CVE-2023-23012

Cross Site Scripting XSS vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the input bgcol in file Weeks.php...

craigrodway classroombookings 跨站脚本漏洞

Craigrodway Classroombookings is a Php, Mysql based school room booking system by Craigrodway individual developer. A security vulnerability exists in craigrodway classroombookings version 2.6.4. An attacker can exploit this vulnerability to execute arbitrary code via the input bgcol in the...

WordPress theme Workreap 安全漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress theme is a theme for WordPress. A security vulnerability exists in WordPress theme Workreap versions prior to 2.6.4. An...

PT-2022-26391 · WordPress · Workreap

Name of the Vulnerable Software and Affected Versions: Workreap WordPress theme versions prior to 2.6.4 Description: The issue allows any user to delete any post by knowing or guessing the id, due to the lack of verification that an addon service belongs to the user issuing the request or that it...

Apache Pulsar Brokers and Proxies vulnerable to Improper Certificate Validation

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middl...

CVE-2022-33683

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middl...

Design/Logic Flaw

A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE...

Security update for freeciv (important)

openSUSE Security Update: Security update for freeciv Announcement ID: openSUSE-SU-2022:10096-1 Rating: important References: 1202548 Cross-References: CVE-2022-6083 Affected Products: openSUSE Backports SLE-15-SP3 An update that fixes one vulnerability is now available. Description: This update...

Segfault due to missing support for quantized types

Impact There is a potential for segfault / denial of service in TensorFlow by calling tf.compat.v1. ops which don't yet have support for quantized types added after migration to TF 2.x: python import numpy as np import tensorflow as tf...

Missing validation results in undefined behavior in `QuantizedConv2D`

Impact The implementation of tf.rawops.QuantizedConv2D does not fully validate the input arguments: python import tensorflow as tf input = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 filter = tf.constant1, shape=1, 2, 3, 3, dtype=tf.quint8 bad args mininput = tf.constant, shape=0,...

Missing validation causes denial of service via `Conv3DBackpropFilterV2`

Impact The implementation of tf.rawops.Conv3DBackpropFilterV2 does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.rawops.Conv3DBackpropFilterV2 input=tf.constant.5053710941,...

Google TensorFlow Input Validation Error Vulnerability (CVE-2022-29192)

Google TensorFlow, an end-to-end open source platform for machine learning from Google, Inc. is vulnerable to an input validation error in versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which originates in tf.rawops QuantizeAndDequantizeV4Grad does not fully validate the input parameters and c...

Google TensorFlow code issue vulnerability (CNVD-2022-44171)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 are vulnerable to a code issue stemming from tf.rawops. QuantizedConv2D does not fully validate input parameters. No detailed...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-44167)

Google TensorFlow, an end-to-end open source platform for machine learning from Google, Inc. is vulnerable to input validation errors in versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, stemming from tf.rawops LoadAndRemapMatrix does not fully validate the input parameters and can be exploited t...

Google TensorFlow suffers from an unspecified vulnerability (CNVD-2022-44211)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow versions prior to 2.9.0, prior to 2.8.1, prior to 2.7.2, and prior to 2.6.4, which stems from incorrect logic when comparing sizet when writi...

Google TensorFlow Input Validation Error Vulnerability (CNVD-2022-44209)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. An input validation error vulnerability exists in Google TensorFlow versions prior to 2.9.0, prior to 2.8.1, prior to 2.7.2, and prior to 2.6.4, which stems from the presence of a non-numeric...

Type confusion

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions e.g., CHECKLT, CHECKGT, etc. have an incorrect logic when comparing sizet and int values. Due to type conversion rules, several of t...

Google TensorFlow代码注入漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A code injection vulnerability exists in TensorFlow versions prior to 2.9.0, prior to 2.8.1, prior to 2.7.2, and prior to 2.6.4, with no detailed vulnerability details provided at this time...

CVE-2020-8225

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials...

CVE-2022-29211

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.histogramfixedwidth is vulnerable to a crash when the values array contain Not a Number NaN elements. The implementation assumes that all floating point operation...