Secret Exfiltration

github.com/metal3-io/baremetal-operator is vulnerable to Secret Exfiltration. The vulnerability is due to BMO's ability to read Secrets from any namespace, which allows an attacker to exfiltrate Secrets from other namespaces by linking them to a BareMetalHost configuration...

Information Exposure Through Log Files

github.com/hashicorp/vault is vulnerable to Information Exposure Through Log Files. The vulnerability is due to a regression that removed the HMAC functionality for sensitive headers in the audit device, leading to the storage of plaintext client tokens and token accessors in the audit log...

Cross Site Request Forgery (CSRF)

spina is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is caused due to a defect in the file admin/mediafolders which allows attacker to launch attack remotely...

Remote Code Execution

mlflow is vulnerable to Remote Code Execution. The vulnerability is caused due to a defect where mflow allows to write/overwrite any file on the file system. A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...

Division By Zero Error

TensorFlow is vulnerable to a Division By Zero Error. The vulnerability is due to the EmbeddingLookup TFLite operator not checking if the first dimension of the value input is zero before performing a division operation. It allows an attacker to craft a model that triggers the error, potentially...

Null Pointer Error

TensorFlow is vulnerable to Null Pointer Error . The vulnerability is due to improper handling of null pointers returned by the GetVariableInput function and the GetMutableInput function, which are not correctly checked before being used in the TFLite implementation of SVDF, allows an attacker to...

Division By Zero Error

TensorFlow is vulnerable to a Division By Zero Error. The vulnerability is due to a division by zero error in the TFLite implementation of hashtable lookup when the values tensor's first dimension is 0, allowing an attacker to craft a model that, when processed, triggers the division by zero erro...

Brute Force Protection Bypass

Keycloak is vulnerable to Brute Force Protection Bypass. The vulnerability is due to a timing loophole that allows attackers to initiate multiple login requests simultaneously, exceeding the configured limits for failed attempts before being locked out...

Improper Hostname Verification

io.kroxylicious, kroxylicious-runtime is vulnerable to Improper Hostname Verification. The vulnerability is due to Kroxylicious failing to properly verify the server's hostname during a TLS connection, which allows an attacker to intercept or manipulate communications...

Directory Traversal

github.com/opencontainers/runc is vulnerable to Directory Traversal. The vulnerability is due to the race condition with os.MkdirAll in runc when sharing a volume between two containers, allowing an attacker to create empty files or directories in arbitrary locations on the host file system...

Template Injection

@blakeembrey/template is vulnerable to Template Injection. The vulnerability is due to insufficient validation of the template name within the file index.ts, allowing untrusted input to be used as the template display name...

Integer Overflow

tensorflow, tensorflowcpu and tensorflowgpu are vulnerable to Integer Overflow. The vulnerability is caused due to a missing validation where TFLite implementation of concatenation is vulnerable to an integer overflow issue. An attacker can craft a model such that the dimensions of one of the...

Divide By Zero

tensorflow, tensorflowcpu and tensorflowgpu are vulnerable to Divide By Zero. The vulnerability is caused due to a missing validation where the implementation of fully connected layers in TFLite is vulnerable to a division by zero error. An attacker can craft a model such that filter-dims-data1 i...

Division By Zero Error

TensorFlow is vulnerable to Division By Zero Error. The vulnerability is due to the SVDF TFLite operator does not properly handle cases where params-rank is set to 0, allowing an attacker to craft a model that triggers a division by zero error...

Uncontrolled Recursion

TensorFlow is vulnerable to an Uncontrolled Recursion vulnerability. The vulnerability is due to the failure to check for loops between nodes in TFLite graphs, allowing an attacker to craft models that could cause infinite loops or stack overflow during evaluation...

Null Pointer Dereference

TensorFlow is vulnerable to a null pointer dereference. The vulnerability exists due to unconditionally dereferencing a pointer in the TFLite model, allowing an attacker to craft a TFLite model that triggers this dereference. It leads to crash the system and cause a denial of service...

