641 matches found
PYSEC-2021-191
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in tf.rawops.DenseCountSparseOutput. This is because the...
PYSEC-2021-482
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in tf.rawops.DenseCountSparseOutput. This is because the...
PYSEC-2021-440
TensorFlow is an end-to-end open source platform for machine learning. If the splits argument of RaggedBincount does not specify a valid SparseTensorhttps://www.tensorflow.org/apidocs/python/tf/sparse/SparseTensor, then an attacker can trigger a heap buffer overflow. This will cause a read from...
CVE-2021-29525
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropInput. This is because the...
CVE-2021-29529
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in tf.rawops.QuantizedResizeBilinear by manipulating input values so that float rounding results in off-by-one error in accessing image elements. This is because the...
CVE-2021-29542
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow by passing crafted inputs to tf.rawops.StringNGrams. This is because the...
CVE-2021-29551
TensorFlow is an end-to-end open source platform for machine learning. The implementation of MatrixTriangularSolvehttps://github.com/tensorflow/tensorflow/blob/8cae746d8449c7dda5298327353d68613f16e798/tensorflow/core/kernels/linalg/matrixtriangularsolveopimpl.hL160-L240 fails to terminate kernel...
PT-2021-18349 · Google · Tensorflow
Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4 are also affected Description: The implementation of the SVDF TFLite operator in TensorFlow is vulnerable to a division by zero error. An attacker can craft...
PT-2021-18297 · Google · Tensorflow
Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.1.4 through 2.4.2 Description: An attacker can trigger an integer division by zero undefined behavior in tf.raw ops.QuantizedBiasAdd. This is because the implementation of the Eigen...
pickyourown.org Cross Site Scripting vulnerability OBB-1445758
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Security update for fossil (important)
openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2020:1478-1 Rating: important References: 1047218 1175760 Cross-References: CVE-2020-24614 Affected Products: openSUSE Leap 15.2 openSUSE Leap 15.1 openSUSE Backports SLE-15-SP2 openSUSE Backports SLE-15-SP1 An upda...
CVE-2020-15149
NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an...
0-dd-trace-init-first-production (>=1.0.0 <=1.0.1), 0.extends.wechat (>=1.0.51 <=1.0.65) +14394 more potentially affected by CVE-2020-8203 via lodash.pick (>=4.0.1 <=4.4.0)
lodash.pick NPM version =4.0.1, =1.0.0, =1.0.51, =1.0.3, =1.0.0, =1.0.0, =4.11.0, =1.0.0, =1.0.1-6.1, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2020-8203 Source advisory: OSV:GHSA-P6MC-M468-83GW...
Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires...
PT-2020-5991
Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.17.20 Lodash versions prior to 4.17.19 Description The issue is related to a prototype pollution attack when using the .zipObjectDeep function in Lodash. This can lead to denial of service or code execution under...
Real-life social engineering. Another two days in tweets
What happens in a real life social engineering exercise? There’s a lot of planning and preparation that goes on behind the scenes: it’s not a matter of turning up to a site and ‘winging it’! I live tweeted an exercise a little while back, to give a flavour of a real task in real time. For reasons...
Know before you go: Talos Threat Research Summit
We are now just 48 hours away from the second annual Talos Threat Research Summit. After last year's success in Orlando, we are back and better than ever from San Diego on Sunday. If you plan on attending, here's what you need to know before Sunday morning. Can't make it out? You can still stream...
pick-a-car.co.uk XSS vulnerability
Vulnerable URL: http://www.pick-a-car.co.uk/searchpage.php?make==any+model=%27%22%3e%3csvg/onload=confirm/openbugbounty/%3e Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website...
August 2, 2017 – Morning Cyber Coffee Headlines – “Declaration of Independence” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 2, 2017 - Headlines Carbon Black in the News: Carbon Black Hires Former...
pick-in.com XSS vulnerability
Vulnerable URL: https://www.pick-in.com/search?q=999" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check pick-in.com SSL connection:| Grade: A Coordinated...