Reference binding to nullptr in map operations

Impact An attacker can cause undefined behavior via binding a reference to null pointer in tf.rawops.Map and tf.rawops.OrderedMap operations: python import tensorflow as tf tf.rawops.MapPeek key=tf.constant8,dtype=tf.int64, indices=, dtypes=tf.int32, capacity=8, memorylimit=128 The implementation...

Heap OOB in `SdcaOptimizerV2`

Impact An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to tf.rawops.SdcaOptimizerV2: python import tensorflow as tf tf.rawops.SdcaOptimizerV2 sparseexampleindices=1, sparsefeatureindices=1, sparsefeaturevalues=1.0,2.0,...

`CHECK`-fail in `MapStage`

Impact An attacker can trigger a denial of service via a CHECK-fail in tf.rawops.MapStage: python import tensorflow as tf tf.rawops.MapStage key=tf.constant, shape=0, 0, 0, 0, dtype=tf.int64, indices=tf.constant0, dtype=tf.int32, values=tf.constant0, dtype=tf.int32, dtypes=tf.int32, tf.int64,...

Division by zero in TFLite

Impact The implementation of fully connected layers in TFLite is vulnerable to a division by zero error: cc const int batchsize = inputsize / filter-dims-data1; An attacker can craft a model such that filter-dims-data1 is 0. Patches We have patched the issue in GitHub commit...

NPE in TFLite

Impact The implementation of SVDF in TFLite is vulnerable to a null pointer error: cc TfLiteTensor state = GetVariableInputcontext, node, kStateTensor; // ... GetTensorDatastate The GetVariableInput function can return a null pointer but GetTensorData assumes that the argument is always a valid...

Use of unitialized value in TFLite

Impact All TFLite operations that use quantization can be made to use unitialized values. For example: cc const auto affinequantization = reinterpretcast filter-quantization.params; The issue stems from the fact that quantization.params is only valid if quantization.type is different that...

FPE in TFLite division operations

Impact The implementation of division in TFLite is vulnerable to a division by 0 error There is no check that the divisor tensor does not contain zero elements. Patches We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6....

FPE in TFLite pooling operations

Impact The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. Patches We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypic...

GHSA-MHHC-Q96P-MFM9 Infinite loop in TFLite

Impact The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition: cc for int i = 0; i params-ellipsismask // ... int ellipsisendidx = std::mini + 1 + numaddaxis +...

Infinite loop in TFLite

Impact The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for ellipsis in axis definition: cc for int i = 0; i params-ellipsismask // ... int ellipsisendidx = std::mini + 1 + numaddaxis +...

Shoutcast Server 2.6.0.753 Crash Vulnerability

Shoutcast server version 2.6.0.753 suffers from a remote authenticated crash vulnerability. Shoutcast Server Remote Authenticated Crash ===== Intro ===== Shoutcast Server crashes after failing to handle a non-existent option recieved from a client in an ADMINCGI request. Requires auth to reproduc...

Pocsuite

This project is an open-sourced remote vulnerability testing and proof-of-concept development framework called Pocsuite. It is developed by the Knownsec 404 Team and supports Python 2.6+. The framework comes with a powerful proof-of-concept engine and many niche features for penetration testers a...

All Vulnerabilities for siv.edu.ec Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| siv.edu.ec ---|--- Open Bug Bounty...

All Vulnerabilities for plataforma.umetropolitana.edu.mx Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| plataforma.umetropolitana.edu.mx ---|--...

All Vulnerabilities for eva.iape.edu.mx Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| eva.iape.edu.mx ---|--- Open Bug Bounty...

All Vulnerabilities for edestek5.kocaeli.edu.tr Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| edestek5.kocaeli.edu.tr ---|--- Open Bu...

All Vulnerabilities for campus.unaj.edu.ar Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| campus.unaj.edu.ar ---|--- Open Bug...

All Vulnerabilities for edestek2.kocaeli.edu.tr Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| edestek2.kocaeli.edu.tr ---|--- Open Bu...

All Vulnerabilities for cursos.comenius.edu.mx Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| cursos.comenius.edu.mx ---|--- Open Bug...

REW-sploit - Emulate And Dissect MSF And *Other* Attacks

REW-sploit The tool has been presented at Black-Hat Arsenal USA 2021 https://www.blackhat.com/us-21/arsenal/schedule/index.htmlrew-sploit-dissecting-metasploit-attacks-24086 Slides of presentation are available at https://github.com/REW-sploit/REW-sploitdocs Need help in analyzing Windows shellco...