PT-2025-53937

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0-syzkaller-13930-g7ebfc85e2cd7 Description The Linux kernel contains a flaw within the udmabuf subsystem. Specifically, if the creation of a scatter-gather sg table fails during the mapping of a dmabuf by...

Code injection

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1 and related NetBackup products. An attacker with access to a NetBackup Client could remotely gather information about any host known to a NetBackup Primary...

Malicious code in gather-electron-interop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 555d7a68ccecdb496e00c51f24d61369422e81fe64f0c26ead5b2512c5b85648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview gather-electron-interop is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Huawei MindSpore Community Concat Information Disclosure Vulnerability

Huawei MindSpore Community is an open source deep learning framework from Huawei, China. Huawei MindSpore Community suffers from an information disclosure vulnerability that stems from accessing a shape allocated from the heap buffer if the input shape size is 0 when performing inferred shape...

CVE-2021-33648

When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers...

CVE-2021-33648

CVE-2021-33648 affects Huawei MindSpore Community’s shape-inference logic for operators including Affine , Concat , MatMul , ArgMinMax , EmbeddingLookup , and Gather . When the input shape size is 0, the code may access data outside of the heap-allocated shape, causing an information-disclosure-t...

Huawei MindSpore Community 缓冲区错误漏洞

Huawei MindSpore Community is an open source deep learning framework from Huawei, China. Huawei MindSpore Community suffers from an information disclosure vulnerability that stems from accessing a shape allocated from the heap buffer if the input shape size is 0 when performing inferred shape...

Deep Panda deploys new rootkit “Fire Chili” by exploiting Log4shell in VMware horizon

THREAT LEVEL: Red For a detailed advisory, download the pdf file here Deep Panda, a Chinese APT group, took advantage of the well-known Log4Shell vulnerability in VMware Horizon servers to deploy a backdoor, rootkit, and steal sensitive data. This threat actor is primarily targeting firms in the...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

Mageia: Security Advisory (MGASA-2013-0372)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

sblim-gather bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

sblim-gather bug fix and enhancement update

An update is available for sblim-gather. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

ALEA-2021:4289 sblim-gather bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

CVE-2021-38175

SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather or change information in the current system without user interaction. The attack would not lead to an impact on the availability of the system, but there...

Cross-site Scripting (XSS) - Stored in leantime/leantime

✍️ Description A malicious actor is able to add New Project with a malicious payload, and upon opening the research menu, the XSS payload is being executed. 🕵️‍♂️ Proof of Concept 1; Log in with a proper roled user 2; Add a new Project to the system at the /projects/showAll/ URI with the + New...

GHSA-QJJ8-32P7-H289 Division by 0 in `ResourceGather`

Impact An attacker can trigger a crash via a floating point exception in tf.rawops.ResourceGather: python import tensorflow as tf tensor = tf.constantvalue=,shape=0,1,dtype=tf.uint32 v = tf.Variabletensor tf.rawops.ResourceGather resource=v.handle, indices=0, dtype=tf.uint32, batchdims=1,...

Heap OOB and CHECK fail in `ResourceGather`

Impact An attacker can trigger a crash via a CHECK-fail in debug builds of TensorFlow using tf.rawops.ResourceGather or a read from outside the bounds of heap allocated data in the same API in a release build: python import tensorflow as tf tensor =...

GHSA-2R8P-FG3C-WCJ4 Heap OOB and CHECK fail in `ResourceGather`

Impact An attacker can trigger a crash via a CHECK-fail in debug builds of TensorFlow using tf.rawops.ResourceGather or a read from outside the bounds of heap allocated data in the same API in a release build: python import tensorflow as tf tensor =...

GHSA-JWF9-W5XM-F437 Heap OOB in TFLite's `Gather*` implementations

Impact TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices. Similar issue exists in Gather implementation. python impor...