Out-of-bounds Read

TensorFlow is vulnerable to an Out-of-bounds Read. The vulnerability is due to improper validation of the axisvalue in the TFLite implementation of SplitV, which can lead to accessing data outside the bounds of the tensor shape array...

Divide By Zero

tensorflow is vulnerable to Divide By Zero. The vulnerability is caused due to a defect in the implementation of BatchToSpaceNd where TFLite operator is vulnerable to a division by zero error. An attacker can craft a model such that one dimension of the block input is 0 resulting in the...

Division By Zero Error

TensorFlow is vulnerable to a division by zero error. The vulnerability is due to insufficient handling of cases where the input's fourth dimension is zero in the DepthwiseConv TFLite operator, which can allows to execution issues or crashes in machine learning models...

Out-of-bounds Write

tensorflow, tensorflowcpu and tensorflowgpu are vulnerable to Out-of-bounds Write. The vulnerability is caused due to a missing validation. A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of ArgMin/ArgMax'...

Regular Expression Denial Of Service (ReDoS)

urlregex is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability is due to inefficient handling of regular expressions in the index.js file of the Backtracking component in nescalante urlregex, allowing an attacker to induce performance degradation or resource exhaustion...

Token Leakage

Tina CMS is vulnerable to search Token leakage. The vulnerability is due to the search token being leaked through the lock file tina-lock.json, allows an attacker to gain unauthorized access to the search functionality by exploiting the leaked search token...

Path Traversal

github.com/spectolabs/hoverfly is vulnerable to Path Traversal. The vulnerability is due to insufficient path sanitization in the /api/v2/simulation POST handler, allowing an attacker to escape the intended base directory and access arbitrary files on the server by manipulating file paths using ....

Path Traversal

actions/artifact is vulnerable to Path Traversal. The vulnerability is due to improper validation of filenames in specifically crafted artifacts, allowing path traversal when using downloadArtifactInternal, downloadArtifactPublic, or streamExtractExternal...

Cross Site Scripting(XSS)

concrete5/concrete5 is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to inadequate input validation and sanitization in Board instances of Concrete CMS, which allows rogue administrators to inject and store malicious code...

Denial Of Service (DOS)

TensorFlow is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of the block input in the SpaceToBatchNd TFLite operator, which allows an attacker to set a dimension of the block input to 0, causing a division by zero error, which can crash the system or make it...

Man-in-the-middle(MitM) Attack

Gentoo Portage is vulnerable to a Man-in-the-Middle MitM attack. The vulnerability exists due to the failure of emerge-webrsync to perform PGP signature verification on downloaded .gpgsig files, allowing an attacker to inject malicious code during the file download process...

Integer Overflow

TensorFlow is vulnerable to an Integer Overflow. The vulnerability is due to an integer overflow in the TFLite code for allocating TFLiteIntArrays, allowing attackers to craft models that cause memory corruption by dereferencing invalid pointers...

Denial Of Service (DOS)

libexpat.so is vulnerable to Denial Of Service DOS. The vulnerability is caused due to a defect within xmlparse.c that does not eject a negative length for XMLParseBuffer...

NULL Pointer Dereference

libvirt is vulnerable to a NULL Pointer Dereference. The vulnerability is due to a corner case in the code fetching the list of interfaces where allocating 0 bytes of memory results in a NULL pointer, leading to a crash of the virtinterfaced daemon...

Double Free

libpcap is vulnerable to a Double Free. The vulnerability is due to the sockinitaddress function not clearly indicating whether freeaddrinfo still needs to be called by the caller function, leading to the possibility of both the function and its caller freeing the same memory block...

Timing Attack

Adyen is vulnerable to a Timing Attack. The vulnerability is due to improper constant-time comparison of HMACs in the isvalidhmac and isvalidhmacnotification methods, allowing an attacker to infer the correct HMAC by measuring timing differences...

Integer Overflow

libexpat.so is vulnerable to Integer Overflow. The vulnerability is caused due to a defect in function nextScaffoldPart within xmlparse.c. This can lead to an integer overflow for mgroupSize on 32-bit platforms where UINTMAX equals SIZEMAX...

