PT-2022-36928

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash has been reported, identified as a Stack-use-after-scope WRITE 1 issue. The crash involves the grk::WaveletReverse::decompress partial tile functio...

Arbitrary file read vulnerability in selected-tests-executor

selected-tests-executor 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller using the Choosing Tests parameter. As of publication of this advisory, there is no fix. Learn why we announce this...

Stored XSS vulnerability in selected-tests-executor

selected-tests-executor 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +34 more potentially affected by CVE-2022-23636 via wasmtime (>=0.7.0, <=0.33.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.40.1, =0.45.0, =0.1.0, =0.3.3, =0.8.0-alpha.2, =0.8.0-alpha.2, =0.1.1, =0.1.1, =0.1.2, =0.2.1, =0.9.0 and more Source cves: CVE-2022-23636 Source advisory: GHSA-88XQ-W8CQ-XFG7...

Puma Information Disclosure Vulnerability

Puma is a web server for highly concurrent applications from Evan Phoenix, an individual developer in the United States. Puma suffers from an information disclosure vulnerability that stems from the fact that prior to puma version 5.6.2, puma may not always call close on the response body, and...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the ActionDispatch::Executor function, which expects response bodies to be closed and will not know to reset a thread's local state for the next request in a case where a response body isn't closed, allowing for...

CVE-2022-23633: Exposure of Sensitive Information to an Unauthorized Actor

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

CVE-2022-23633

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to dat...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2020-1926 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2020-1926 Source advisory: GHSA-54G4-5CF6-HJ...

com.hindog.grid:grid-executor-examples_2.11 (>=1.1.0, <=2.0.1) potentially affected by CVE-2020-1926 via org.apache.hive:hive (2.1.1)

org.apache.hive:hive MAVEN version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.hive:hive and may be impacted: - com.hindog.grid:grid-executor-examples2.11 =1.1.0, =2.0.1 Source cves: CVE-2020-1926 Source advisory:...

Privilege Escalation

openzeppelin/contracts is vulnerable to privilege escalation. The vulnerability exists due to the lack of sanitization in the initializer function which allowed an actor with executor role to escalate privileges...

PYSEC-2022-142

Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize. Here, we set item-kernel to nullptr but it is a simple OpKernel pointer so the memory that was previously allocated to it...

PYSEC-2022-87

Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize. Here, we set item-kernel to nullptr but it is a simple OpKernel pointer so the memory that was previously allocated to it...

CVE-2022-23578

Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize. Here, we set item-kernel to nullptr but it is a simple OpKernel pointer so the memory that was previously allocated to it...

PT-2022-16095

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier Description The issue arises when a graph node is invalid, causing TensorFlow to leak memory i...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.1.0, <=0.3.5), org.jenkins-ci.main:jenkins-test-harness (1.625.2) +6 more potentially affected by CVE-2022-20612 via org.jenkins-ci.main:jenkins-core (1.625.2)

org.jenkins-ci.main:jenkins-core MAVEN version 1.625.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin =0.1.0, =1.0.1, =1.0.2 Source cves:...

EXOCET - AV-evading, Undetectable, Payload Delivery Tool

EXOCET is superior to Metasploit's "Evasive Payloads" modules as EXOCET uses AES-256 in GCM Mode Galois/Counter Mode. Metasploit's Evasion Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware. However, i...

php:php-fuzz-tracing-jit: Heap-use-after-free in zval_ptr_dtor

Detailed Report: https://oss-fuzz.com/testcase?key=6748907644780544 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-tracing-jit Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x613000001000 Crash State: zvalptrdtor...

org.nutz:nutzboot-starter-xxl-job-executor (>=2.1.0, <=2.5.1.v20220215) potentially affected by CVE-2020-29204 via com.xuxueli:xxl-job-core (1.9.0)

com.xuxueli:xxl-job-core MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.xuxueli:xxl-job-core and may be impacted: - org.nutz:nutzboot-starter-xxl-job-executor =2.1.0, =2.5.1.v20220215 Source cves: CVE-2020-29204 Source advisory...

ai.deepsense:seahorse-executor-deeplang_2.11 (>=1.4.2, <=1.4.3), ai.h2o:h2o-persist-gcs (>=3.20.0.1, <=3.32.1.5) +1920 more potentially affected by CVE-2020-7692 via com.google.oauth-client:google-oauth-client (>=1.5.0-alpha, <=1.30.6)

com.google.oauth-client:google-oauth-client MAVEN version =1.5.0-alpha, =1.4.2, =3.20.0.1, =2.1.44, =3.30.0.5-1-3.0, =2.1.44, =3.30.0.5-1-3.0, =2.1.44, =3.30.0.5-1-3.0, =2.1.44, =0.1.2, =19.9.0, =19.9.0, =19.9.0, =19.9.1, =19.9.0, =20.3.2-2 and more Source cves: CVE-2020-7692 Source advisory:...