XWiki Platform 跨站脚本漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in the XWiki Platform Wiki UI Main Wiki that stems from an issue with the XWiki Platform Wiki UI Main Wiki containing a cross-site script vector i...

GHSA-HX9Q-2MX4-M4PG Missing validation causes denial of service via `Conv3DBackpropFilterV2`

Impact The implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.strings.unsortedsegmentjoin inputs='123', segmentids=0, numsegments=-1...

GHSA-HRG5-737C-2P56 Missing validation causes denial of service via `UnsortedSegmentJoin`

Impact The implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.rawops.UnsortedSegmentJoin inputs=tf.constant"this", shape=12,...

GHSA-JV65-PF7V-F7P8 Deserialization of Untrusted Data in Hazelcast

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code...

CVE-2022-29204

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. T...

PT-2022-19449

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4 Description The implementation of tf.raw ops.UnsortedSegmentJoin does not fully validate the input...

GHSA-96VX-QF28-6F8M Drupal Access Control Bypass

Drupal 7.x before 7.3 allows remote attackers to bypass intended nodeaccess restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table...

GHSA-CCQF-C5HQ-77MP Missing Authorization in Apache ZooKeeper

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader...

kernel: mptcp: fix deadlock in __mptcp_push_pending()

A vulnerability was found in the Linux kernel's mptcp component in the mptcppushpending function, where a deadlock can occur when calling mptcpflushjoinlist with the subflow socket lock held. This happens if the synchronization function mptcpsockoptsyncall is invoked, causing the system to hang d...

kernel: mptcp: fix deadlock in __mptcp_push_pending()

A vulnerability was found in the Linux kernel's mptcp component in the mptcppushpending function, where a deadlock can occur when calling mptcpflushjoinlist with the subflow socket lock held. This happens if the synchronization function mptcpsockoptsyncall is invoked, causing the system to hang d...

PT-2022-16970 · Flask +1 · Flask +1

Name of the Vulnerable Software and Affected Versions: Piano LED Visualizer versions 1.3 and prior Description: The issue concerns a path traversal attack. The os.path.join call is unsafe for use with untrusted input, as it ignores all parameters encountered before an absolute path and starts...

Piano LED Visualizer 安全漏洞

Piano LED Visualizer is a piano playing software. A security vulnerability exists in Piano LED Visualizer version 1.3 and prior versions that stems from an insecure os.path.join when using untrusted input...

mariadb: crash in Used_tables_and_const_cache::used_tables_and_const_cache_join

A flaw was found in MariaDB. An issue in the component, Usedtablesandconstcache::usedtablesandconstcachejoin, of the MariaDB Server v10.7 allows attackers to cause a denial of service DoS via specially crafted SQL statements, impacting availability...

mariadb: crash in Used_tables_and_const_cache::used_tables_and_const_cache_join

A flaw was found in MariaDB. An issue in the component, Usedtablesandconstcache::usedtablesandconstcachejoin, of the MariaDB Server v10.7 allows attackers to cause a denial of service DoS via specially crafted SQL statements, impacting availability...

The vulnerability of the Used_tables_and_const_cache::used_tables_and_const_cache_join component of the MariaDB database management system allows a hacker to cause a service failure.

The vulnerability of the Usedtablesandconstcache::usedtablesandconstcachejoin component of the MariaDB database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to trigger service failures using...

GSD-2022-1002516 mac80211: fix potential double free on mesh join

mac80211: fix potential double free on mesh join This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.309 by commit...

GSD-2022-1002455 mac80211: fix potential double free on mesh join

mac80211: fix potential double free on mesh join This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.274 by commit...

GSD-2022-1002379 mac80211: fix potential double free on mesh join

mac80211: fix potential double free on mesh join This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.237 by commit...

GSD-2022-1002286 mac80211: fix potential double free on mesh join

mac80211: fix potential double free on mesh join This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.188 by commit...

GSD-2022-1002149 mac80211: fix potential double free on mesh join

mac80211: fix potential double free on mesh join This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.109 by commit...