PYSEC-2021-743

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via CHECK-fail in tf.strings.substr with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3,...

PYSEC-2021-242

TensorFlow is an end-to-end open source platform for machine learning. The TFLite code for allocating TFLiteIntArrays is vulnerable to an integer overflow issuehttps://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.cL24-L27. An attacker can...

PYSEC-2021-692

TensorFlow is an end-to-end open source platform for machine learning. An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to tf.rawops.Dilation2DBackpropInput. This is because the...

PYSEC-2021-255

TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to tf.transpose at the same time as passing conjugate=True argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFl...

CVE-2021-29603

TensorFlow is an end-to-end open source platform for machine learning. A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of...

PYSEC-2021-161

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropFilter. This is because the...

CVE-2021-29527

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.QuantizedConv2D. This is because the...

PT-2021-19950 · Unknown · Express-Hbs

Name of the Vulnerable Software and Affected Versions: express-hbs affected versions not specified Description: The issue arises from express-hbs mixing pure template data with engine configuration options through the Express render API, potentially leading to file disclosure vulnerabilities in...

PT-2021-3049 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to insufficient access control in the Windows Graphics Component, which can be exploited to elevate privileges. This can allow an attacker to affect...

PT-2021-3046 · Microsoft · Accessibility Insights For Web

Name of the Vulnerable Software and Affected Versions: Microsoft Accessibility Insights for Web affected versions not specified Description: The issue is related to a lack of protection for service data in the Microsoft Accessibility Insights for Web browser extension. Exploitation of this issue...

PT-2021-3100 · Microsoft · Windows Container Manager Service +1

Name of the Vulnerable Software and Affected Versions: Windows Container Manager Service affected versions not specified Description: The issue is related to insecure privilege management in the Windows Container Manager Service, which can be exploited to elevate privileges. This allows an attack...

PT-2021-2821 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC Software affected versions not specified Description: The issue is related to insufficient validation of user-supplied input by the web-based management interface, which could allow an unauthenticated,...

DEBIAN-CVE-2021-29470

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An out-of-bounds read was found in Exiv2 versions v0.27.3 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An...

PT-2024-11122 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak issue has been resolved in the Linux kernel. The issue occurred when mt7915 unregister device was called, and mt7915 tx token put should have been called before mt76 free...

PT-2021-2685 · Microsoft · Office Word +1

Name of the Vulnerable Software and Affected Versions: Microsoft Word affected versions not specified Description: The issue is related to errors in code generation management in Microsoft Word, allowing remote attackers to execute arbitrary code. This can be exploited to gain unauthorized access...

PT-2021-2672 · Unknown · Raw Image Extension

Name of the Vulnerable Software and Affected Versions: Raw Image Extension affected versions not specified Description: The issue is related to incorrect code generation management in the Raw Image Extension plugin. It can be exploited by an attacker to execute arbitrary code using a specially...

PT-2024-11142 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A memory leak issue has been identified in the Linux kernel, specifically in the crypto: sa2ul component. The problem arises from two error return paths that fail to free the rxd...

PT-2021-2546 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: The issue is related to errors in access control, which could allow an attacker to modify any user account. It may also enable an unauthenticated, remote attacker to...

Stored XSS vulnerability in extra-columns

extra-columns 1.22 and earlier does not escape parameter values in the build parameters column. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build...

PT-2024-11144 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a potential reference count leak in the Linux kernel. The reference count of a child is incremented and decremented automatically in the for each available chil...