cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2021-29516 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2021-29516 Source advisory: OSV:PYSEC-2021-153...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2021-29613 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2021-29613 Source advisory: OSV:PYSEC-2021-250...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2021-29525 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2021-29525 Source advisory: OSV:PYSEC-2021-162...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2021-29584 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2021-29584 Source advisory: OSV:PYSEC-2021-221...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2021-29589 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2021-29589 Source advisory: OSV:PYSEC-2021-226...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2021-29519 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2021-29519 Source advisory: OSV:PYSEC-2021-156...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2021-29554 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2021-29554 Source advisory: OSV:PYSEC-2021-191...

USN-4898-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description Viktor Szakats discovered that curl did not strip off user credentials from referrer header fields. A remote attacker could possibly use this issue to obtain sensitive information...

USN-4922-1: Ruby vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description Juho Nurminen discovered that the REXML gem bundled with Ruby incorrectly parsed and serialized XML documents. A remote attacker could possibly use this issue to perform an XML round-trip attack. CVEs...

USN-4900-1: OpenEXR vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that OpenEXR incorrectly handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, a remote attacker could cause a denial of service, or...

CVE-2021-28242

SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cfname" parameter when creating a new filter under the "Collections" tab...

PT-2021-17829

Name of the Vulnerable Software and Affected Versions: b2evolution version 7.2.2-stable Description: The issue allows remote attackers to obtain sensitive database information by injecting SQL commands into the cf name parameter when creating a new filter under the "Collections" tab. This occurs ...

USN-4882-1: Ruby vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that the Ruby JSON gem incorrectly handled certain JSON files. If a user or automated system were tricked into parsing a specially crafted JSON file, a remote attacker could use this iss...

USN-4764-1: GLib vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that GLib incorrectly handled certain symlinks when replacing files. If a user or automated system were tricked into extracting a specially crafted file with File...

USN-4891-1: OpenSSL vulnerability | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that OpenSSL incorrectly handled certain renegotiation ClientHello messages. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly...

USN-4899-2 spamassassin vulnerability

USN-4899-1 fixed a vulnerability in SpamAssassin. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially-...

USN-4899-1: SpamAssassin vulnerability

Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a specially- crafted CF file, a remote attacker could possibly run arbitrary code...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : SpamAssassin vulnerability (USN-4899-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4899-1 advisory. Damian Lukowski discovered that SpamAssassin incorrectly handled certain CF files. If a user or automated system were tricked into using a...

Command Injection

Apache SpamAssassin is vulnerable to command injection. malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios...

CVE-2020-1946: Improper Neutralization of Special Elements used in an OS Command

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...