paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38673 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38673...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38670 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38670...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38671 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38671...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38673 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38673...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38672 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38672...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38671 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38671...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38670 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38670...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38669 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38669...

paddle-ner (0.1.0), paddle-quantum (>=1.1.1, <=2.2.1) +3 more potentially affected by CVE-2023-38669 via paddlepaddle (1.8.5)

paddlepaddle PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on paddlepaddle and may be impacted: - paddle-ner 0.1.0 - paddle-quantum =1.1.1, =1.8.5.0, =1.8.5.1 - paddle-tokenizer 0.1.0 - pyunit-ner 2021.8.2 Source cves: CVE-2023-38669...

GO-2023-1914 Brute-force of token secrets in github.com/superfly/tokenizer

Brute-force of token secrets in github.com/superfly/tokenizer...

Brute Force Token Secrets

superfly/tokenizer is vulnerable to brute-force of token secrets vulnerability. The vulnerability is due to not restricting formatting in fmt parameter to simple formatting and allowing fmt/dst parameters to be specified at request time leading to attacker brute forcing secret values using...

GHSA-F28G-86HC-823Q Tokenizer vulnerable to client brute-force of token secrets

Impact Authorized clients, having an injectprocessor secret, could brute-force the secret token value by abusing the fmt parameter to the Proxy-Tokenizer header. Patches This was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in...

Tokenizer vulnerable to client brute-force of token secrets

Impact Authorized clients, having an injectprocessor secret, could brute-force the secret token value by abusing the fmt parameter to the Proxy-Tokenizer header. Patches This was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2022-25758 DESCRIPTION: Node.js scss-tokenizer module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS vulnerability in the loadAnnotation function....

python3-libraries:fuzzer-ast: Heap-buffer-overflow in tok_get_normal_mode

Detailed Report: https://oss-fuzz.com/testcase?key=4723623318650880 Project: python3-libraries Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-ast Job Type: libfuzzerasanpython3-libraries Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x62a0000591f4 Crash State:...

SUSE CVE-2023-30402

YASM v1.3.0 was discovered to contain a heap overflow via the function handledotlabel at /nasm/nasm-token.re. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code...

cpython3:fuzz_ast_literal_eval: Heap-buffer-overflow in tok_get_normal_mode

Project: https://github.com/python/cpython.git Detailed Report: https://oss-fuzz.com/testcase?key=5570516294696960 Project: cpython3 Fuzzing Engine: afl Fuzz Target: fuzzastliteraleval Job Type: aflasancpython3 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

SUSE CVE-2009-4214

Cross-site scripting XSS vulnerability in the striptags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and...

SUSE CVE-2017-11626

A stack-consumption vulnerability was found in libqpdf in QPDF 6.0.0, which allows attackers to cause a denial of service via a crafted file, related to the QPDFTokenizer::resolveLiteral function in QPDFTokenizer.cc after four consecutive calls to QPDFObjectHandle::parseInternal, aka an "infinite...

SUSE CVE-2017-12595

The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption and segmentation fault or possibly have unspecified other impact via a PDF document with a deep data structure, as demonstrated by a crash ...