CVE-2021-41197

CVE-2021-41197 concerns TensorFlow where treating large tensor shapes can overflow int64, causing a CHECK-failure abort during shape construction (notably in operations like tf.math.segment_, SparseCwise , and depthwise-related paths). The issue is addressed by upstream fixes, with the primary pa...

CVE-2021-41198

CVE-2021-41198 affects TensorFlow where calling tf.tile with very large inputs can trigger a CHECK failure due to int64 overflow, crashing the process. The issue is rooted in the tile operation’s handling of output size and overflow detection. Remediation is available: TensorFlow 2.7.0 includes t...

CVE-2021-41198 Overflow/crash in `tf.tile` when tiling tensor is large

TensorFlow is an open source platform for machine learning. In affected versions if tf.tile is called with a large input argument then the TensorFlow process will crash due to a CHECK-failure caused by an overflow. The number of elements in the output tensor is too much for the int64t type and th...

CVE-2021-41199

CVE-2021-41199 refers to an overflow crash in TensorFlow’s tf.image.resize when the output size is very large. Affected TF versions up to 2.7.0 (and cherry-picks for 2.6.1, 2.5.2, 2.4.4) abort the process via a CHECK failure due to int64 overflow while computing the output tensor size. Connected ...

CVE-2021-41196

CVE-2021-41196 affects TensorFlow (Keras pooling layers). In affected builds, pooling operations can segfault when pool size is 0 or a dimension is negative because values in the sliding window are not checked to be strictly positive. The issue is tied to TensorFlow’s pooling implementation, with...

CVE-2021-41195

TensorFlow CVE-2021-41195 affects tf.math.segment_* implementations; large segment_ids can trigger a CHECK failure and abort due to int64 overflow when computing output shapes. Vulnerable CPU/GPU paths use AddDim, with AddDimWithStatus needed to prevent overflow. The fix is planned for TensorFlow...

Deserialization of untrusted data

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability...

SUSE: Security Advisory (SUSE-SU-2021:3611-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:3611-1 Security update for systemd

This update for systemd fixes the following issues: - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 - Add timestamp to D-Bus events to improve traceability. jscSLE-21894 - busctl: add a timestamp to the output of the busctl monitor command bsc1180225, jscSLE-21894 -...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueueadd function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the...

CVE-2021-38418

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization...

Authorization

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization...

CVE-2021-38418

Delta Electronics DIALink (versions 1.2.4.0 and earlier) runs by default over HTTP, enabling potential machine-in-the-middle access to sensitive information. The CVE-2021-38418 issue is classified as high risk (CISA says 8.8/3.1) due to cleartext transmission of sensitive data. Affected component...

CVE-2021-38418 Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization...

Cisco HyperFlex HX Data Platform Command Injection Vulnerability

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user...

Cisco HyperFlex HX Installer Virtual Machine Command Injection Vulnerability

Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the root user...

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

kernel: SVM nested virtualization issue in KVM (VMLOAD/VMSAVE)

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB virtual machine control block provided by the L1 guest to spawn/handle a nested guest L2. Due to improper validation of the "virtext" field, this issue could allow a malicious...

10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow (SEH) Exploit

Exploit Title: 10-Strike Network Inventory Explorer Pro 9.31 - Buffer Overflow SEH Exploit Author: ro0k Vendor Homepage: https://www.10-strike.com/ Software Link: https://www.10-strike.com/networkinventoryexplorer/network-inventory-pro-setup.exe Version: 9.31 Tested on: Windows 10 x64 Education...

Gradle Remote Code Execution Vulnerability

Gradle is the U.S. Gradle company's set of JVM-based project build tool , it supports maven, Ivy repository and so on. A remote code execution vulnerability exists in Gradle Enterprise prior to 2021.1.2, which stems from the installation configuration user interface available to administrators...