825 matches found
PYSEC-2021-746
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data. The implementation fails to validate that each reduction group does not overfl...
PYSEC-2021-257
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data. The implementation fails to validate that each reduction group does not overfl...
CVE-2021-37635
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data. The implementation fails to validate that each reduction group does not overfl...
PT-2021-21750 · Google · Tensorflow
Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier Description: The implementation of sparse reduction operations in TensorFlow can trigger...
Google TensorFlow缓冲区错误漏洞
Google TensorFlow is an end-to-end open source machine learning platform. an information disclosure vulnerability exists in Google TensorFlow TensorFlow sparse reduction. An attacker could exploit this vulnerability to read data from outside the boundaries of the heap allocation data or cause a...
5 Themes for Product Security and Fostering Organizational Growth
In this article we would like to review what Raj Umadas, Product Security Manager at Compass, has shared during our recent webinar highlighting recurring themes that have led to impactful collaborations and organizational risk reduction. Product security ProdSec is crucial in the process of growi...
Top Routinely Exploited Vulnerabilities
CISA, the Australian Cyber Security Centre ACSC, the United Kingdom’s National Cyber Security Centre NCSC, and the U.S. Federal Bureau of Investigation FBI have released the Joint Cybersecurity Advisory Top Routinely Exploited Vulnerabilities, which details the top vulnerabilities routinely...
Improper access control of claimAllForMember allows anyone to reduce the weight of a member
Handle shw Vulnerability details Impact The claimAllForMember function of Dao is permissionless, allowing anyone to claim the unlocked bonded LP tokens for any member. However, claiming a member's LP tokens could decrease the member's weight in the BondVault, thus affecting the member's votes and...
OPENSUSE-SU-2021:1061-1 Security update for nodejs10
This update for nodejs10 fixes the following issues: Update nodejs10 to 10.24.1. Including fixes for - CVE-2021-22918: libuv upgrade - Out of bounds read bsc1187973 - CVE-2021-27290: ssri Regular Expression Denial of Service bsc1187976 - CVE-2021-23362: hosted-git-info Regular Expression Denial o...
SUSE-SU-2021:2353-1 Security update for nodejs10
This update for nodejs10 fixes the following issues: Update nodejs10 to 10.24.1. Including fixes for - CVE-2021-22918: libuv upgrade - Out of bounds read bsc1187973 - CVE-2021-27290: ssri Regular Expression Denial of Service bsc1187976 - CVE-2021-23362: hosted-git-info Regular Expression Denial o...
OPENSUSE-SU-2021:2353-1 Security update for nodejs10
This update for nodejs10 fixes the following issues: Update nodejs10 to 10.24.1. Including fixes for - CVE-2021-22918: libuv upgrade - Out of bounds read bsc1187973 - CVE-2021-27290: ssri Regular Expression Denial of Service bsc1187976 - CVE-2021-23362: hosted-git-info Regular Expression Denial o...
Logic Flaw Vulnerability in Flash Flood Monitoring and Early Warning System of Siltronic Ltd.
Siltronic is committed to the cause of disaster reduction and profitability, providing the government with comprehensive solutions for disaster reduction and profitability informatization; providing enterprises with information and application services for disaster reduction and profitability; an...
How purple teams can embrace hacker culture to improve security
The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Matthew Hickey, co-founder, CEO, and writ...
F5 Networks BIG-IP : glibc vulnerability (K38481791)
The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.3 / 15.1.4 / 16.0.1.2 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K38481791 advisory. The GNU C Library aka glibc or libc6 before 2.32 could overflow an on-stack buffer during range...
Creating coefficiency: DevOps, Security, and Compliance
Secure IaC Infrastructure-as-code IaC is a powerful partnership accelerator. As businesses and organizations scale into the cloud to realize its full production-enablement potential, security often struggles to keep up. The ultimate goal on the security horizon is, of course, to prevent risks and...
[SECURITY] Fedora 34 Update: python-fastapi-0.65.1-2.fc34
FastAPI is a modern, fast high-performance, web framework for building AP Is with Python 3.6+ based on standard Python type hints. The key features are: =EF=BF=BD=EF=BF=BD=EF=BF=BD Fast: Very high performance, on par with Node JS and Go thanks to Starlette and Pydantic. One of the fastest Python...
Top Challenges for Security Analytics and Operations, and How a Cloud-Based SIEM Can Help
As the attack surface continues to grow, the job of a security professional is getting exponentially more complicated. With the surge in remote work over the last year, this has only accelerated. To keep up and combat key security operations challenges, many organizations are making the move to t...
iOS / iPadOS 14.5 Updates: Identify Assets Requiring Update and Take Remote Action with VMDR for Mobile Devices
Apple recently released iOS 14.5 and iPadOS 14.5 which include a security update that addresses almost 50 vulnerabilities including several critical RCE and privilege escalation vulnerabilities. Qualys recommends security teams to immediately update all devices running iOS and iPadOS to the lates...
Bypass or reduction on the lockup period.
Handle shw Vulnerability details Impact In Pool.sol, the lockup restriction of withdrawal can be bypassed or reduced if new liquidity providers cooperate with existing ones. Proof of Concept 1. A liquidity provider Alice deposits liquidity assets into the pool and gained some FDTs. She then waits...
