PT-2022-11908 · Odyssey +1 · Odyssey +1

Name of the Vulnerable Software and Affected Versions: Odyssey affected versions not specified Description: The issue allows a man-in-the-middle attacker to inject false responses to the client's initial queries when Odyssey storage is configured to use the PostgreSQL server with specific...

UVI-2021-1002212 comedi: dt9812: fix DMA buffers on stack

comedi: dt9812: fix DMA buffers on stack This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.2 by commit...

PT-2021-5295 · Microsoft · Visual Studio

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Studio affected versions not specified Description: The issue is related to insufficient access restrictions in Microsoft Visual Studio, allowing an attacker to bypass security restrictions and elevate their privileges...

PT-2021-5265 · Microsoft · Windows Media Foundation +1

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Media Foundation affected versions not specified Description: The issue is related to incorrect code generation management in the Microsoft Windows Media Foundation component of the Windows operating system. It allows remote...

PT-2021-5084 · Microsoft · Azure Rtos

Name of the Vulnerable Software and Affected Versions: Azure RTOS affected versions not specified Description: The issue is related to insufficient boundaries in the controlled area of the system, which can allow an attacker to gain unauthorized access to the device. Recommendations: At the momen...

PT-2021-5070 · Microsoft · Office Excel +1

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Description: The issue is related to incorrect code generation management in Microsoft Excel, allowing remote attackers to execute arbitrary code. This can be exploited by attackers to gain...

PYSEC-2021-814

TensorFlow is an open source platform for machine learning. In affected versions the implementation of ParallelConcat misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow...

PYSEC-2021-401

TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1,...

CVE-2021-41212

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for tf.ragged.cross can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1,...

CVE-2021-41200

TensorFlow is an open source platform for machine learning. In affected versions if tf.summary.createfilewriter is called with non-scalar arguments code crashes due to a CHECK-fail. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow...

PT-2021-23119 · Minio · Minio

Name of the Vulnerable Software and Affected Versions: Minio versions RELEASE.2021-10-10T16-53-30Z through RELEASE.2021-10-12T23-59-59Z Description: The issue involves bypassing policy restrictions on regular users in Minio, a Kubernetes native application for cloud storage. Normally, the...

PT-2021-4371 · Microsoft · Windows Dns Server +1

Name of the Vulnerable Software and Affected Versions: Windows DNS Server affected versions not specified Description: The issue is related to incorrect code generation management in the Windows DNS Server component. It allows remote attackers to execute arbitrary code, affecting the system...

PT-2021-4379 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in privilege management within the Windows operating system. It allows an attacker to potentially elevate their privileges. Recommendations: At the moment,...

PT-2021-4394 · Microsoft · Windows Ad Fs +1

Name of the Vulnerable Software and Affected Versions: Windows AD FS affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to bypass the security mechanism. This can affect the system. Recommendations: At the moment, there is ...

PT-2021-4374 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an information disclosure vulnerability. It allows attackers to obtain sensitive information and potentially affect the system. There is no information provided abou...

PT-2021-22718 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 and later Description: The issue allows an attacker to bypass the setting to disable Bitbucket Server import by making a crafted API call. This affects instances of GitLab CE/EE where this setting is enabled...

CVE-2021-22869

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group...

PT-2021-21941 · Npm +2 · Object-Path +2

Name of the Vulnerable Software and Affected Versions: object-path affected versions not specified Description: The issue is related to Improperly Controlled Modification of Object Prototype Attributes, also known as 'Prototype Pollution'. This occurs because the del function does not properly...

GHSA-5VP3-V4HC-GX76 UUPSUpgradeable vulnerability in @openzeppelin/contracts

Impact Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon. Patches A fix is included in version 4.3.2 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeabl...

PT-2021-6318 · Microsoft · Windows Subsystem For Linux +1

Name of the Vulnerable Software and Affected Versions: Windows Subsystem for Linux affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Subsystem for Linux, which can be exploited to elevate privileges. This could allow an attacker t...