MAL-2025-37658 Malicious code in umbra-ginkgo-onz4 (npm)

The package umbra-ginkgo-onz4 was found to contain malicious code...

CVE-2024-37658

creationtimestamp| type| source ---|---|--- 2025-07-07 19:38:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltfjxx5nie2b...

CVE-2024-37658

An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/memberconfirm.php...

CVE-2023-37658

fast-poster v2.15.0 is vulnerable to Cross Site Scripting XSS. File upload check binary of img, but without strictly check file suffix at /server/fast.py - ApiUploadHandler.post causes stored XSS...

CVE-2021-37658

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type tf.rawops.MatrixSetDiagV. The implementation has incomplete validation that the value of k is a...

CVE-2023-37658

fast-poster v2.15.0 is vulnerable to Cross Site Scripting XSS. File upload check binary of img, but without strictly check file suffix at /server/fast.py - ApiUploadHandler.post causes stored XSS...

CVE-2023-37658

fast-poster v2.15.0 is vulnerable to Cross Site Scripting XSS. File upload check binary of img, but without strictly check file suffix at /server/fast.py - ApiUploadHandler.post causes stored XSS...

CVE-2023-37658

fast-poster v2.15.0 is vulnerable to Cross Site Scripting XSS. File upload check binary of img, but without strictly check file suffix at /server/fast.py - ApiUploadHandler.post causes stored XSS...

CVE-2023-37658

CVE-2023-37658 affects fast-poster v2.15.0. The vulnerability is in the file upload path: ApiUploadHandler.post in /server/fast.py, where the image check is based on binary data and does not strictly verify the file suffix, enabling stored XSS. Several connected sources confirm this issue; exploi...

deepdefacer (>=0.0.2, <=1.0.4), delft (>=0.1.2, <=0.2.0) potentially affected by CVE-2021-37658 via tensorflow-gpu (1.8.0)

tensorflow-gpu PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - deepdefacer =0.0.2, =0.1.2, =0.2.0 Source cves: CVE-2021-37658 Source advisory: OSV:GHSA-6P5R-G9MQ-GGH2...

accuinsight (>=1.0.47, <=3.0.0), adapt-diagnostics (>=1.2.0, <=1.6.0) +331 more potentially affected by CVE-2021-37658 via tensorflow (>=2.0.0, <=2.3.2)

tensorflow PYPI version =2.0.0, =1.0.47, =1.2.0, =0.0.1, =0.5.6, =0.5.0, =0.1.0, =0.10.0.dev0, =2.0.0b0, =0.5.0, =1.1.0 and more Source cves: CVE-2021-37658 Source advisory: GHSA-6P5R-G9MQ-GGH2...

alphapulldown (>=0.21.2, <=0.22.3), autokeras (1.0.16) +44 more potentially affected by CVE-2021-37658 via tensorflow (2.5.0)

tensorflow PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - alphapulldown =0.21.2, =1.1.0, =0.8.1, =3.3.0, =0.0.24, =1.0.0, =2.0.2, =0.7.0, =0.3.11, =1.33.0, =1.33.3 and more Source cves: CVE-2021-376...

abmarl (>=0.1.1, <=0.1.3), agrothon (>=1.1.5, <=1.3.2) +83 more potentially affected by CVE-2021-37658 via tensorflow (>=2.4.0, <=2.4.2)

tensorflow PYPI version =2.4.0, =0.1.1, =1.1.5, =2.1.0, =0.0.1, =0.0.6, =0.1.0, =1.4.0, =1.2.2, =20210221.0.0, =0.7.2, =0.7.4 and more Source cves: CVE-2021-37658 Source advisory: GHSA-6P5R-G9MQ-GGH2...

audeep (>=0.9.2, <=0.9.6a1), cryocare (>=0.0.1, <=0.0.2) +17 more potentially affected by CVE-2021-37658 via tensorflow-gpu (1.15.5)

tensorflow-gpu PYPI version 1.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - audeep =0.9.2, =0.0.1, =0.6.7a1, =0.2.5, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =1.3.0, =0.0.4, =0.1.3, =0.4.0, =0.0.6, =0.0.8 and more...

classitransformers (0.0.1), pyclue (>=0.1.0, <=0.1.2) +4 more potentially affected by CVE-2021-37658 via tensorflow-gpu (1.15.2)

tensorflow-gpu PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - classitransformers 0.0.1 - pyclue =0.1.0, =0.1.1, =0.1.2, =0.1.2, =0.1.3 Source cves: CVE-2021-37658 Source advisory:...

axelerate (>=0.5.8, <=0.5.9), bianbu-ai-toolkit-tf1 (1.0.6) +27 more potentially affected by CVE-2021-37658 via tensorflow (1.15.3)

tensorflow PYPI version 1.15.3 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.8, =0.0.1.2, =0.0.13, =1.1.0, =0.22.0, =1.6.0, =4.1.3, =0.10.0.dev1, =0.11.0 - muffnn 2.3.1 - neoepiscope 0.4.0 and more...

keras-pandas (>=1.1.2, <=2.0.1), learna-tools (0.1.0) potentially affected by CVE-2021-37658 via tensorflow (1.4.0)

tensorflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - keras-pandas =1.1.2, =2.0.1 - learna-tools 0.1.0 Source cves: CVE-2021-37658 Source advisory: OSV:GHSA-6P5R-G9MQ-GGH2...

branchedgp (1.0.0), fate-client (>=0.1.0, <=1.5.3) +9 more potentially affected by CVE-2021-37658 via tensorflow (1.15.4)

tensorflow PYPI version 1.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - branchedgp 1.0.0 - fate-client =0.1.0, =0.2.2, =0.2.0, =0.2.4, =0.0.5.dev0, =1.5.0, =0.1.6, =0.2.4 Source cves: CVE-2021-37658 Source...

adpred (>=1.1.2, <=1.2.7), aix360 (>=0.2.0, <=0.2.1) +73 more potentially affected by CVE-2021-37658 via tensorflow (1.14.0)

tensorflow PYPI version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - adpred =1.1.2, =0.2.0, =1.0.4, =0.1.1, =1.0.2, =0.0.4, =0.1.0, =0.92.0, =0.12.0, =0.22.0 and more Source cves: CVE-2021-37658 Source...

axelerate (>=0.5.2, <=0.5.5), bert-experimental (1.0.0) +24 more potentially affected by CVE-2021-37658 via tensorflow (1.15.2)

tensorflow PYPI version 1.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - axelerate =0.5.2, =2.0.1, =1.0.1, =0.1.0.dev1, =1.5.0.dev20210429, =1.5.0.dev20210512 - fedlearner-manylinux 1.5.0.dev20210429 -...