PYSEC-2022-136

Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is covered by the DCHECK function however, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first cas...

PYSEC-2022-141

Tensorflow is an Open Source Machine Learning Framework. The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, ...

CVE-2022-23576

Tensorflow is an Open Source Machine Learning Framework. The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number ...

CVE-2022-23583

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a "SavedModel" such that any binary op would trigger "CHECK" failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the "dtype" no...

CVE-2022-24129

The vulnerability CVE-2022-24129 affects the Shibboleth Identity Provider OIDC OP plugin before version 3.0.4. Root cause: insufficient restriction of the request_uri parameter enables server-side request forgery (SSRF), allowing interaction with arbitrary third-party HTTP services. Impact is SSR...

PT-2022-16092

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description The implementation of OpLevelCostEstimator::CalculateTensorSize is vulnerable to a...

PT-2022-16483

Name of the Vulnerable Software and Affected Versions Shibboleth Identity Provider OIDC OP plugin versions prior to 3.0.4 Description The issue allows server-side request forgery SSRF due to insufficient restriction of the request uri parameter. This enables attackers to interact with arbitrary...

CVE-2022-24129: Server-Side Request Forgery (SSRF)

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

PT-2022-1628 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.17-rc4 Description: A flaw in the kvm s390 guest sida op function in KVM for s390 in the Linux kernel allows a local attacker with normal user privileges to obtain unauthorized memory write access. This issue ...

PT-2022-7663

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the incorrect update of reference counters in the gpmi nfc exec op function of the MTD driver in the Linux kernel. This can potentially allow an attacker to impac...

PT-2022-15717

Name of the Vulnerable Software and Affected Versions Jerryscript version 3.0.0 Description A stack overflow issue was discovered in Jerryscript via the ecma op object find own function in /ecma/operations/ecma-objects.c. Recommendations For Jerryscript version 3.0.0, consider disabling the ecma ...

PT-2021-27989

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack buffer overflow error, as indicated by a crash report. The crash occurs in the pdfi oc is ocg visible, pdfi op BDC, and pdf...

CVE-2021-45463

Due to the use of the system command in the Magick-Load op used by gegl an attacker is able to craft a command line path that is able to lead to the execution of arbitrary shell commands that impacts availability, confidentiality and integrity...

Exploit for Race Condition in Linux Linux_Kernel

CVE-2021-44733: Fuzzing and exploitation of a use-after-free i...

GHSA-J5QG-W9JG-3WG3 Inability to de-op players if listed in ops.txt with non-lowercase letters

Impact Originally reported in iTXTech/Genisys1188 txt PotterHarry98 potterharry98 deop PotterHarry98 will remove potterharry98 from the ops.txt but not PotterHarry98. Operator permissions are checked using Config-exists with lowercase=true, which will result in a match:...

Unspecified Vulnerability in Trusted Firmware M

ARM Trusted Firmware M TFM is an open source software from ARM UK. Provides a set of highly configurable software components to create a trusted execution environment. A security vulnerability exists in Trusted Firmware OP-TEE Trusted OS prior to version 3.15.0, which stems from the lack of secur...

CVE-2021-44149

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write...

Design/Logic Flaw

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write...

CVE-2021-44149

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write...

CVE-2021-44149

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write...