Google TensorFlow integer division by zero error vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. An integer division by zero error vulnerability exists in the implementation of tf.rawops.SparseReshape in versions prior to Google TensorFlow 2.6.0. No details of the vulnerability are currently available...

PT-2021-5803 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: A stack buffer overflow can occur when correcting differences in the MFT and MFTMirror, allowing for code execution or escalation of privileges when setuid-root. The vulnerability is related to...

PT-2021-10253 · Libexe · Libexe

Name of the Vulnerable Software and Affected Versions: libexe versions prior to 20181128 Description: A heap-based buffer overflow in the libexe io handle read coff optional header function allows attackers to execute arbitrary code. Recommendations: For versions prior to 20181128, update to a...

kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions...

PT-2021-10245 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: DotCMS versions prior to 5.1 Description: The issue allows remote attackers to gain privileges by injecting client configurations via vtl velocity files. This is due to incorrect access control in the software. Recommendations: For versions...

CVE-2021-29983

Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affects Firefox 91...

hw: Vector Register Leakage-Active

A flaw was found in the Intel Advanced Vector Extensions AVX implementation, where a local authenticated attacker with the ability to execute AVX instructions can gather the AVX register state from previous AVX executions. This vulnerability allows information disclosure of the AVX register state...

PT-2021-5760 · Ntfs-3G +7 · Ntfs-3G +7

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: The issue is related to an out-of-bounds read in the ntfs ie lookup function of the NTFS-3G driver for the FUSE module. This can be exploited by a crafted NTFS image, potentially allowing an...

PT-2021-5772 · Ntfs-3G +6 · Ntfs-3G +6

Name of the Vulnerable Software and Affected Versions: NTFS-3G versions prior to 2021.8.22 Description: A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs attr record resize. This issue may allow an attacker to access...

SuiteCRM 跨站脚本漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM Suitecrm team. A cross-site scripting vulnerability exists in SuiteCRM, which stems from the product's cleanfileoutput protection mechanism not validating SVG file uploads. The vulnerability can be exploited to execute...

CVE-2021-37711

Versions prior to 6.4.3.1 contain an authenticated server-side request forgery vulnerability in file upload via URL. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin...

PT-2021-15284 · Pulse Secure · Pulse Connect Secure

Name of the Vulnerable Software and Affected Versions: Pulse Connect Secure versions prior to 9.1R12 Description: A buffer overflow issue exists due to a maliciously crafted web request. This could be exploited by an authenticated administrator or a compromised Pulse Connect Secure device in a...

PT-2021-22206 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.8.0 HashiCorp Vault and Vault Enterprise versions 1.7.x prior to 1.7.4 HashiCorp Vault and Vault Enterprise versions 1.6.x prior to 1.6.6 Description: The UI of HashiCorp Vault and Vaul...

Google TensorFlow tf.raw_ops.BoostedTreesCreateEnsemble code execution hole

Google TensorFlow is an end-to-end open source machine learning platform. tf.rawops.BoostedTreesCreateEnsemble in versions prior to Google TensorFlow 2.6.0 has a security vulnerability. An attacker could exploit the vulnerability to execute arbitrary code on the system...

Google TensorFlow tf.raw_ops.SaveV2 denial of service vulnerability

Google TensorFlow is an end-to-end open source machine learning platform. a security vulnerability exists in Google TensorFlow versions prior to 2.6.0. The vulnerability stems from code in tf.rawops.SaveV2 that fails to properly validate input. A local attacker could exploit this vulnerability to...

CVE-2021-27792

The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properly handle malformed user input, resulting in a service crash. An authenticated attacker could use this weakness to cause the FOS HTTP application handler to...

PT-2021-21762 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4 Description: The issue arises when a user does not supply arguments that determine a valid sparse tensor, causing the tf.raw...

PT-2021-21750 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: The implementation of sparse reduction operations in TensorFlow can trigger...

PT-2021-21792 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: An attacker can trigger a denial of service via a segmentation fault in tf.raw...

PT-2021-21812 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions, under certain conditions, Go code can trigger a segfault in string...