XML External Entity (XXE)

GeoNode is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML input in the style upload functionality of GeoServer, allowing an attacker to read arbitrary files on the server...

Integer Overflow

libexpat.so is vulnerable to Integer Overflow. The vulnerability is caused due to a defect in function dtdCopy within xmlparse.c. This can lead to integer overflow for nDefaultAtts on 32-bit platforms whereUINTMAX equals SIZEMAX...

NULL Pointer Dereference

libpcap is vulnerable to a NULL pointer dereference. The vulnerability is due to the pcapfindalldevsex function not checking the return value of opendir and passing a NULL value to readdir when an invalid filesystem path is provided...

Unrestricted File Upload

FeehiCMS is vulnerable to unrestricted file upload. The vulnerability is due to lack of proper validation and restrictions on file uploads in the BannerForm argument of the createBanner function, which allows attackers to perform unrestricted file uploads...

Unrestricted File Upload

FeehiCMS is vulnerable to unrestricted file upload. The vulnerability is due to lack of proper restrictions on file uploads in the User argument within the insert function of FeehiCMS, which allows an attacker to upload malicious files remotely, potentially leading to unauthorized code execution ...

Unrestricted File Upload

FeehiCMS is vulnerable to unrestricted file upload. The vulnerability is due to insufficient input validation in the FriendlyLink argument, which allows attackers to upload files without proper restrictions in the update function of FeehiCMS...

Unauthorized Ledger Alterations

indynode is vulnerable to Unauthorized Ledger Alterations. The vulnerability is due to lack of signature verification and the ability to update a DID with a nym transaction without checking changes to ROLE or VERKEY, allows unauthorized alterations to the ledger, such as spamming it with...

Cross Site Scripting(XSS)

Svelte is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper HTML escaping during server-side rendering, allowing an attacker to inject malicious content and execute unauthorized scripts in the victim's browser...

IP Address Spoofing

serilog.enrichers.clientinfo is vulnerable to IP Spoofing. The vulnerability is caused due to a failure to validate IP address specified in X-Forwarded-For or Client-Ip headers. This allows attackers to falsify their IP addresses by specifying an arbitrary IP as a value of X-Forwarded-For or...

Cross-site Scripting (XSS)

Typo3 is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper parsing of values assigned to HTML attributes in the frontend's typolink functionality and improper encoding of error messages in the backend's filelist module when renaming files...

Improper Input Validation

Ingress-nginx is vulnerable to Improper Input Validation. The vulnerability is due to improper annotation validation, allowing an actor with permission to create Ingress objects to inject arbitrary commands and obtain the credentials of the ingress-nginx controller...

Improper Authorization

getkirby/cms is vulnerable to Improper Authorization. The vulnerability is due to the insufficient permission checks in the language settings. An attacker with Panel access can manipulate language definitions by exploiting these missing checks...

Denial Of Service (DOS)

TensorFlow is vulnerable to a denial of service. The vulnerability is due to the improper handling of the dimensionality of the output tensor in TensorFlow Lite's segment sum implementation,where the code uses the last element of the tensor holding segment IDs to determine the output tensor's siz...

Directory Traversal

github.com/ollama/ollama is vulnerable to Directory Traversal. The vulnerability is due to inadequate handling of ZIP file paths during extraction. The extractFromZipFile function in model.go does not properly enforce directory boundaries, allowing ZIP members to be extracted to locations outside...

SQL Injection

centreon/centreon is vulnerable to SQL Injection. The vulnerability is caused due to a missing validation while constructing SQL queries...

Carriage Return Line Feed (CRLF) Injection

RestSharp is vulnerable to Carriage Return Line Feed CRLF Injection. The vulnerability is due to the lack of CRLF character validation in HTTP header values by the HttpHeaders.TryAddWithoutValidation method, which allows an attacker to inject additional HTTP headers or smuggle entire HTTP request...

Prototype Pollution

chartist is vulnerable to Prototype Pollution. The vulnerability is due to lack of validation in the extend function to prevent arguments from modifying the object prototype in Chartist, allows an attacker to inject malicious object properties using the proto property, which recursively affects a...