PT-2022-22542 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue was discovered in OTFCC via the /release-x64/otfccdump+0x6e412a endpoint. This issue can be exploited, but no details are provided about the estimated number of potentially affect...

PT-2022-22543 · Otfcc +1 · Otfcc +1

Name of the Vulnerable Software and Affected Versions: OTFCC commit 617837b Description: A heap buffer overflow issue has been discovered in OTFCC commit 617837b via the /release-x64/otfccdump+0x6c0bc3 endpoint. Recommendations: For OTFCC commit 617837b, as a temporary workaround, consider...

PT-2022-37373 · Unknown +1 · Democritus-Networking +1

Name of the Vulnerable Software and Affected Versions: d8s-urls version 0.1.0 Description: A potential code-execution backdoor was inserted by a third party into the d8s-urls package for Python, distributed on PyPI. Another affected package is democritus-networking. Recommendations: For d8s-urls...

PT-2022-37342 · Unknown +1 · Democritus-Strings +1

Name of the Vulnerable Software and Affected Versions: d8s-math version 0.1.0 Description: The d8s-math library for Python contains a potential code-execution backdoor. This backdoor is attributed to the democritus-strings package, which was inserted by a third party. Recommendations: For version...

PT-2022-37369 · Unknown +1 · Democritus-Hypothesis +1

Name of the Vulnerable Software and Affected Versions: d8s-dicts version 0.1.0 Description: The d8s-dicts package for Python contains a potential code-execution backdoor. This backdoor is attributed to the democritus-hypothesis package, which was inserted by a third party. Recommendations: For...

PT-2022-24466 · Unknown · Interview Management System

Name of the Vulnerable Software and Affected Versions: Interview Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It affects the component "/interview/delete.php?action=deletecand&id=". Recommendations: For Interview Management System version 1.0,...

PT-2022-24436 · Ucms · Ucms

Name of the Vulnerable Software and Affected Versions: UCMS version 1.6.0 Description: A cross-site scripting XSS issue was found in UCMS via the Import function under the Site Management page. This allows for potential malicious script execution. Recommendations: For UCMS version 1.6.0, consider...

PT-2022-25526 · Modern Campus · Modern Campus - Omni Cms

Name of the Vulnerable Software and Affected Versions: Modern Campus Omni CMS formerly OU Campus version 10.2.4 Description: The issue allows for SQL injection via a specific substring on the login page. This can be achieved by using a substring such as ' OR 1 = 1 -- - , ?php'. Recommendations: F...

PT-2022-25534 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 versions 1.6.0-639 and earlier Description: An issue was discovered in Bento4, where a NULL pointer dereference occurs in the AP4 StszAtom::WriteFields function. Recommendations: For Bento4 versions 1.6.0-639 and earlier, as a temporar...

GSD-2022-1005971 usb: cdns3 fix use-after-free at workaround 2

usb: cdns3 fix use-after-free at workaround 2 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by commit...

GSD-2022-1005493 usb: cdns3 fix use-after-free at workaround 2

usb: cdns3 fix use-after-free at workaround 2 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

PT-2022-33783 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.63 Description: A potential bad pointer dereference issue exists in the bpf sys bpf function. The actual impact and attack plausibility have not yet been proven. This issue was introduced in version v5.14...

CVE-2022-36013

TensorFlow is an open source platform for machine learning. When mlir::tfg::GraphDefImporter::ConvertNodeDef tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0...

CVE-2022-36014

TensorFlow is an open source platform for machine learning. When mlir::tfg::TFOp::nameAttr receives null type list attributes, it crashes. We have patched the issue in GitHub commits 3a754740d5414e362512ee981eefba41561a63a6 and a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in...

CVE-2022-35997 `CHECK` fail in `tf.sparse.cross` in TensorFlow

TensorFlow is an open source platform for machine learning. If tf.sparse.cross receives an input separator that is not a scalar, it gives a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 83dcb4dbfa094e33db084e97c4d0531a559e0ebf. The f...

CVE-2022-36001 `CHECK` fail in `DrawBoundingBoxes` in TensorFlow

TensorFlow is an open source platform for machine learning. When DrawBoundingBoxes receives an input boxes that is not of dtype float, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit da0d65cdc1270038e72157ba35bf74b85d9bda11. The fix wi...

GHSA-MV8X-668M-53FG Elrond-go has improper initialization

Impact Read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract's B state, the state will be altered for contract B as if the call was not made in the read-only...

GHSA-FXWR-4VQ9-9VHJ XWiki Cross-Site Request Forgery (CSRF) for actions on tags

Impact It's possible to perform a CSRF attack for adding or removing tags on XWiki pages. Patches The problem has been patched in XWiki 13.10.5 and 14.3. Workarounds It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the...

CVE-2022-35941

TensorFlow is an open source platform for machine learning. The AvgPoolOp function takes an argument ksize that must be positive but is not checked. A negative ksize can trigger a CHECK failure and crash the program. We have patched the issue in GitHub commit...

CVE-2022-35939

TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have...