681 matches found
PT-2023-20229
Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1 Description TensorFlow is an open source platform for machine learning. Attackers using TensorFlow can access heap memory which is not in the control of the user, leading ...
GHSA-6Q4M-7476-932W github-slug-action vulnerable to arbitrary code execution
Impact This action uses the github.headref parameter in an insecure way. This vulnerability can be triggered by any user on GitHub on any workflow using the action on pull requests. They just need to create a pull request with a branch name, which can contain the attack payload. Note that...
CVE-2022-27672
A flaw was found in HW. When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch, potentially resulting in information disclosure. Mitigation The current mitigations for spectre V4 or spectrev2 should mitiga...
SUSE CVE-2021-33033
The Linux kernel before 5.11.14 has a use-after-free in cipsov4genopt in net/ipv4/cipsoipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value...
SUSE CVE-2021-45387
tcpreplay 4.3.4 has a Reachable Assertion in addtreeipv4 at tree.c...
KASAGO IPv6/v4 Dual 安全特征问题漏洞
KASAGO IPv6/v4 Dual is KASAGO's protocol middleware for TCP/IP communication. A security vulnerability exists in KASAGO IPv6/v4 Dual that stems from an insufficiently randomized ISN Initial Sequence Number. An attacker can exploit this vulnerability to predict the value of the ISN...
Malicious Package
Overview bootstrap-v4 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Weak password vulnerability in TOTOLINK N300RH V4
The TOTOLINK N300RH V4 is a wireless router. The TOTOLINK N300RH V4 suffers from a weak password vulnerability that can be exploited by attackers to obtain sensitive information...
GO-2022-1159 Path traversal in github.com/containers/podman/v4
The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality...
CVE-2022-45942
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
Remote code execution
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
CVE-2022-45942
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
CVE-2022-45942
A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4...
PT-2022-27696 · Baijiacms · Baijiacms
Name of the Vulnerable Software and Affected Versions: baijiacms version v4 Description: A Remote Code Execution RCE vulnerability was found in includes/baijiacms/common.inc.php. Recommendations: For baijiacms version v4, consider restricting access to the includes/baijiacms/common.inc.php file...
CVE-2022-46139
Summary : CVE-2022-46139 affects TP-Link TL-WR940N V4, specifically versions 3.16.9 and earlier. The issue allows an authenticated attacker to trigger a Denial of Service by uploading a crafted firmware image during the firmware update process. What’s affected : The vulnerable device is the TP-Li...
CVE-2020-36565 Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
Cross site request forgery (csrf)
perfSONAR v4.x = v4.4.5 was discovered to contain a Cross-Site Request Forgery CSRF which is triggered when an attacker injects crafted input into the Search function...
CVE-2022-41413
CVE-2022-41413 affects perfSONAR v4.x through v4.4.5, with a Cross-Site Request Forgery (CSRF) vulnerability triggered when crafted input is injected into the Search function. The issue is a partial blind CSRF that can cause the client to issue background requests to arbitrary URLs, bypassing the...