CVE-2021-44149

CVE-2021-44149 affects Trusted Firmware OP-TEE Trusted OS up to version 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoCs lacks proper secure access configuration for wakeup-related registers, enabling a TrustZone bypass where a NonSecure World process can perform arbitrary reads/writes of Sec...

CVE-2021-44149

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write...

Cross site scripting

Cross Site Scripting XSS in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter...

CVE-2020-19611

Cross Site Scripting XSS in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter...

PT-2021-24046

Name of the Vulnerable Software and Affected Versions: Trusted Firmware OP-TEE Trusted OS versions through 3.15.0 Description: An issue in the OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers. This results in TrustZone bypass, allowi...

Racktables 跨站脚本漏洞

Racktables is a data center asset management system. It is used for data center and server room asset management. Racktables suffers from a cross-site scripting vulnerability that originates from cross-site scripting XSS in the redirection module that allows attackers to inject arbitrary web scri...

CVE-2020-19611: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter...

CVE-2021-44149: Undefined Security Weakness

An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. The OPTEE-OS CSU driver for NXP i.MX6UL SoC devices lacks security access configuration for wakeup-related registers, resulting in TrustZone bypass because the NonSecure World can perform arbitrary memory read/write...

CVE-2021-41206 Incomplete validation of shapes in multiple TF ops

TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or CHECK-fail related crashes...

PT-2021-16133

Name of the Vulnerable Software and Affected Versions GamePress WordPress plugin versions prior to 1.1.1 Description The issue is related to Reflected Cross-Site Scripting. The op edit POST parameter is not properly escaped before being outputted back in multiple Game Option pages, leading to...

PT-2021-27743

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 1 crash type. The crash state involves several functions, including i zval ptr dtor, concat function,...

PT-2021-21250

Name of the Vulnerable Software and Affected Versions OrbiTeam BSCW Classic versions prior to 5.0.12 OrbiTeam BSCW Classic versions prior to 5.1.10 OrbiTeam BSCW Classic versions prior to 5.2.4 OrbiTeam BSCW Classic versions prior to 7.3.3 OrbiTeam BSCW Classic versions prior to 7.4.3 Description...

PYSEC-2021-776

TensorFlow is an end-to-end open source platform for machine learning. In affected versions due to incomplete validation in MKL implementation of requantization, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap...

PYSEC-2021-559

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of tf.rawops.StringNGrams is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The...

CVE-2021-37643

TensorFlow is an end-to-end open source platform for machine learning. If a user does not provide a valid padding value to tf.rawops.MatrixDiagPartOp, then the code triggers a null pointer dereference if input is empty or produces invalid behavior, ignoring all values after the first. The...

PT-2021-22234

Name of the Vulnerable Software and Affected Versions Wasm3 version 0.5.0 Description The issue is a heap-based buffer overflow in the op Const64 function, which is called from EvaluateExpression and m3 LoadModule. Recommendations For Wasm3 version 0.5.0, consider disabling the op Const64 functio...

CVE-2019-25052

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...

Information disclosure

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...

CVE-2019-25052

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information...

CVE-2019-25052

The CVE-2019-25052 issue affects Linaro OP-TEE up to versions before 3.7.0. Root cause: processing inconsistent or malformed data allows calling update and final cryptographic functions directly. Impact: a crash that could leak sensitive information. Exploitation details or in-the-wild usage are ...