Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

...

PYSEC-2024-222

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch adde...

CVE-2024-27318

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch adde...

The vulnerability of the Bluetooth module of the EMUI operating system of HarmonyOS allows a hacker to disable the Bluetooth function.

The vulnerability of the Bluetooth module of the EMUI operating system of HarmonyOS is related to the disclosure of information in an erroneous data field. Exploiting this vulnerability could allow a remote attacker to cause the Bluetooth function to become unavailable...

The vulnerability of the Bluetooth module of the HarmonyOS operating system, which allows a perpetrator to compromise privacy

The vulnerability of the Bluetooth module of the HarmonyOS operating system is related to the disclosure of information in an erroneous data field. Exploiting this vulnerability could allow a remote attacker to compromise confidentiality...

DRUPAL-CONTRIB-2023-040

The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. the Paragraphs system. Access to these forms isn't properly validated, allowing a user with the "access content" permission to view and edit fields on entities...

Data field - Moderately critical - Access bypass - SA-CONTRIB-2023-040

The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. the Paragraphs system. Access to these forms isn't properly validated, allowing a user with the "access content" permission to view and edit fields on entities...

The vulnerability of the Codesys software suite for industrial automation integrated into Schneider Electric’s programmable logic controllers allows a perpetrator to compromise data integrity.

The vulnerability of the Codesys software suite for industrial automation integrated into Schneider Electric’s programmable logic controllers is related to the disclosure of information in the incorrect data field. Exploiting this vulnerability could allow a malicious actor to compromise the...

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory for example "../../../etc/passwd"

...

CVE-2022-25882

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"...

UBUNTU-CVE-2022-25882

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"...

PT-2023-12827 · Onnx · Onnx

Name of the Vulnerable Software and Affected Versions: onnx versions prior to 1.13.0 Description: The issue allows Directory Traversal, where the external data field of the tensor proto can contain a path to a file outside the model's current directory or user-provided directory. For example, an...

The vulnerability of the Remote Desktop Protocol Client protocol on the Windows operating system, which allows a hacker to disclose protected information

The vulnerability of the Remote Desktop Protocol Client on the Windows operating system is related to the disclosure of information in the erroneous data field. Exploiting this vulnerability allows a malicious actor to disclose the protected information from a remote location...

CVE-2022-31267

Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext '[email protected]\n\trole = "admin"' value...

The vulnerability of the Remote Desktop Protocol Client protocol on the Microsoft Windows operating system, which allows a hacker to disclose protected information

The vulnerability of the Remote Desktop Protocol Client on the Microsoft Windows operating system is related to the disclosure of information in the erroneous data field. Exploiting this vulnerability allows a malicious actor to disclose the protected information from a remote location...

The driver’s vulnerability allows for the functionality of Storage Spaces controllers on Windows operating systems, enabling a hacker to exploit this to disclose protected information.

The vulnerability of the driver for enabling Storage Spaces on Windows operating systems is related to the disclosure of information in a erroneous data field. Exploiting this vulnerability can allow an attacker to disclose protected information...

The driver’s vulnerability allows for the functionality of Storage Spaces controllers on Windows operating systems, enabling a hacker to exploit this to disclose protected information.

The vulnerability of the driver for enabling Storage Spaces on Windows operating systems is related to the disclosure of information in a erroneous data field. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the Microsoft Message Queuing (MSMQ) service on the Microsoft Windows operating system allows unauthorized access to protected information.

The vulnerability of the Microsoft Message Queuing MSMQ service on the Microsoft Windows operating system is related to the disclosure of information in the error data field. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the dictsort template pattern in the Django web framework allows a attacker to access confidential information.

The vulnerability of the dictsort template pattern in the Django web framework relates to the disclosure of information in the error data field. Exploiting this vulnerability can allow an attacker, operating remotely, to obtain confidential system information...

AZL-8514 CVE-2022-22844 affecting package libtiff for versions less than 4.3.0-2

LibTIFF 4.3.0 has an out-of-bounds read in TIFFmemcpy in tifunix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field...