6856 matches found
CVE-2020-14160
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources...
CVE-2020-14160
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources...
CVE-2020-14161
CVE-2020-14161 affects Gotenberg and is exploited as a Server-Side Request Forgery (SSRF) via the /convert/html endpoint. The root cause is insecure handling of the src in HTML elements, enabling an attacker to reference internal files (e.g., file:// URIs) through the chromium module used by the ...
CVE-2020-14161
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...
PT-2021-9700
Name of the Vulnerable Software and Affected Versions Gotenberg versions through 6.2.1 Description A Server-Side Request Forgery SSRF issue exists in the remote URL to PDF conversion, allowing a remote attacker to read local files or fetch intranet resources. Recommendations For Gotenberg version...
CVE-2020-14160: Server-Side Request Forgery (SSRF)
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources...
CVE-2020-14161: Improper Neutralization of Input During Web Page Generation
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...
Gotenberg code issue vulnerabilities
Thecodingmachine Gotenberg is Victornpb Thecodingmachine individual developers of a Go-based HTML, Markdown and Office documents can be converted to PDF applications. The application is based on Docker's stateless API can be used to support building web applications. Gotenberg A security...
Incorrect cast in anymap
An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a u8 to a u64...
GHSA-M9M5-CG5H-R582 Improper random number generation in nanorand
In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the...
Integer overflow due to conversion to unsigned
Impact The implementation of tf.rawops.QuantizeAndDequantizeV4Grad is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. python import tensorflow as tf tf.rawops.QuantizeAndDequantizeV4Grad...
GHSA-9W2P-5MGW-P94C Integer overflow due to conversion to unsigned
Impact The implementation of tf.rawops.QuantizeAndDequantizeV4Grad is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. python import tensorflow as tf tf.rawops.QuantizeAndDequantizeV4Grad...
GHSA-H6JH-7GV5-28VG Bad alloc in `StringNGrams` caused by integer conversion
Impact The implementation of tf.rawops.StringNGrams is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. python import tensorflow as tf tf.rawops.StringNGrams data='','', datasplits=0,2, separator...
GHSA-GF88-J2MG-CC82 Crash caused by integer conversion to unsigned
Impact An attacker can cause a denial of service in boostedtreescreatequantilestreamresource by using negative arguments: python import tensorflow as tf from tensorflow.python.ops import genboostedtreesops import numpy as np v= tf.Variable0.0, 0.0, 0.0, 0.0, 0.0...
Crash caused by integer conversion to unsigned
Impact An attacker can cause a denial of service in boostedtreescreatequantilestreamresource by using negative arguments: python import tensorflow as tf from tensorflow.python.ops import genboostedtreesops import numpy as np v= tf.Variable0.0, 0.0, 0.0, 0.0, 0.0...
Crash in NMS ops caused by integer conversion to unsigned
Impact An attacker can cause denial of service in applications serving models using tf.rawops.NonMaxSuppressionV5 by triggering a division by 0: python import tensorflow as tf tf.rawops.NonMaxSuppressionV5 boxes=0.1,0.1,0.1,0.1,0.2,0.2,0.2,0.2,0.3,0.3,0.3,0.3, scores=1.0,2.0,3.0, maxoutputsize=-1...
GHSA-VMJW-C2VP-P33C Crash in NMS ops caused by integer conversion to unsigned
Impact An attacker can cause denial of service in applications serving models using tf.rawops.NonMaxSuppressionV5 by triggering a division by 0: python import tensorflow as tf tf.rawops.NonMaxSuppressionV5 boxes=0.1,0.1,0.1,0.1,0.2,0.2,0.2,0.2,0.3,0.3,0.3,0.3, scores=1.0,2.0,3.0, maxoutputsize=-1...
Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
Impact It is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap: python import...
GHSA-G8WG-CJWC-XHHP Heap OOB in nested `tf.map_fn` with `RaggedTensor`s
Impact It is possible to nest a tf.mapfn within another tf.mapfn call. However, if the input tensor is a RaggedTensor and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap: python import...
sistem-binar.base-conversion.ro Cross Site Scripting vulnerability OBB-2120219
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...