Google TensorFlow security vulnerabilities

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google Inc. in the United States. Google TensorFlow suffers from a security vulnerability that stems from the fact that when tf.quantization.fakequantwithminmaxvarsperchannelgradient receives an input min o...

CVE-2022-35990: Reachable Assertion

TensorFlow is an open source platform for machine learning. When tf.quantization.fakequantwithminmaxvarsperchannelgradient receives input min or max of rank other than 1, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit...

PT-2022-23070

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1, 2.8.1, and 2.7.2 Description The issue arises when FakeQuantWithMinMaxVars is given min or max tensors of a nonzero rank, resulting in a CHECK fail that can be used to trigger a...

Google TensorFlow security vulnerabilities

Google TensorFlow is an end-to-end open source platform for machine learning from Google, Inc. A denial-of-service vulnerability exists in Google TensorFlow, which stems from the fact that FakeQuantWithMinMaxVars will fail to assert if it is given a tensor of non-zero rank min or max. An attacker...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.7.0, <=0.7.1), io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.2.final, <=1.2.3.final) +51 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (1.9.0.final)

org.keycloak:keycloak-core MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.7.0, =1.2.2.final, =1.2.2.final, =1.2.2.final,...

Dynamic quorum votes parameters for a proposal (Proposal A) are changed according to another proposal (Proposal B) that proposes to update dynamic quorum votes parameters when Proposal B is executed after Proposal A is created in the same block

Lines of code Vulnerability details Impact The following writeQuorumParamsCheckpoint function is used to record dynamic quorum votes parameters at a block of interest. function writeQuorumParamsCheckpointDynamicQuorumParams memory params internal uint32 blockNumber = safe32block.number, 'block...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.7.beta1, <=1.2.7.final), io.apiman:apiman-distro-eap7 (>=1.2.7.beta1, <=1.2.7.final) +49 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (1.9.7.final)

org.keycloak:keycloak-core MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.2.7.beta1, =1.2.7.beta1, =1.2.7.beta1,...

WordPress Enable SVG, WebP & ICO Upload plugin <= 1.0.3 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability discovered by Kim Jong Min aka Universe Patchstack Alliance in WordPress Enable SVG, WebP & ICO Upload plugin versions = 1.0.3. Solution No patched version available...

PT-2022-32391

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.15 Description The issue concerns a data-race condition around the sysctl tcp min snd mss setting in the TCP implementation. This condition may potentially lead to security vulnerabilities, although the...

PT-2022-32941

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.208 Description The issue concerns a data-race around sysctl tcp min snd mss in the tcp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-32613

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.58 Description The issue concerns a data-race condition around the sysctl tcp min snd mss setting in the TCP implementation. The actual impact and potential for attack have not been fully determined...

PT-2022-32797

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.134 Description The issue concerns a data-race around sysctl tcp min snd mss in the tcp module. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2025-8591

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to insufficient bounds propagation in the Linux kernel's bpf Berkeley Packet Filter functionality. Specifically, it concerns the adjust scalar min max vals function,...

CVE-2021-33648

When performing the inference shape operation of Affine, Concat, MatMul, ArgMinMax, EmbeddingLookup, and Gather operators, if the input shape size is 0, it will access data outside of bounds of shape which allocated from heap buffers...

Huawei MindSpore Community Buffer Error Vulnerability

Huawei MindSpore Community is an open source deep learning framework from Huawei, China. Huawei MindSpore Community suffers from an information disclosure vulnerability that stems from accessing a shape allocated from the heap buffer if the input shape size is 0 when performing inferred shape...

CVE-2022-31025

CVE-2022-31025 affects Discourse; prior to versions 2.8.4 (stable) and 2.9.0beta5 (beta/tests-passed) an SSO-based invite could bypass must_approve_users, causing invites by staff to be auto-approved. A fix is available: Discourse 2.8.4 on stable and 2.9.0.beta5 on beta/tests-passed. Workarounds ...

org.hawkular.accounts:hawkular-accounts (>=2.0.23.final, <=2.0.39.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.23.final, <=2.0.39.final) +53 more potentially affected by CVE-2020-27838 via org.keycloak:keycloak-core (1.9.1.final)

org.keycloak:keycloak-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.23.final, =2.0.23.final, =2.0.23.final, =2.0.23.final,...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +54 more potentially affected by CVE-2020-10770 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.1.0,...

org.keycloak:keycloak-adapter-core (1.9.5.final), org.keycloak:keycloak-admin-client (1.9.5.final) +43 more potentially affected by CVE-2020-1724 via org.keycloak:keycloak-core (1.9.5.final)

org.keycloak:keycloak-core MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 1.9.5.final - org.keycloak:keycloak-admin-client 1.9.5.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.7.0, <=0.7.1), io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.2.final, <=1.2.3.final) +51 more potentially affected by CVE-2020-10686 via org.keycloak:keycloak-core (1.9.0.final)

org.keycloak:keycloak-core MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.7.0, =1.2.2.final, =1.2.2.final, =1.2.2.final,...