On the Consistency of GNN Explanations for Malware Detection

Control Flow Graphs CFGs are critical for analyzing program execution and characterizing malware behavior. With the growing adoption of Graph Neural Networks GNNs, CFG-based representations have proven highly effective for malware detection. This study proposes a novel framework that dynamically...

Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

Impact Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1 are also impacted through their use of @apollo/query-planner. If @apollo/query-planner is asked to plan a sufficiently complex query, it may loop infinitely and never complete. This results in unbounded...

GHSA-FMJ9-77Q8-G6C4 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries

Impact Instances of @apollo/query-planner =2.0.0 and =2.0.0 and 2.8.5 and Apollo Router 1.52.1 are also impacted through their use of @apollo/query-planner. If @apollo/query-planner is asked to plan a sufficiently complex query, it may loop infinitely and never complete. This results in unbounded...

CVE-2023-40085

In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-40577 · Boost · Boost

Name of the Vulnerable Software and Affected Versions: boost affected versions not specified Description: The issue is related to a stack-overflow crash. Technical details about the crash include the involvement of specific function names such as parse subgraph, parse endpoint rest, and parse stm...

Out-of-bounds

In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Malicious Package

Overview tokenlon-v5-subgraph is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

MAL-2023-894 Malicious code in tokenlon-v5-subgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dceb07244c9168376047cfb891dbdf3048a9003f143fe5e73fad62a14471057e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Kam1n0 - Assembly Analysis Platform

Kam1n0 v2.x is a scalable assembly management and analysis platform. It allows a user to first index a large collection of binaries into different repositories and provide different analytic services such as clone search and classification. It supports multi-tenancy access and management of...

Malicious code in ib-subgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dec631660263dd92dbbc3c1a243f486c68590ba0ec86a9e78681bcb4c17526d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1834 Malicious code in cartesi-subgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4958d20fd8097a70078688efd874edcbc3c5500774bf3affd521a2a634b7d9fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cartesi-subgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4958d20fd8097a70078688efd874edcbc3c5500774bf3affd521a2a634b7d9fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5206 Malicious code in pancakeswap-v2-subgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0e92926b45b2dbde728955b8808c67bb42af6d599ed815dcbc7d2dfa9b0d538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pancakeswap-v2-subgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0e92926b45b2dbde728955b8808c67bb42af6d599ed815dcbc7d2dfa9b0d538 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3745 Malicious code in ib-subgraph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dec631660263dd92dbbc3c1a243f486c68590ba0ec86a9e78681bcb4c17526d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview pancakeswap-v2-subgraph is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview ib-subgraph is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview cartesi-subgraph is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Stack overflow due to looping TFLite subgraph

Impact TFlite graphs must not have loops between nodes. However, this condition was not checked and an attacker could craft models that would result in infinite loop during evaluation. In certain cases, the infinite loop would be replaced by stack overflow due to too many recursive calls. For...

CVE-2021-29591

TensorFlow is an end-to-end open source platform for machine learning. TFlite graphs must not have loops between nodes. However, this condition was not checked and an attacker could craft models that would result in infinite loop during evaluation. In certain cases, the infinite loop would be...