CVE-2022-23573 Uninitialized variable access in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The implementation of AssignOp can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized to minimize number of...

CVE-2022-23585 Memory leak in decoding PNG images in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. When decoding PNG images TensorFlow can produce a memory leak if the image is invalid. After calling png::CommonInitDecode..., &decode, the decode value contains allocated buffers which can only be freed by calling...

CVE-2022-23592 Out of bounds read in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a DCHECK which is a no-op during production. An attacker can control the inputidx variable such that ix would be larger than the number of...

CVE-2022-23593 Segfault in `simplifyBroadcast` in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes. If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector...

PYSEC-2022-116

Tensorflow is an Open Source Machine Learning Framework. The implementation of Bincount operations allows malicious users to cause denial of service by passing in arguments which would trigger a CHECK-fail. There are several conditions that the input arguments must satisfy. Some are not caught...

PYSEC-2022-117

Tensorflow is an Open Source Machine Learning Framework. The implementation of SparseCountSparseOutput can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this comm...

PYSEC-2022-109

Tensorflow is an Open Source Machine Learning Framework. The implementation of FractionalAvgPoolGrad does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this...

PT-2022-1698 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to errors in the representation of information by the user interface. Exploitation of this issue may allow a remote attacker to conduct spoofing...

PT-2022-16298 · Zoho · Zoho Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Desktop Central versions prior to 10.1.2137.10 Description: The issue allows an authenticated user to change any user's login password. Recommendations: For versions prior to 10.1.2137.10, update to version 10.1.2137.10 or...

PT-2022-12214 · Lexmark · Lexmark Devices

Name of the Vulnerable Software and Affected Versions: Lexmark devices affected versions not specified Description: The initial admin account setup wizard on Lexmark devices allows unauthenticated access to the "out of service erase" feature. This issue may be related to an unprotected API,...

PT-2024-11807

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the SUNRPC component in the Linux kernel, where the -sock can be set to NULL asynchronously unless the -recv mutex is held. This can trigger an oops when a sysfs...

PT-2022-11464

Name of the Vulnerable Software and Affected Versions calibre-web affected versions not specified Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software does not properly neutralize user...

HPESBGN04232 rev.1 - HPE Network Functions, Apache Log4j 2 Remote Arbitrary Code Execution

Potential Security Impact: Remote: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified Data Management UDM 1.2009.0, 1.2101.0, 1.2103.0, 1.2105.0, 1.2107.0, 1.2109.0, 1.2109.1 HPE Authentication Server Function AUSF 1.2009.0, 1.2101.0, 1.2103.0,...

PT-2022-15172 · Unknown +1 · Connected Devices Platform Service +1

Name of the Vulnerable Software and Affected Versions: Connected Devices Platform Service affected versions not specified Description: The issue is an elevation-of-privilege vulnerability that allows attackers to affect the system. No information is provided about the estimated number of...

PT-2022-15202 · Microsoft · Remote Desktop Licensing Diagnoser +1

Name of the Vulnerable Software and Affected Versions: Remote Desktop Licensing Diagnoser affected versions not specified Description: A vulnerability allows attackers to obtain sensitive information and affect the system. The issue concerns the Remote Desktop Licensing Diagnoser Information...

PT-2021-23399 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: livehelperchat affected versions not specified Description: The issue concerns the generation of error messages that contain sensitive information. This could potentially expose internal details, making it easier for attackers to exploit othe...

PT-2021-23376 · Unknown · Livehelperchat

Name of the Vulnerable Software and Affected Versions: livehelperchat affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software does not properly neutralize use...

PT-2021-13738 · Sma 410 +5 · Sma 410 +5

Name of the Vulnerable Software and Affected Versions: SMA 100 SMA 200 SMA 210 SMA 400 SMA 410 SMA 500v Description: An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. Recommendations: For SMA 100, consider...

PT-2021-7720 · Zabbix +2 · Zabbix +2

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to the lack of protection of the web page structure in Zabbix, allowing a remote attacker to impact data integrity. An authenticated user can create a hosts group from t...

PT-2021-17913 · Suse · Suse

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue is related to a security problem, but specific details are not provided. Recommendations: At the moment, there is no information about...