Searpy - Search Engine Tookit

1. Install git clone https://github.com/j3ers3/Searpy pip install -r requirement.txt 配置API及账号 ./config.py python Searpy -h 2. Help baidu Engine --google Using google Engine --so Using 360so Engine --bing Using bing Engine --shodan Using shodan Engine --fofa Using fofa Engine --zoomeye Using...

CVE-2021-44302

BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidumap parameters in /user/ztconfig.php...

CVE-2021-44302

BaiCloud-cms v2.5.7 was discovered to contain multiple SQL injection vulnerabilities via the tongji and baidumap parameters in /user/ztconfig.php...

Baicloud Cms 安全漏洞

Baicloud Cms is a Chinese lightweight open source content management system Cms based on Php and MySQL, running on Linux, Windows and other platforms. BaiCloud cms v2.5.7 suffers from a SQL injection vulnerability that allows attackers to pass the tongji and baidumap parameters in...

A use of uninitialized value vulnerability in Tensorflow

Impact TensorFlow's Grappler optimizer has a use of unitialized variable: cc const NodeDef dequeuenode; for const auto& trainnode : trainnodes if IsDequeueOptrainnode dequeuenode = trainnode; break; if dequeuenode ... If the trainnodes vector obtained from the saved model that gets optimized does...

`CHECK`-fail in `MapStage`

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.MapStage: python import tensorflow as tf tf.rawops.MapStage key=tf.constant, shape=0, 0, 0, 0, dtype=tf.int64, indices=tf.constant0, dtype=tf.int32, values=tf.constant0, dtype=tf.int32, dtypes=tf.int32, tf.int64,...

Incomplete validation in `MaxPoolGrad`

Impact An attacker can trigger a denial of service via a segmentation fault in tf.rawops.MaxPoolGrad caused by missing validation: python import tensorflow as tf tf.rawops.MaxPoolGrad originput = tf.constant, shape=3, 0, 0, 2, dtype=tf.float32, origoutput = tf.constant, shape=3, 0, 0, 2,...

Division by 0 in most convolution operators

Impact Most implementations of convolution operators in TensorFlow are affected by a division by 0 vulnerability where an attacker can trigger a denial of service via a crash: python import tensorflow as tf tf.compat.v1.disablev2behavior tf.rawops.Conv2D input = tf.constant, shape=0, 0, 0, 0,...

Reference binding to nullptr in shape inference

Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.SparseFillEmptyRows: python import tensorflow as tf tf.compat.v1.disablev2behavior tf.rawops.SparseFillEmptyRows indices = tf.constant, shape=0, 0, dtype=tf.int64, values = tf.constant, shape=0,...

Missing validation in shape inference for `Dequantize`

Impact The shape inference code for tf.rawops.Dequantize has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments: python import tensorflow as tf tf.compat.v1.disablev2behavior tf.rawops.Dequantize inputtensor = tf.constant-10.0,...

Division by zero in TFLite

Impact The implementation of fully connected layers in TFLite is vulnerable to a division by zero error: cc const int batchsize = inputsize / filter-dims-data1; An attacker can craft a model such that filter-dims-data1 is 0. Patches We have patched the issue in GitHub commit...

Heap OOB in TFLite

Impact TFLite's expanddims.cc contains a vulnerability which allows reading one element outside of bounds of heap allocated data: cc if axis size; ++i if i datai = inputdims.datai; else if i == axis outputdims-datai = 1; else outputdims-datai = inputdims.datai - 1; If axis is a large negative val...

Heap OOB in TFLite's `Gather*` implementations

Impact TFLite's GatherNd implementation does not support negative indices but there are no checks for this situation. Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in indices. Similar issue exists in Gather implementation. python impor...

Null pointer dereference in TFLite

Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: python import tensorflow as tf model = tf.keras.models.Sequential model.addtf.keras.Inputshape=1, 2, 3 model.addtf.keras.layers.Dense0, activation='relu'...

Null pointer dereference in TFLite MLIR optimizations

Impact An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service: This is caused by the MLIR optimization of L2NormalizeReduceAxis operator. The implementation unconditionally dereferences a pointer to an iterator to a...

FPE in LSH in TFLite

Impact An attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation. cc int RunningSignBitconst TfLiteTensor input, const TfLiteTensor weight, float seed int inputitembytes = input-bytes / SizeOfDimensioninput, 0; // ... There is no check that the first...

py-tflite -- denial of service vulnerability

Yakun Zhang of Baidu Security reports: An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service...

com.baidu.xuper:xuper-java-sdk (>=0.1.0 <=0.2.0), com.bitpay:bitpay_sdk (>=5.0.2011 <=6.3.2109) +131 more potentially affected by CVE-2020-15522 via org.bouncycastle:bcprov-jdk15to18 (>=1.63 <=1.65)

org.bouncycastle:bcprov-jdk15to18 MAVEN version =1.63, =0.1.0, =5.0.2011, =0.1.0, =1.0.1, =0.2, =2.0.0, =0.1.0, =1.0.0, =0.3, =1.0.0-6, =2.1.0, =0.0.1, =0.0.2 and more Source cves: CVE-2020-15522 Source advisory: OSV:GHSA-6XX3-RG99-GC3P...

Baidu Rust SGX SDK 安全漏洞

Baidu Rust SGX SDK is a Rust language development kit for Intel SGX Trusted Computing Platform from Baidu, China. Baidu Rust SGX SDK suffers from a security vulnerability, which originates from a side-channel vulnerability in base64 PEM file decoding in Rust SGX 1.1.3. An attacker can exploit the...

MipCMS server-side request forgery vulnerability

MipCMS is an application software. A content management system based on Baidu Mobile Accelerator MIP and an SEO website building system. mipCMS 5.0.1 has a server-side request forgery vulnerability that can be exploited by attackers to access sensitive information...