CVE-2022-35939

TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have...

CVE-2022-35935 `CHECK` failure in `SobolSample` via missing validation in TensorFlow

TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure assertion failure caused by assuming input0, input1, and input2 to be scalar. This issue has been patched in GitHub commit...

CVE-2022-35934 `CHECK` failure in tf.reshape in Tensorflow

TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure assertion failure caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit...

PT-2022-33273 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.6 Description: The issue concerns array range checking for poke descriptors in the bpf module. It was introduced in version v5.5 and fixed in version v5.19.6. The actual impact and attack plausibility have...

PT-2022-26164 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 13.1RC1 through 14.6RC1 XWiki Platform versions 13.1RC1 through 14.4.3 XWiki Platform versions 13.1RC1 through 13.10.8 Description: The XWiki Platform has a vulnerability where the password is stored in plain text in t...

Google TensorFlow 缓冲区错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. Google TensorFlow suffers from a buffer error vulnerability that stems from the ScatterNd function accepting an input parameter that determines the index of the output...

PT-2022-33407 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: The issue is related to an out of range error in the aq vec index. It was introduced in version v4.11 and fixed in version v5.19.4. The actual impact and attack plausibility have not yet bee...

Google TensorFlow 输入验证错误漏洞

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google, Inc. in the United States. Google TensorFlow suffers from an input validation error vulnerability that stems from it crashing when RangeSize receives a value that does not fit into int64t. The...

PT-2022-33342 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: The issue is related to the ext4 file system, where a block range must be validated before use in the ext4 mb clear bb function. The actual impact and attack plausibility have not yet been...

PT-2022-33676 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 5.15.61 through 5.15.65 Description: A potential security issue exists in the Linux Kernel, related to the bpf and cgroup subsystems. The issue is described as a kernel BUG in purge effective progs. The actual impact and...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Vim vulnerabilities (USN-5613-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5613-1 advisory. It was discovered that Vim was not properly performing bounds checks when executing spell suggestion commands. An attacker could...

EC-CUBE 跨站脚本漏洞

EC-CUBE is an open source e-commerce system from the Japanese company EC-CUBE. A security vulnerability exists in EC-CUBE versions 4.0.0 through 4.1.2, which stems from a DOM-based cross-site scripting vulnerability that could allow a remote attacker to execute arbitrary script on the...

Tauri 后置链接漏洞

Tauri is a Tauri open source for building smaller, faster, and more secure desktop applications using a web front end. Tauri versions prior to 1.0.6 have a backlink vulnerability that stems from a lack of normalization when calling readDir recursively, potentially displaying directory listings...

Project Wonder 跨站脚本漏洞

Project Wonder is an open source collection of reusable WebObjects frameworks, applications and extensions open sourced by the WOCommunity Association. A security vulnerability exists in Project Wonder versions 1.0 through 5.4.3 that stems from vulnerability to arbitrary HTTP header injection and...

CVE-2022-38539

Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply...

PT-2022-24443 · Archery · Archery

Name of the Vulnerable Software and Affected Versions: Archery versions 1.4.5 through 1.8.5 Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities exist via the start file, end file, start time, and stop time parameters in the binlog2sql interface...

Archery SQL注入漏洞

Archery is a set of open source vulnerability assessment and management tools. A security vulnerability exists in Archery versions v1.4.0 through v1.8.5, which stems from the ThreadIDs parameter in the createkillsession interface containing a SQL injection vulnerability...

Archery SQL注入漏洞

Archery is a set of open source vulnerability assessment and management tools. A security vulnerability exists in Archery versions v1.4.5 through v1.8.5, which stems from the startfile, endfile, and starttime parameters in the binlog2sql interface containing multiple SQL injection vulnerabilities...

Archery SQL注入漏洞

Archery is a set of open source vulnerability assessment and management tools. A security vulnerability exists in Archery versions v1.8.3 through v1.8.5, which stems from the starttime and stoptime parameters in the my2sql interface containing SQL injection vulnerabilities...

Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients

Some components in Apache Kafka use Arrays.equals to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been...