CVE-2021-22866

The CVE describes a UI misrepresentation in GitHub Enterprise Server’s GitHub App authorization flow. A user could grant more permissions than shown if the App had additional user-level permissions added after initial approval, by revisiting the authorization flow. Affected products/versions: Git...

PYSEC-2021-731

TensorFlow is an end-to-end open source platform for machine learning. The TFLite code for allocating TFLiteIntArrays is vulnerable to an integer overflow issuehttps://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.cL24-L27. An attacker can...

CVE-2021-29597

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the SpaceToBatchNd TFLite operator is vulnerable to a division by zero error. An attacker can craft a model such that one dimension of the block input is 0. Hence, the corresponding value in blockshape is...

PYSEC-2021-460

TensorFlow is an end-to-end open source platform for machine learning. An attacker can force accesses outside the bounds of heap allocated arrays by passing in invalid tensor values to tf.rawops.RaggedCross. This is because the...

PYSEC-2021-676

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in tf.rawops.FractionalAvgPool. This is because the...

CVE-2021-29587

TensorFlow is an end-to-end open source platform for machine learning. The Prepare step of the SpaceToDepth TFLite operator does not check for 0 before divisionhttps://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/spacetodepth.ccL63-L67. An...

Weak password vulnerability in Airspace Technologies WIFISKY 7-layer flow control router

Shenzhen Airspace Technology Co., Ltd. is a supplier of network communication equipment, dedicated to the research and development of network communication equipment. Weak password vulnerability exists in Airspace Technology WIFISKY 7-layer flow control router. Attackers utilize the weak password...

SQL Injection Vulnerability in web management interface of Aifei Flow Control Route.

The business scope of All Answers Convergence Network Technology Beijing Co., Ltd. includes: operation of telecommunication business; Internet information service; technology development, technology service, technology consulting, technology transfer, technology promotion and so on. SQL injection...

PT-2021-15239

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 2.22.x prior to 2.22.13 GitHub Enterprise Server versions 3.0.x prior to 3.0.7 Description A UI misrepresentation issue was identified that allowed more permissions to be granted during a GitHub App's...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Google TensorFlow 2.4.2, 2.3.3, 2.2.3, 2.1.4, which stems from the absence of loops between nodes of a TFlite graph. No detailed vulnerability details are...

CVE-2021-22866: User Interface (UI) Misrepresentation of Critical Information

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be granted during a GitHub App's user-authorization web flow than was displayed to the user during approval. To exploit this vulnerability, an attacker would need to create a GitHub Ap...

Logic Flaw Vulnerability in Enterprise Flow Control Cloud Router

Founded in October 2016, Chengdu ZhiBee.com Technology Limited Liability Company is an emerging high-tech company integrating research and development, production and sales. A logic flaw vulnerability exists in the Enterprise Flow Control Cloud Router, which can be exploited by attackers to obtai...

Weak Password Vulnerability in Aifei Flow Control Routing of AllConvergence Network Technology (Beijing) Co.

Quanxun Convergence Network Technology Beijing Co., Ltd. was founded in 2013, love fast, iKuai is the company's product brand, iKuic is the company's overseas product brand. A weak password vulnerability exists in iKuai flow control routing, which can be exploited by attackers to obtain sensitive...

dom-to-gaffa (>=0.0.1, <=0.0.2), gaffa (>=0.1.0, <=1.23.2) +7 more potentially affected by CVE-2020-7727 via gedi (1.6.3)

gedi NPM version 1.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on gedi and may be impacted: - dom-to-gaffa =0.0.1, =0.1.0, =0.0.1, =1.0.0, =0.0.1, =0.1.0, =0.0.1, =0.3.2, =0.3.3 Source cves: CVE-2020-7727 Source advisory: OSV:GHSA-JH2M-J8PP-55RC...

IBM QRadar SIEM Hardcoded Credentials Vulnerability

QRadar SIEM is an IBM enterprise security information and event management product that consolidates log event and network flow data from thousands of devices, endpoints and applications scattered across the network. A hard-coded credentials vulnerability exists in IBM QRadar SIEM versions 7.3 an...

Vaadin flow 安全漏洞

Vaadin flow is a software application. the Java framework for the Vaadin platform for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in vaadin that allows a local user to inject malicious code into front-end resources duri...

PT-2021-19293

Name of the Vulnerable Software and Affected Versions com.vaadin:flow-server versions 2.0.9 through 2.5.2 com.vaadin:flow-server versions 3.0 prior to 6.0 com.vaadin:flow-server versions 6.0.0 through 6.0.5 Description Insecure temporary directory usage in frontend build functionality allows loca...

GitHub Security Lab: ihsinme: CPP Add query for CWE-691 Insufficient Control Flow Management After Refactoring The Code

This bug was reported directly to GitHub Security Lab...

CVE-2021-31411

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 Vaadin 14.0.3 through Vaadin 14.5.2, 3.0 prior to 6.0 Vaadin 15 prior to 19, and 6.0.0 through 6.0.5 Vaadin 19.0.0 through 19.0.4 allows local users to inject malicious code...

Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19

Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 Vaadin 14.0.3 through Vaadin 14.5.2, 3.0 prior to 6.0 Vaadin 15 prior to 19, and 6.0.0 through 6.0.5 Vaadin 19.0.0 through 19.0.4 allows local users to inject malicious code...