BIT-TENSORFLOW-2021-41215 Null pointer exception in `DeserializeSparse`

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for DeserializeSparse can trigger a null pointer dereference. This is because the shape inference function assumes that the serializesparse tensor is a tensor with positive rank and having 3 ...

BIT-TENSORFLOW-2021-41217 Null pointer exception when `Exit` node is not preceded by `Enter` op

TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in th...

BIT-TENSORFLOW-2021-41218 Integer division by 0 in `tf.raw_ops.AllToAll`

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for AllToAll can be made to execute a division by 0. This occurs whenever the splitcount argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on...

BIT-TENSORFLOW-2021-41221 Access to invalid memory during shape inference in `Cudnn*` ops

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the Cudnn operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the input, inputh and inputc parameters are n...

BIT-TENSORFLOW-2021-41227 Arbitrary memory read in `ImmutableConst`

TensorFlow is an open source platform for machine learning. In affected versions the ImmutableConst operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the tstring TensorFlow string class has a special case for memory mapped strings but the operation...

PT-2024-3141

Name of the Vulnerable Software and Affected Versions Tutor LMS versions up to, and including, 2.6.1 Description The issue is related to a SQL Injection vulnerability due to insufficient protection of the SQL query structure when handling the question id parameter. This allows a remote attacker t...

PT-2024-3142 · WordPress · The Tutor Lms

Name of the Vulnerable Software and Affected Versions: The Tutor LMS – eLearning and online course solution plugin for WordPress versions up to, and including, 2.6.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the erase tutor dat...

WordPress Custom Field Template Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field Template Type Plugin Vulnerable versions = 2.6 Fixed in 2.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25919 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9a3d14013fc0 Credits LVT-tholv2k Required privilege...

PT-2024-12218

Name of the Vulnerable Software and Affected Versions dnspython versions prior to 2.6.1 eventlet versions prior to 0.35.2 Description The issue allows remote attackers to interfere with DNS name resolution by quickly sending an invalid packet from the expected IP address and source port, also kno...

WordPress SimpleMap Store Locator Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)

Software SimpleMap Store Locator Type Plugin Vulnerable versions = 2.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22282 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2ef3007a7000 Credits Dimas Maulana Required...

CVE-2023-50857

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit.This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing,...

WordPress Automation By Autonami Plugin <= 2.6.1 is vulnerable to SQL Injection

Software Automation By Autonami Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.7.0 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-50857 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID fc113d13a945 Credits Muhammad Daffa Required privilege...

CVE-2023-47853

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in myCred myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin allows Stored XSS.This issue affects myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin: from n/a...

PT-2023-30647 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin versions through 2.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows...

PT-2023-29975 · Prestashop +1 · Bl Modules Csvfeeds Module +1

Name of the Vulnerable Software and Affected Versions: Bl Modules csvfeeds module for PrestaShop versions prior to 2.6.1 Description: The issue allows a guest to download personal information without restriction due to too permissive access control. This lack of control does not force the...

CVE-2022-45360 WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1...

PT-2023-14649 · Unknown · Commenter Emails

Name of the Vulnerable Software and Affected Versions: Commenter Emails versions from n/a through 2.6.1 Description: The issue is related to the improper neutralization of formula elements in a CSV file, affecting Commenter Emails. Recommendations: For versions from n/a through 2.6.1, update to a...

AZL-34805 CVE-2023-44487 affecting package influxdb for versions less than 2.6.1-11

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Security Bulletin: IBM Cloud Pak for Network Automation 2.6.1 fixes multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.6.1 fixes multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-32681 DESCRIPTION: python-requests could allow a remote attacker to obtain sensitive information, caused by the leaking of Proxy-Authorization...

WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection

Software WP Project Manager Type Plugin Vulnerable versions = 2.6.0 Fixed in 2.6.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-34383 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 02d3661940eb Credits Theodoros Malachias Required privilege...