21465 matches found
CVE-2021-29519
TensorFlow is an end-to-end open source platform for machine learning. The API of tf.rawops.SparseCross allows combinations which would result in a CHECK-failure and denial of service. This is because the...
CVE-2021-29541
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null pointer in tf.rawops.StringNGrams. This is because the...
PT-2021-18292 · Google · Tensorflow
Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4 Description: An attacker can trigger a dereference of a null pointer in tf.raw ops.StringNGrams because the...
FreeBSD : Prosody -- multiple vulnerabilities (fc75570a-b417-11eb-a23d-c7ab331fd711)
The Prosody security advisory 2021-05-12 reports : This advisory details 5 new security vulnerabilities discovered in the Prosody.im XMPP server software. All issues are fixed in the 0.11.9 release default configuration. - CVE-2021-32918: DoS via insufficient memory consumption controls -...
UBUNTU-CVE-2021-32921
An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret strings when running under Lua 5.2 or later. This can potentially be used in a timing attack to reveal the contents of secret strings to an attacker...
PT-2021-7477 · Numpy +4 · Numpy +4
Name of the Vulnerable Software and Affected Versions: NumPy versions prior to 1.22.0 NumPy versions 1.9.x Description: The issue is related to an incomplete string comparison in the numpy.core component, which allows attackers to trigger slightly incorrect copying by constructing specific string...
CVE-2021-32096
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
Emissary 跨站请求伪造漏洞
Emissary is a software application. A P2P-based data-driven workflow engine that operates across heterogeneous and potentially widely distributed multi-tier P2P network computing resources. U.S. National Security Agency NSA Emissary 5.9.0 suffers from a cross-site request forgery vulnerability th...
PT-2021-6514 · Tcl +3 · Tcl +3
Name of the Vulnerable Software and Affected Versions: Tcl version 8.6.11 Description: A format string vulnerability in the nmakehlp.c component of the Tcl programming language may allow code execution via a crafted file. This issue is related to insufficient processing of format strings, which...
GHSA-F98M-Q3HR-P5WQ Prototype Pollution in locutus
All versions of package locutus prior to version 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parsestr function...
DEBIAN-CVE-2019-25043
ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header...
GHSA-HPMR-G4PQ-JHGP Denial of service in chrono-node
This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces...
Denial of service in chrono-node
This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces...
Improper access control
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This in some situations allows attackers to bypass access control that is based on IP addresses...
Denial Of Service (DoS)
Rust is vulnerable to denial of service. The optimization for joining strings can cause uninitialized bytes to be exposed or lead to an application crash...
Mozilla Rust Formatting String Error Vulnerability
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A format string error vulnerability exists in the standard library in versions of Rust prior to 1.52.0, which stems from the fact that if the length of a borrowed string is changed after checking it, it could...
libpano13 -- arbitrary memory access through format string vulnerability
libpano13 developers reports: Fix crash and security issue caused by malformed filename prefix...
Qualcomm 组件输入验证错误漏洞
The Qualcomm Component is a component of Qualcomm Incorporated USA. An intrinsic part that provides the functionality of Qualcomm devices. An input validation error vulnerability exists in the Qualcomm Component that stems from a failure to validate out-of-range in the recorder due to prefix size...
CVE-2021-29486
cumulative-distribution-function is an open source npm library used which calculates statistical cumulative distribution function from data array of x values. In versions prior to 2.0.0 apps using this library on improper data may crash or go into an infinite-loop. In the case of a nodejs...
