optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-41199 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2021-41199 Source advisory: OSV:GHSA-5HX2-QX8J-QJQM...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-41206 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2021-41206 Source advisory: OSV:GHSA-PGCQ-H79J-2F69...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-41207 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2021-41207 Source advisory: OSV:GHSA-7V94-64HJ-M82H...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-41216 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2021-41216 Source advisory: OSV:GHSA-3FF2-R28G-W7H9...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-41217 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2021-41217 Source advisory: OSV:GHSA-5CRJ-C72X-M7GQ...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-41223 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2021-41223 Source advisory: OSV:GHSA-F54P-F6JP-4RHR...

optimuspyspark (>=2.0.4, <=2.0.6), pytorch-es (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-41228 via tensorflow (1.6.0)

tensorflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - optimuspyspark =2.0.4, =0.1.0, =0.12.0, =0.7.2, =0.10.0 Source cves: CVE-2021-41228 Source advisory: OSV:GHSA-3RCW-9P9X-582V...

Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton

By Claudio Bozzato and Lilith --;. Following our previous engagements see blog posts 1, 2, 3 and 4 with Microsoft's Azure Sphere IoT platform, we decided to take another look at the device, without all the rush and commotion that normally entails a hacking challenge. Today, we’re... This is only...

WordPress Plugin Access Control Error Vulnerability (CNVD-2021-101466)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor...

WordPress Plugin Information Disclosure Vulnerability (CNVD-2021-101464)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor version...

WordPress Plugin Cross-Site Scripting Vulnerability (CNVD-2021-101465)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The WordPress plugin is a WordPress open source application plugin. WordPress plugin Simple Download Monitor version 3.9.5 before the cross-site scripting vulnerability, the vulnerability stems from...

Microsoft Azure Sphere Security Monitor SMSyscallCommitImageStaging 1BL firmware downgrade vulnerability

Summary A firmware downgrade vulnerability exists in the Security Monitor SMSyscallCommitImageStaging 1BL functionality of Microsoft Azure Sphere 21.01. A specially-crafted set of Secmon syscalls can lead to downgrading the version of the 1BL firmware. An attacker can use syscalls to trigger this...

Microsoft Azure Sphere Security Monitor SMSyscallStageBaseManifests image validation signature check bypass vulnerability

Summary A signature check bypass vulnerability exists in the Security Monitor SMSyscallStageBaseManifests image validation functionality of Microsoft Azure Sphere 21.01. A specially crafted manifest can lead to a firmware downgrade. An attacker can use syscalls to trigger this vulnerability. Test...

Microsoft Azure Sphere Security Monitor SMSyscallStageBaseManifests offset calculation out-of-bounds read vulnerability

Summary An out-of-bounds read vulnerability exists in the Security Monitor SMSyscallStageBaseManifests offset calculation of Microsoft Azure Sphere 21.01. A specially crafted manifest could lead to information disclosure. An attacker can use syscalls to trigger this vulnerability. Tested Versions...

CVE-2021-24695

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

CVE-2021-24697

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1 sdmactivetab GET parameter and 2 sdmstatsstartdate/sdmstatsenddate POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24693

The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the "File Thumbnail" post meta before outputting it in some pages, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks. Given the that XSS is triggered even when the...

CVE-2021-24698

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download...

CVE-2021-24698

The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the download...

Authentication flaw

The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...