Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A buffer overflow vulnerability exists in versions prior to Google TensorFlow 2.11.0, which can be exploited by attackers to cause out-of-bounds memory reads or crashes...

thisAAY Lazy Mouse 访问控制错误漏洞

thisAAY Lazy Mouse is a mouse application from thisAAY. A security vulnerability exists in versions prior to thisAAY Lazy Mouse 2.0.1, which stems from a default configuration that does not require a password and allows an unauthenticated remote user to execute arbitrary code without prior...

CVE-2022-1578 My wpdb < 2.5 - Arbitrary SQL Query via CSRF

The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack...

PT-2022-26138

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4 Description The issue occurs when tf.raw ops.ResizeNearestNeighborGrad is given a large size input, causing an overflow. This can be exploited with a specific input...

PT-2022-26127

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4 Description TensorFlow is an open source platform for machine learning. If ThreadUnsafeUnigramCandidateSampler is given input filterbank channel count greater than...

PT-2023-5862 · Git · Git For Windows

Name of the Vulnerable Software and Affected Versions: Git for Windows versions prior to 2.40.1 Description: The issue is related to an Uncontrolled Search Path Element vulnerability. It affects users of Git CMD who start the command in an untrusted directory, allowing maliciously-placed doskey.e...

artemis-commons: Apache ActiveMQ Artemis DoS

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability DoS through uncontrolled resource consumption of memory...

PT-2022-18508 · Sick · Sick Sim1004

Name of the Vulnerable Software and Affected Versions: SICK SIM1004 Partnumber 1098148 versions prior to 2.0.0 Description: A password recovery issue allows an unprivileged remote attacker to invoke the password recovery mechanism method, gaining access to the user level defined as...

PYSEC-2022-42983

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API...

ALPINE-CVE-2022-39244

PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been...

PYSEC-2022-285

Cross-Site Request Forgery CSRF in GitHub repository ikus060/rdiffweb prior to 2.4.6...

CVE-2022-2177

Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2...

PT-2022-22313 · Zyxel · Zyxel Gs1900

Name of the Vulnerable Software and Affected Versions: Zyxel GS1900 series firmware versions prior to V2.70 Description: An insufficient entropy issue, caused by the improper use of randomness sources with low entropy for RSA key pair generation, affects the web administration interface. This cou...

WordPress plugin Affiliates Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

MB CONNECT LINE mymbCONNECT24 安全漏洞

MB CONNECT LINE mymbCONNECT24 is an in-house remote maintenance solution for virtual environments from MB CONNECT LINE, Germany. A security vulnerability exists in MB CONNECT LINE mymbCONNECT24, mbCONNECT24, Helmholz myREX24, and myREX24.virtual v2.11.2 and prior versions, which originates from a...

PT-2022-7691 · Tinygltf +2 · Tinygltf +2

Name of the Vulnerable Software and Affected Versions: tinygltf versions prior to 2.6.0 Description: The tinygltf library has an issue related to the use of the C library function wordexp for file path expansion on untrusted paths from input files. This allows for command injection using backtick...

tinygltf 命令注入漏洞

tinygltf is a header-only C++ miniature glTF library loader/saver by the Japanese individual developer Syoyo Fujita. A security vulnerability exists in tinygltf versions prior to 2.6.0, which stems from the C library function wordexp performs file path expansion on untrusted paths provided by the...

AZL-10714 CVE-2022-38533 affecting package binutils for versions less than 2.37-4

In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfdgetl32 when called from the stripmain function in strip-new via a crafted file...

Vite 路径遍历漏洞

Vite is a new front-end build tool open-sourced by Vite. A security vulnerability exists in versions prior to Vite v2.9.13 that stems from a vulnerability that allows an attacker to perform directory traversal of a victim's service via a crafted URL...

CVE-2022-28626

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and...