CVE-2021-23555

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine...

CVE-2021-23555

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine...

CVE-2021-23555

The CVE-2021-23555 entry concerns the Node.js vm2 sandbox module (pre-3.9.6) allowing a sandbox bypass via direct access to host error objects generated during stack-trace creation, enabling possible remote arbitrary code execution. Concrete details across connected docs indicate this affects vm2...

Google Tensorflow Input Validation Error Vulnerability (CNVD-2022-09896)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to create an operation that contains a tensor with enough elements to cause an integer overflow...

Google Tensorflow Resource Management Error Vulnerability (CNVD-2022-09860)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a resource management error vulnerability that stems from the GraphDef format in TensorFlow not allowing self-recursive functions. No detailed vulnerability detail...

Google Tensorflow has an unspecified vulnerability (CNVD-2022-09895)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc...

Google Tensorflow buffer overflow vulnerability (CNVD-2022-09899)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in Google TensorFlow, which stems from a typo in TensorFlow's SpecializeType that could be exploited by an attacker to read and write outside the bounds of the dat...

Google Tensorflow code issue vulnerability (CNVD-2022-09867)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a code issue vulnerability that stems from TensorFlow triggering null pointer dereferences if default settings are used when building the XLA compilation cache. No...

Google Tensorflow Input Validation Error Vulnerability (CNVD-2022-09897)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, U.S. Google TensorFlow is vulnerable to an input validation error that could be exploited by an attacker to create an operation containing a tensor with enough elements to cause an integer overflow...

Google Tensorflow code issue vulnerability (CNVD-2022-09885)

Google TensorFlow is an end-to-end open source platform for machine learning from Google USA. Google TensorFlow is vulnerable to a code issue that stems from the fact that TensorFlow may fail to specialize types during shape inference. No detailed vulnerability details are currently available...

Google Tensorflow Buffer Overflow Vulnerability (CNVD-2022-09884)

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google Tensorflow is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to build a TFLite model that allows limited reads and writes to the outside of arrays in TFLit...

Google Tensorflow code issue vulnerability (CNVD-2022-09892)

Google TensorFlow is an end-to-end open-source platform for machine learning from Google, a U.S. company. Google TensorFlow is vulnerable to a code issue that could be exploited by an attacker to cause a crash...

Google Tensorflow numeric error vulnerability (CNVD-2022-09879)

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A numerical error vulnerability exists in Google Tensorflow, which could be exploited by an attacker to create a TFLite model that triggers a division in the "BiasAndClamp" implementation. The...

Google Tensorflow Code Issue Vulnerability (NVD-C-2022-117042)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. Google TensorFlow suffers from a code issue vulnerability that can be exploited by an attacker to cause a process to crash because it encounters an incorrect StatusOr value and force it to extra...

VMware Fusion 12.x < 12.2.0 Heap Overflow RCE (VMSA-2022-0001)

VMware Fusion contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. Not...

Virtuozzo Hybrid Infrastructure 5.0 (5.0.0-137)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' interoperability and help expand their services. The improvements cover compute services, object storage, security, and monitoring. Additionally, this release delivers stability...

CVE-2022-23592

Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a DCHECK which is a no-op during production. An attacker can control the inputidx variable such that ix would be larger than the number of...

CVE-2022-23593

Tensorflow is an Open Source Machine Learning Framework. The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes. If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector...

CVE-2022-23566

Tensorflow is an Open Source Machine Learning Framework. TensorFlow is vulnerable to a heap OOB write in Grappler. The setoutput function writes to an array at the specified index. Hence, this gives a malicious user a write primitive. The fix will be included in TensorFlow 2.8.0. We will also...

CVE-2022-23577

Tensorflow is an Open Source Machine Learning Framework. The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, ...