5235 matches found
log4j: improper validation of certificate with host mismatch in SMTP appender
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...
AlmaLinux 8 : kernel (ALSA-2021:1578)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:1578 advisory. - A memory leak in the sofsetgetlargectrldata function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of...
PYSEC-2022-92
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer...
PYSEC-2022-147
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer...
PYSEC-2022-147
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer...
CVE-2022-23583 `CHECK`-failures in binary ops in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer...
CVE-2022-23583
Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the dtype no longer...
CVE-2021-44886
In Zammad 5.0.2, agents can configure "out of office" periods and substitute persons. If the substitute persons didn't have the same permissions as the original agent, they could receive ticket notifications for tickets that they have no access to...
PT-2022-16100
Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected Description A malicious user can cause a denial of service by altering a SavedModel such that any binary op would trigger CHECK failures. This...
PT-2022-2697
Name of the Vulnerable Software and Affected Versions cURL affected versions not specified Description The issue is related to the implementation of the HSTS HTTP Strict Transport Security mechanism in the cURL utility. It could be bypassed if the hostname in the given URL used a trailing dot whi...
Mandiant-Azure-AD-Investigator - PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity
This repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are "high-fidelity" indicators of compromise, while other artifacts are so called "dual-use" artifacts. Dual-use artifacts may be related to thre...
CVE-2021-46343
There is an Assertion 'contextp-token.type == LEXERLITERAL' failed at /jerry-core/parser/js/js-parser-expr.c in JerryScript 3.0.0...
UBUNTU-CVE-2021-46349
There is an Assertion 'type == ECMAOBJECTTYPEGENERAL || type == ECMAOBJECTTYPEPROXY' failed at /jerry-core/ecma/operations/ecma-objects.c in JerryScript 3.0.0...
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.
...
CVE-2021-30353
Improper validation of function pointer type with actual function signature can lead to assertion in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables...
PT-2022-10014 · Qualcomm · Snapdragon
Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to improper validation of function pointer type with actual function signature, which can lead to assertion in various Snapdragon products, including...
Flatpak 安全漏洞
Flatpak is an application virtualization system for Linux desktop application computing environments. A security vulnerability exists in Flatpak that stems from the fact that Flatpak does not properly verify that the application permissions displayed to the user at installation time match the...
EXNESS: Verification process done using different documents without corresponding to user information / User information can be changed after verification
A business logic flaw in the Exness trading platform allowed a verified user to change their profile information Name, DoB, and Address after identity verification. Additionally, a user could verify their account with official documents that did not correspond to their provided information. This...
