CVE-2022-35888

CVE-2022-35888 affects Ampere Altra and Ampere Altra Max devices through 2022-07-15. The issue enables Hertzbleed, a power side-channel attack that can extract secret information by correlating CPU power consumption with processed data. The base CVSS vector indicates Network attack vector, low at...

CVE-2022-35888: Observable Discrepancy

Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret information from the CPU by correlating the power consumption with data being processed on the system...

Ampere Computing Ampere Altra 安全漏洞

Ampere Computing Ampere Altra is an 80-core server processor from Ampere Computing, USA. A security vulnerability exists in Ampere Altra and Ampere Altra Max 2022-7-15 and prior versions, which stems from an attack that allows via Hertzbleed, secret information to be extracted from the CPU by...

PT-2025-38168

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where an invalid max flowrings number read from a dongle during firmware initialization can cause a kernel panic when attempting to initialize the dong...

Users cannot use mintWithSignature() function in most cases

Lines of code Vulnerability details Impact Function sfrxETH.mintWithSignature allows users to approve and mint in one transaction. Users will provide input param shares and function will calculate what assets amount needed to be approved in case approveMax = false. uint256 amount = approveMax ?...

PT-2025-1375

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically in the media: s5p cec component, where the msg.len is limited to CEC MAX MSG SIZE. This change is intended to handle a...

Cross site scripting

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Max Foundry Button Plugin MaxButtons plugin = 9.2 at WordPress...

CVE-2022-38703 WordPress Button Plugin MaxButtons plugin <= 9.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Max Foundry Button Plugin MaxButtons plugin = 9.2 at WordPress...

CVE-2022-38703: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Max Foundry Button Plugin MaxButtons plugin = 9.2 at WordPress...

VariableSupplyERC20Token bypass max supply

Lines of code Vulnerability details Impact When minting the tokens in VariableSupplyERC20Token the mintableSupply is reduced, thus you can bypass the max supply limit once it hits 0 because 0 means unlimited. As far as I understand, the total supply should never reach the cap set in the construct...

FAAD2 calculate_gain Heap Buffer Overflow DoS

The vulnerability of the calculategain function in the libfaad/sbrhfadj.c component of the Freeware Advanced Audio Decoder 2 FAAD2 audio decoder is related to the lack of comparison with MAXM. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its...

PT-2022-34087 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue is related to a refcount leak in the xive get max prio function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-34393 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.14 through 4.19.255 Description: The issue is related to a refcount leak in the xive get max prio function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

GHSA-VXV8-R8Q2-63XW TensorFlow vulnerable to `CHECK` fail in `FractionalMaxPoolGrad`

Impact FractionalMaxPoolGrad validates its inputs with CHECK failures instead of with returning errors. If it gets incorrectly sized inputs, the CHECK failure can be used to trigger a denial of service attack: python import tensorflow as tf overlapping = True originput = tf.constant.453409232,...

GHSA-V7VW-577F-VP8X TensorFlow vulnerable to segfault in `QuantizedRelu` and `QuantizedRelu6`

Impact If QuantizedRelu or QuantizedRelu6 are given nonscalar inputs for minfeatures or maxfeatures, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf outtype = tf.quint8 features = tf.constant28, shape=4,2, dtype=tf.quint8 minfeatures...

GHSA-VGVH-2PF4-JR2X TensorFlow vulnerable to segfault in `QuantizeDownAndShrinkRange`

Impact If QuantizeDownAndShrinkRange is given nonscalar inputs for inputmin or inputmax, it results in a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf outtype = tf.quint8 input = tf.constant1, shape=3, dtype=tf.qint32 inputmin = tf.constant,...

GHSA-689C-R7H2-FV9V TensorFlow vulnerable to segfault in `QuantizedMatMul`

Impact If QuantizedMatMul is given nonscalar input for: - mina - maxa - minb - maxb It gives a segfault that can be used to trigger a denial of service attack. python import tensorflow as tf Toutput = tf.qint32 transposea = False transposeb = False Tactivation = tf.quint8 a = tf.constant7,...

GHSA-9FPG-838V-WPV7 TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVars`

Impact If FakeQuantWithMinMaxVars is given min or max tensors of a nonzero rank, it results in a CHECK fail that can be used to trigger a denial of service attack. python import tensorflow as tf numbits = 8 narrowrange = False inputs = tf.constant0, shape=2,3, dtype=tf.float32 min = tf.constant0,...

GHSA-H7FF-CFC9-WMMH TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannelGradient`

Impact When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. python import tensorflow as tf arg0=tf.random.uniformshape=1,1, dtype=tf.float32, maxval=None...

CVE-2022-36005

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsgradient receives input min or max that is nonscalar, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...