CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-789

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-591

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-591

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

Buffer overflow

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

PYSEC-2021-789

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

CVE-2021-37678 Arbitrary code execution due to YAML deserialization

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The implementation uses yaml.unsafeload which can perform arbitrary code execution...

Google TensorFlow 代码问题漏洞

Google TensorFlow is an end-to-end open source machine learning platform. An arbitrary code execution vulnerability exists in Google TensorFlow versions prior to 2.6.0. The vulnerability stems from YAML deserialization. An attacker can exploit this vulnerability to execute arbitrary code...

PT-2021-21796 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: TensorFlow and Keras can be tricked to perform arbitrary code execution when...

Sensitive Information Disclosure in “Extbase Yaml Routes” (routes)

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site...

23andMe Yamale 代码问题漏洞

23andMe Yamale is the architecture and validator for open source YAML. A code issue vulnerability exists in 23andMe Yamale that stems from the pattern parser in 23andMe Yamale prior to version 3.0.8 using eval as part of its processing and attempting to prevent malicious expressions by limiting t...

olcne security update

olcne 1.2.4-5 - Updated registry-image-helper.sh to work with olcne-utils 1.2.4-4 - Fix istio template for 1.9.6 for k8s update failure 1.2.4-3 - Fixed yaml file to stop olcne-nginx and keepalived services at uninstall Orabug: 32296282 1.2.4-2 - Fix iptables issue when running on OL7 host using O...

Security Bulletin: Apache Commons Configuration Vulnerability Affects IBM Sterling Connect:Direct File Agent (CVE-2020-1953)

Summary There is a vulnerability in Apache Commons used by IBM Sterling Connect:Direct File Agent. IBM Sterling Connect:Direct File Agent has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-1953 DESCRIPTION: Apache Commons Configuration could allow a remote attacker to execute...

ansible: Template Injection through yaml multi-line strings with ansible facts used in template.

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...

Template Injection

Ansible is vulnerable to template injection. An attacker is able to inject malicious code via the templates in multi-line YAML...

The vulnerability of the PyYAML syntax analyzer lies in insufficient validation of input data, allowing an attacker to execute arbitrary code.

The vulnerability of the PyYAML syntax analyzer is related to insufficient validation of data entered by users during the processing of unreliable YAML files using the fullload method or the FullLoader loader. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using ...

ansible: Template Injection through yaml multi-line strings with ansible facts used in template.

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters...