PT-2022-28687

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.24 Description The issue concerns the behavior of READ near OFFSET MAX in NFSD. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.15.2...

PT-2022-28617

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.180 Description The issue is related to limiting I2C reads to I2C SMBUS BLOCK MAX in the ee1004 eeprom. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-28796

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.16.3 through v5.16.9 Description The issue is related to the eeprom module, specifically the ee1004 component, where I2C reads are not properly limited to I2C SMBUS BLOCK MAX. This could potentially lead to security...

PT-2022-28653

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10.94 through v5.10.100 Description The issue is related to limiting I2C reads to I2C SMBUS BLOCK MAX in the ee1004 eeprom. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux...

PT-2022-28712

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15.17 through v5.15.23 Description The issue is related to the eeprom module, specifically the ee1004 component, where I2C reads are not properly limited to I2C SMBUS BLOCK MAX. This could potentially lead to security...

PT-2022-28762

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.10 Description The issue concerns the behavior of READ near OFFSET MAX in NFSD. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.16.1...

CVE-2022-24671

A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on...

Privilege escalation

A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on...

CVE-2022-24671

CVE-2022-24671 is a local privilege-escalation vulnerability in Trend Micro Antivirus for Mac. The flaw resides in the post-update handling (program_after_update) where an attacker can abuse symbolic links to modify a file during the update process, enabling privilege escalation to root if low-pr...

CVE-2022-24671

A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the ability to execute low-privileged code on...

QA Report

Lower max fee percentage Currently fees can be set as high as 100%, may consider a lower max fee to reduce rug risk src/modules/TurboClerk.sol:38: requirenewDefaultFeePercentage if customFeePercentageForSafe != 0 return customFeePercentageForSafe; --- The text was updated successfully, but these...

USN-5299-1: Linux kernel vulnerabilities

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could reassemble mixed encrypted and plaintext fragments. A physically proximate attacker could possibly use this issue to inject packets or exfiltrate selected fragments. CVE-2020-26147 It was discovered that the bluetooth...

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

GHSA-87V6-CRGM-2GFJ Division by zero in Tensorflow

Impact The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0: python import tensorflow as tf import numpy as np tf.rawops.FractionalMaxPool value=tf.constantvalue=1, 4, 2, 3, dtype=tf.int64, poolingratio=1.0, 1.44, 1.73, 1.0, pseudorandom=False,...

GHSA-3MW4-6RJ6-74G5 Null pointer dereference in TensorFlow

Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. python import tensorflow as tf tf.rawops.QuantizedMaxPool input = tf.constant4, dtype=tf.quint8, mininput = , maxinput = 1, ksize = 1, 1, 1, 1,...

CVE-2022-21739

Tensorflow is an Open Source Machine Learning Framework. The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow...

CVE-2022-21735

Tensorflow is an Open Source Machine Learning Framework. The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google Google. Google Tensorflow is vulnerable to a code issue that stems from an undefined behavior in the QuantizedMaxPool implementation, where user-controlled input can trigger a reference binding to a null...

PT-2022-15075

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected Description The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0. This issue can be exploited by...

UBUNTU-CVE-2022-21708

graphql-go is a GraphQL server with a focus on ease of use. In versions prior to 1.3.0 there exists a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL...