Division by 0 in `QuantizedMul`

Impact An attacker can trigger a division by 0 in tf.rawops.QuantizedMul: python import tensorflow as tf x = tf.zeros4, 1, dtype=tf.quint8 y = tf.constant, dtype=tf.quint8 minx = tf.constant0.0 maxx = tf.constant0.0010000000474974513 miny = tf.constant0.0 maxy = tf.constant0.0010000000474974513...

Division by 0 in `QuantizedConv2D`

Impact An attacker can trigger a division by 0 in tf.rawops.QuantizedConv2D: python import tensorflow as tf input = tf.zeros1, 1, 1, 1, dtype=tf.quint8 filter = tf.constant, shape=1, 0, 1, 1, dtype=tf.quint8 mininput = tf.constant0.0 maxinput = tf.constant0.0001 minfilter = tf.constant0.0 maxfilt...

Division by 0 in `Conv2D`

Impact An attacker can trigger a division by 0 in tf.rawops.Conv2D: python import tensorflow as tf input = tf.constant, shape=0, 0, 0, 0, dtype=tf.float32 filter = tf.constant, shape=0, 0, 0, 0, dtype=tf.float32 strides = 1, 1, 1, 1 padding = "SAME" tf.rawops.Conv2Dinput=input, filter=filter,...

Division by 0 in `Conv2DBackpropInput`

Impact An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropInput: python import tensorflow as tf inputtensor = tf.constant52, 1, 1, 5, shape=4, dtype=tf.int32 filtertensor = tf.constant, shape=0, 1, 5, 0, dtype=tf.float32 outbackprop = tf.constant, shape=52, 1, 1, 0, dtype=tf.float...

Division by 0 in `Conv2DBackpropFilter`

Impact An attacker can trigger a division by 0 in tf.rawops.Conv2DBackpropFilter: python import tensorflow as tf inputtensor = tf.constant, shape=0, 0, 1, 0, dtype=tf.float32 filtersizes = tf.constant1, 1, 1, 1, shape=4, dtype=tf.int32 outbackprop = tf.constant, shape=0, 0, 1, 1, dtype=tf.float32...

Division by 0 in `Conv3DBackprop*`

Impact The tf.rawops.Conv3DBackprop operations fail to validate that the input tensors are not empty. In turn, this would result in a division by 0: python import tensorflow as tf inputsizes = tf.constant0, 0, 0, 0, 0, shape=5, dtype=tf.int32 filtertensor = tf.constant, shape=0, 0, 0, 1, 0,...

Heap buffer overflow in `Conv3DBackprop*`

Impact Missing validation between arguments to tf.rawops.Conv3DBackprop operations can result in heap buffer overflows: python import tensorflow as tf inputsizes = tf.constant1, 1, 1, 1, 2, shape=5, dtype=tf.int32 filtertensor = tf.constant734.6274508233133, -10.0, -10.0, -10.0, -10.0, -10.0,...

CHECK-fail in SparseCross due to type confusion

Impact The API of tf.rawops.SparseCross allows combinations which would result in a CHECK-failure and denial of service: python import tensorflow as tf hashedoutput = False numbuckets = 1949315406 hashkey = 1869835877 outtype = tf.string internaltype = tf.string indices1 = tf.constant0, 6, shape=...

Division by zero in `Conv3D`

Impact A malicious user could trigger a division by 0 in Conv3D implementation: python import tensorflow as tf inputtensor = tf.constant, shape=0, 0, 0, 0, 0, dtype=tf.float32 filtertensor = tf.constant, shape=0, 0, 0, 0, 0, dtype=tf.float32 tf.rawops.Conv3Dinput=inputtensor, filter=filtertensor,...

Null pointer dereference via invalid Ragged Tensors

Impact Calling tf.rawops.RaggedTensorToVariant with arguments specifying an invalid ragged tensor results in a null pointer dereference: python import tensorflow as tf inputtensor = tf.constant, shape=0, 0, 0, 0, 0, dtype=tf.float32 filtertensor = tf.constant, shape=0, 0, 0, 0, 0, dtype=tf.float3...

Heap out of bounds write in `RaggedBinCount`

Impact If the splits argument of RaggedBincount does not specify a valid SparseTensor, then an attacker can trigger a heap buffer overflow: python import tensorflow as tf tf.rawops.RaggedBincountsplits=7,8, values= 5, 16, 51, 76, 29, 27, 54, 95,\ size= 59, weights= 0, 0, 0, 0, 0, 0, 0, 0,...

Heap buffer overflow in `RaggedBinCount`

Impact If the splits argument of RaggedBincount does not specify a valid SparseTensor, then an attacker can trigger a heap buffer overflow: python import tensorflow as tf tf.rawops.RaggedBincountsplits=0, values=1,1,1,1,1, size=5, weights=1,2,3,4, binaryoutput=False This will cause a read from...

Case Study: Incident Response is a relationship-driven business

Proof that incident response is "the ultimate team sport" By Brad Garnett. Introduction As a seasoned incident responder, and now IR business leader here at Cisco Talos Incident Response CTIR, I have always said that incident response is the ultimate team sport. People are... This is only the...

WordPress CM Registration Pro premium plugin <= 3.2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by WPScan Team in WordPress CM Registration Pro premium plugin versions = 3.2.0. Solution Update the WordPress CM Registration Pro premium plugin to the latest available version at least 3.2.1...

PT-2021-18313 · Google · Tensorflow

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4 Description: An attacker can cause a denial of service by exploiting a CHECK-failure coming from the...

Atlassian Confluence < 7.11.0 SSRF (CONFSERVER-61453)

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.11.0 . It is, therefore, affected by a server-side request forgery SSRF vulnerability in its Team Calendar REST API component. An authenticated, remote attacker can exploit...

Atlassian Confluence Server Server-Side Request Forgery Vulnerability

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. A server-side request forgery vulnerability exists in Confluence Server versions prior to 7.11.0,...

Zulip server access control error vulnerability

Zulip server is an open source team chat application from the American company Zulip. An access control error vulnerability exists in versions of Zulip Server prior to 3.4, which stems from a bug in the implementation of replies to messages that send a webhook to a private stream.No details of th...

CVE-2020-29444

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters...

CVE-2020-29445

Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and ports via a blind server-side request forgery vulnerability in Team Calendars parameters...