8469 matches found
CVE-2021-29590
TensorFlow is an end-to-end open source platform for machine learning. The implementations of the Minimum and Maximum TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty. This is because the broadcasting...
CVE-2021-29527
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.QuantizedConv2D. This is because the...
CVE-2020-18167
Cross Site Scripting XSS in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu"...
CVE-2021-24282
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to...
CVE-2021-31922
An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3...
LAOBANCMS 代码问题漏洞
LAOBANCMS is a content management system based on PHP and MySQL. LAOBANCMS v2.0 version of the existence of arbitrary file upload vulnerability, the vulnerability stems from the unrestricted file upload allows remote attackers can exploit the vulnerability to upload arbitrary files, the method is...
WordPress plugin 代码问题漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A PHP object injection vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...
Google TensorFlow 数字错误漏洞
Google TensorFlow is an end-to-end open source machine learning platform. A divide-by-zero error vulnerability exists in the tf.rawops.Conv2D implementation in TensorFlow versions prior to 2.5.0. No details of the vulnerability are provided at this time...
UBUNTU-CVE-2021-32918
An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-service DoS attacks via memory exhaustion when running under Lua 5.2 or Lua 5.3...
Mercedes Benz HERMES 缓冲区错误漏洞
Mercedes Benz HERMES E Series is a series of Hermes Edition E Series cars by Mercedes Benz of Germany. A security vulnerability exists in HERMES version 2.1. The vulnerability originates from an out-of-bounds array access in the RemoteDiagnosisApp of the program...
IBM Planning Analytics 信息泄露漏洞
IBM Planning Analytics Local provides a single planning and analytics solution that can be deployed locally. An information disclosure vulnerability exists in IBM Planning Analytics Local version 2.0. An attacker could exploit the vulnerability to obtain sensitive information...
CVE-2020-18165
Cross Site Scripting XSS in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu"...
Jenkins 跨站请求伪造漏洞
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site request forgery...
CVE-2021-30224
Cross Site Request Forgery CSRF in Rukovoditel v2.8.3 allows attackers to create an admin user with an arbitrary credentials...
Inxedu inxedu SQL注入漏洞
Inxedu inxedu is a set of open source online education platform of China Inxedu Inxedu company. The platform includes an online school system, a live broadcasting system, an examination system and a marketing website. Inxedu v2.0.6 suffers from a SQL injection vulnerability, which originates from...
Vulnerability fixed in Moxa NPort 5110 firmware
Moxa has fixed a vulnerability in the NP5110 firmware. The vulnerability potentially allows a malicious party to use the device to forward IP traffic to network segments that the initially did not have access to because the NPort devices facilitated IP forwarding. Moxa has released updates to fix...
UBUNTU-CVE-2020-36325
DISPUTED An issue was discovered in Jansson through 2.13.1. Due to a parsing error in jsonloads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification...
CVE-2021-27736
FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely...
envoyproxy/envoy: crash with empty HTTP/2 metadata map
A flaw was found in envoyproxy. An attacker, able to craft an HTTP2 request that specifies an empty metadata map, can crash envoy resulting in a denial of service due to the null reference. The highest threat from this vulnerability is to system availability...