Security Bulletin: Multiple Vulnerabilities affecting IBM Watson Studio in Cloud Pak for Data Are Addressed

Summary There are multiple vulnerabilities in Runtimes 22.2 component impacting IBM Watson Studio in Cloud Pak for Data. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-2800 DESCRIPTION: Hugging Face Transformers is vulnerable to a...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service due to [CVE-2023-2800]

Summary Hugging Face Transformers is used by IBM App Connect Enterprise Certified Container for mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service. This bulletin provides patch information t...

Insecure Temporary File

transformers is vulnerable to Insecure Temporary Files. The vulnerability exists inside downloadurl due to the use of deprecated function tempfile.mktemp which creates temporary file names that are fundamentally insecure, as they do not ensure exclusive access to a file with the temporary name th...

GHSA-282V-666C-3FVG transformers has Insecure Temporary File

Insecure Temporary File in GitHub repository huggingface/transformers 4.29.2 and prior. A fix is available at commit 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 and has been released as part of version 4.30.0...

accord-nlp (>=0.1.0 <=0.1.8), adamix-gpt2 (>=0.0.1 <=0.0.2) +560 more potentially affected by CVE-2023-2800 via transformers (>=2.10.0 <=4.2.2)

transformers PYPI version =2.10.0, =0.1.0, =0.0.1, =0.3.0, =0.1.0, =0.1.0, =0.0.8, =0.0.4, =0.0.4, =0.0.11, =1.8.20, =0.0.3, =1.9.0, =1.0.0, =1.1.0 and more Source cves: CVE-2023-2800 Source advisory: OSV:GHSA-282V-666C-3FVG...

transformers has Insecure Temporary File

Insecure Temporary File in GitHub repository huggingface/transformers 4.29.2 and prior. A fix is available at commit 80ca92470938bbcc348e2d9cf4734c7c25cb1c43 and has been released as part of version 4.30.0...

CVE-2023-2800

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

CVE-2023-2800

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

PYSEC-2023-299

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

PYSEC-2023-299

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

accord-nlp (>=0.1.0 <=0.1.8), adamix-gpt2 (>=0.0.1 <=0.0.2) +560 more potentially affected by CVE-2023-2800 via transformers (>=2.10.0 <=4.2.2)

transformers PYPI version =2.10.0, =0.1.0, =0.0.1, =0.3.0, =0.1.0, =0.1.0, =0.0.8, =0.0.4, =0.0.4, =0.0.11, =1.8.20, =0.0.3, =1.9.0, =1.0.0, =1.1.0 and more Source cves: CVE-2023-2800 Source advisory: OSV:PYSEC-2023-299...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers versions prior to 4.30.0, which stems from the presence of an insecure temporary file in the program...

CVE-2023-2800 Insecure Temporary File in huggingface/transformers

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

CVE-2023-2800

CVE-2023-2800 affects Hugging Face Transformers (prior to 4.30.0). Insecure temporary file creation via tempfile.mktemp() could enable local denial of service. The IBM/IBM Cloud Pak bulletin and GH advisories confirm the workaround: upgrade Transformers to 4.30.0 or newer.

CVE-2023-2800 Insecure Temporary File in huggingface/transformers

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

CVE-2023-2800 Insecure Temporary File in huggingface/transformers

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0...

anomalib (>=0.2.2 <=0.2.4), argos-trains (=0.1.0) +174 more potentially affected by CVE-2022-0845 via pytorch-lightning (>=0.10.0 <=1.5.9)

pytorch-lightning PYPI version =0.10.0, =0.2.2, =0.1.1, =0.3.2b20220222, =0.3.2b20220222, =0.0.1, =0.0.7, =3.0.0, =3.3.0 and more Source cves: CVE-2022-0845 Source advisory: OSV:GHSA-R5QJ-CVF9-P85H...

GHSA-F2C9-5JQW-3XH3 Cross-Site Scripting in Qiita-Markdown

Increments Qiita-Markdown before 0.33.0 allows XSS in transformers...

Cross-Site Scripting in Qiita-Markdown

Increments Qiita-Markdown before 0.33.0 allows XSS in transformers...

Cross-Site Scripting in Qiita::Markdown

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers...