PT-2022-24424 · Unknown · Logrocket-Oauth2-Example

Name of the Vulnerable Software and Affected Versions: logrocket-oauth2-example versions prior to 2020-05-27 Description: The issue allows SQL injection via the /auth/register API endpoint, specifically through the username parameter. Recommendations: For versions prior to 2020-05-27, as a...

fuzztest-example:escaping_test@EscapingTest.UnescapingAStringNeverTriggersUndefinedBehavior: Heap-buffer-overflow in codelab::Unescape

Detailed Report: https://oss-fuzz.com/testcase?key=6417467054620672 Project: fuzztest-example Fuzzing Engine: libFuzzer Fuzz Target: escapingtest@EscapingTest.UnescapingAStringNeverTriggersUndefinedBehavior Job Type: libfuzzerasanfuzztest-example Platform Id: linux Crash Type: Heap-buffer-overflo...

Airflow run_id Command Execution

The vulnerability of the runid parameter in the Example Dags function of the Airflow software for data processing scenario creation, monitoring, and orchestration is related to incorrect code generation. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-40189 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-40189 Source advisory:...

Denial Of Service (DoS)

tensorflow is vulnerable to denial of service DoS attacks. An attacker is able to cause denial of service conditions due to improper validation of user Inputs, densefeatures and examplestatedata, resulting in a CHECK fail in SdcaOptimizer...

GHSA-27RC-728F-X5W2 `CHECK` fail via inputs in `SdcaOptimizer`

Impact Inputs densefeatures or examplestatedata not of rank 2 will trigger a CHECK fail in SdcaOptimizer. python import tensorflow as tf tf.rawops.SdcaOptimizer sparseexampleindices=4 tf.random.uniform5,5,5,3, dtype=tf.dtypes.int64, maxval=100, sparsefeatureindices=4 tf.random.uniform5,5,5,3,...

Mozilla: Symlinks may resolve to partially uninitialized buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink such as file:///proc/self/fd/1, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer...

Google TensorFlow input validation error vulnerability

Google TensorFlow is an open source platform for machine learning from Google, Inc. An input validation error vulnerability exists in Google TensorFlow, which stems from the fact that entering 'densefeatures' or 'examplestatedata' that is not rank 2 will trigger a 'CHECK' failure in...

org.apache.camel:camel-example-ssh (>=2.13.0, <=2.13.4), org.apache.camel:camel-example-ssh-security (>=2.13.0, <=2.13.4) +4 more potentially affected by CVE-2022-45047 via org.apache.sshd:sshd-core (0.10.1)

org.apache.sshd:sshd-core MAVEN version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.sshd:sshd-core and may be impacted: - org.apache.camel:camel-example-ssh =2.13.0, =2.13.0, =2.13.0, =2.13.4 - org.apache.sshd:apache-sshd 0.10.1 -...

org.apache.camel:camel-example-ssh (>=2.15.0, <=2.15.6), org.apache.camel:camel-example-ssh-security (>=2.15.0, <=2.15.6) +3 more potentially affected by CVE-2022-45047 via org.apache.sshd:sshd-core (0.13.0)

org.apache.sshd:sshd-core MAVEN version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.sshd:sshd-core and may be impacted: - org.apache.camel:camel-example-ssh =2.15.0, =2.15.0, =2.15.0, =2.15.6 - org.apache.sshd:apache-sshd 0.13.0 -...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-45402 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-45402 Source advisory:...

Arbitrary Code Execution

apacheairflow is vulnerable to arbitrary code execution. The vulnerability exists in example DAGs of examplebashoperator.py which allows an attacker to execute arbitrary commands via the manually provided runid parameter...

GHSA-6PW3-8H9W-32GC Apache Airflow vulnerable to OS Command Injection via example DAGs

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow versions prior to 2.4.0...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-27949 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-27949 Source advisory:...

Apache Airflow vulnerable to OS Command Injection via example DAGs

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow versions prior to 2.4.0...

CVE-2022-40127

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...

Design/Logic Flaw

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...

PYSEC-2022-42982

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...

Malicious code in react-nesting-example-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0a6877c514ae49fccfe170b75f8405a65c085e2bb1d3d78b1ce4d44bff375d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...