AZL-31216 CVE-2023-25665 affecting package tensorflow for versions less than 2.11.1-1

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when SparseSparseMaximum is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow version 2.12 and version 2.11.1...

AZL-31215 CVE-2023-25663 affecting package tensorflow for versions less than 2.11.1-1

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when ctx-stepcontainter is a null ptr, the Lookup function will be executed with a null pointer. A fix is included in TensorFlow 2.12.0 and 2.11.1...

AZL-25843 CVE-2023-28448 affecting package cloud-hypervisor for versions less than 30.0-2

Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for...

AZL-25740 CVE-2023-1249 affecting package kernel for versions less than 5.15.107.1-2

A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 "coredump: Use the vma snapshot in fillfilesnote" not applied yet, then kernel could be affected...

CVE-2023-28664

The Meta Data and Taxonomies Filter WordPress plugin, in versions 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'taxname' parameter of the mdfgettaxoptionsinwidget action, which can only be triggered by an authenticated user...

AZL-25691 CVE-2022-4095 affecting package kernel for versions less than 5.15.107.1-2

A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmdhdlfilter in drivers/staging/rtl8712/rtl8712cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges...

SUSE CVE-2023-28162

While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird 102.9...

GFI Kerio Connect 缓冲区错误漏洞

GFI Kerio Connect is a mail server and all-in-one collaboration tool from GFI. A security vulnerability exists in GFI Kerio Connect versions prior to 10.0.0 that stems from the presence of a stack-based buffer overflow vulnerability...

UBUNTU-CVE-2023-28176

Memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 111, Firefox ESR 102.9, and Thunderbird...

CVE-2023-27400

A vulnerability has been identified in Tecnomatix Plant Simulation All versions V2201.0006. The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the...

CVE-2023-27310

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.2. The client query handler of the affected application fails to check for proper permissions when assigning groups to user accounts. This could allow an authenticated remote attacker to assign administrative groups to...

PT-2023-6477

Name of the Vulnerable Software and Affected Versions Apache Log4j versions prior to 2 Description The issue is related to the Chainsaw and SocketAppender components in Log4j 1.x when used with JRE less than 1.7. An attacker can cause a logging entry involving a specially-crafted hashmap or...

PT-2023-12246 · Yuneec · Yuneec Mantis Q

Name of the Vulnerable Software and Affected Versions: Yuneec Mantis Q affected versions not specified PX4-Autopilot versions 1.11.3 and below Description: An issue in the affected software allows an attacker to gain access to sensitive information via various nuttx commands. Recommendations: For...

AZL-37373 CVE-2023-24532 affecting package golang for versions less than 1.21.6-1

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh...

PT-2023-16005 · Proofpoint · Proofpoint Enterprise Protection

Name of the Vulnerable Software and Affected Versions: Proofpoint Enterprise Protection PPS/POD versions 8.20.0 and below Description: The webservices in Proofpoint Enterprise Protection contain a vulnerability that allows an anonymous user to execute remote code through 'eval injection'...

AZL-39496 CVE-2022-3854 affecting package ceph for versions less than 16.2.10-3

A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service...

AZL-36998 CVE-2021-20251 affecting package samba for versions less than 4.18.3-1

A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if special conditions are met...

AZL-25611 CVE-2023-23004 affecting package kernel for versions less than 5.15.102.1-1

In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidpplanes.c misinterprets the getsgtable return value expects it to be NULL in the error case, whereas it is actually an error pointer...

AZL-31287 CVE-2022-3162 affecting package kubernetes for versions less than 1.25.4-0

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-13830 CVE-2022-36021 affecting package redis for versions less than 6.2.11-1

Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands like SCAN or KEYS with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18...