Coolwindhf

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 0.0.34 **Description** The software fails to detect ` operator.attrgetter` function calls within pickle payloads, which allows security checks to be bypassed. Remote attackers can create malicious pickle files utilizing ` operator.attrgetter` in reduce methods to achieve remote code execution when the `pickle.load()` function processes the file. **Recommendations** Update to version 0.0.34 or later.

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 0.0.34 **Description** The software fails to detect the ` operator.methodcaller` built-in function when scanning pickle files for malicious code. This allows attackers to create malicious pickle payloads using ` operator.methodcaller` that bypass detection and achieve remote code execution when processed by the `pickle.load()` function. **Recommendations** Update to version 0.0.34 or later.

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 0.0.33 **Description** An issue exists where the software fails to detect malicious pickle files that utilize the `reduce` method to invoke the `numpy.f2py.crackfortran.myeval()` function. This allows attackers to create specially crafted pickle files containing arbitrary code that bypasses detection and leads to remote code execution when the files are loaded. **Recommendations** Update to version 0.0.33 or later.

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 0.0.33 **Description** The software fails to detect malicious pickle files that utilize the `numpy.f2py.crackfortran.param eval()` function within reduce methods. This flaw allows attackers to bypass security checks by embedding undetected code in pickle files. When an application loads untrusted pickle data, the embedded code executes during deserialization, leading to arbitrary code execution. **Recommendations** Update to version 0.0.33 or later.

**Name of the Vulnerable Software and Affected Versions** picklescan versions prior to 0.0.33 **Description** The software fails to detect `operator.methodcaller` function calls within pickle files, which allows security checks to be bypassed. Remote attackers can create malicious pickle payloads using `operator.methodcaller` to execute arbitrary code upon loading, compromising systems that use the tool for validation. **Recommendations** Update to version 0.0.33 or later.