46 matches found
PYSEC-2026-3342 Missing validation causes denial of service via `Conv3DBackpropFilterV2`
Impact The implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.strings.unsortedsegmentjoin inputs='123', segmentids=0, numsegments=-1...
CVE-2026-2519: External Control of Assumed-Immutable Web Parameter
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configure...
EUVD-2003-1461
Malware in sbrugna...
EUVD-2021-16966
Malware in sbrugna...
EUVD-2021-15916
Malware in sbrugna...
EUVD-2023-1650
Malicious code in bioql PyPI...
EUVD-2025-18190
Malicious code in bioql PyPI...
SQL Injection
pg-promise is vulnerable to SQL Injection. The vulnerability is due to improper handling of negative numbers, which allows an attacker to manipulate SQL queries by injecting malicious input...
CVE-2025-29744
pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...
pg-promise SQL Injection vulnerability
pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...
pg-promise 安全漏洞
pg-promise is a PostgreSQL interface for Node.js by Vitaly Tomilov Personal Developer. A security vulnerability exists in pg-promise versions prior to 11.5.5, which stems from mishandling of negative numbers and may lead to SQL injection...
CVE-2025-29744
The pg-promise library (NPM) versions prior to 11.5.5 are vulnerable to SQL Injection due to the improper handling of negative numbers. This flaw allows an attacker to manipulate SQL queries by injecting malicious input. Several packages, including parse-server , class-controller , and @evdhiggin...
PT-2024-34115
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, specifically in the media module cx24116, where an underflow could occur when reading SNR registers if the reading process fails,...
CVE-2024-36740
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service DoS when index as a negative number exceeds the range of size...
Design/Logic Flaw
The Customer Management Framework CMF for Pimcore adds functionality for customer data management. In pimcore/customer-management-framework-bundle prior to version 3.3.9, business logic errors are possible in the Conditions tab since the counter can be a negative number. This vulnerability is...
Input validation and money transfer vulnerability with negative number
Description I transfer money from account1 to account2. According to the scenario, account 1 will be deducted, and account 2 will add money. But account1 was add, account was sub. If I use a negative number and its value exceeds the account balance, the money will still be added to the transfer...
Denial Of Service (DoS)
tensorflow is vulnerable to denial of service. The vulnerability exists due to an integer overflow in OpLevelCostEstimator::CalculateOutputSize allowing an attacker to crash the system by inputting a negative number into the cost estimate...
YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number
YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number...
PYSEC-2021-574
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in boostedtreescreatequantilestreamresource by using negative arguments. The implementation does not validate that numstreams only contains non-negative numbers. I...
PYSEC-2021-772
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in boostedtreescreatequantilestreamresource by using negative arguments. The implementation does not validate that numstreams only contains non-negative numbers. I...