SUSE CVE-2020-24020

Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnnexecutelayerpad in libavfilter/dnn/dnnbackendnativelayerpad.c due to a call to memcpy without length checks, which could let a remote malicious user execute arbitrary code...

SUSE CVE-2022-21733

Tensorflow is an Open Source Machine Learning Framework. The implementation of StringNGrams can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on padwitdh and that result in computing a negative value for...

The vulnerability of the pretty.c::format_and_padCommit() function, a formatting mechanism for Git’s distributed version control system, allows a hacker to execute arbitrary code.

The vulnerability of the pretty.c::formatandpadCommit function, a formatting mechanism for Git’s distributed version control system, is related to buffer overflows in dynamic memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...

Prilex PoS Malware Evolves to Block Contactless Payments to Steal from NFC Cards

The Brazilian threat actors behind an advanced and modular point-of-sale PoS malware known as Prilex have reared their head once again with new updates that allow it to block contactless payment transactions. Russian cybersecurity firm Kaspersky said it detected three versions of Prilex 06.03.808...

git -- Heap overflow in `git archive`, `git log --format` leading to RCE

The git team reports: git log has the ability to display commits using an arbitrary format with its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators e.g., %, %, or % , an integer overflow can occur in...

CVE-2022-4087

A vulnerability was found in ipxe. This issue affects the tlsnewciphertext function in the src/net/tls.c file of the TLS component. The manipulation of the padlen argument leads to information exposure due to discrepancy...

GHSA-GQ2J-CR96-GVQX `MirrorPadGrad` heap out of bounds read

Impact If MirrorPadGrad is given outsize input paddings, TensorFlow will give a heap OOB error. python import tensorflow as tf tf.rawops.MirrorPadGradinput=1, paddings=0x77f00000,0xa000000, mode = 'REFLECT' Patches We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec9...

GHSA-762H-VPVW-3RCX Overflow in `FusedResizeAndPadConv2D`

Impact When tf.rawops.FusedResizeAndPadConv2D is given a large tensor shape, it overflows. python import tensorflow as tf mode = "REFLECT" strides = 1, 1, 1, 1 padding = "SAME" resizealigncorners = False input = tf.constant147, shape=3,3,1,1, dtype=tf.float16 size =...

CVE-2022-4087

A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tlsnewciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument padlen leads to information exposure through discrepancy. The name of the patch is...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read. This is If MirrorPadGrad is given outsize input paddings. Remediation Upgrade tensorflow-lite to version 2.12.0 or higher. References - GitHub Commit - Vulnerable Code Credit: Vul AI...

Google TensorFlow 安全漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow versions prior to 2.7.4, 2.8.0 and later, 2.8.1 and later, 2.9.0 and later, and 2.9.1 and earlier, which originates from "tf.rawops...

PT-2022-26116

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4 Description TensorFlow is an open source platform for machine learning. When tf.raw ops.FusedResizeAndPadConv2D is given a large tensor shape, it overflows...

CVE-2022-41885

TensorFlow is an open source platform for machine learning. When tf.rawops.FusedResizeAndPadConv2D is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick...

CVE-2022-41895

TensorFlow is an open source platform for machine learning. If MirrorPadGrad is given outsize input paddings, TensorFlow will give a heap OOB error. We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92. The fix will be included in TensorFlow 2.11. We will also...

Prilex: the pricey prickle credit card complex

Prilex is a Brazilian threat actor that has evolved out of ATM-focused malware into modular point-of-sale malware. The group was behind one of the largest attacks on ATMs in the country, infecting and jackpotting more than 1,000 machines, while also cloning in excess of 28,000 credit cards that...

CVE-2022-39801

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

Session fixation

SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker can gain access to admin session and...

Malicious code in meta-left-pad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a19253348a23c665bd890b1db3dc8d7961574a3009a13f687b22846bd355bad8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-FRGW-FGH6-9G52 Numpy missing input validation

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack...

Numpy missing input validation

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack...