Archive
May 2021
Vulnerabilities first published in this month (UTC), newest first.
138 results · Clear filters · Feed
-
Low —
Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build
### Impact If you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project. ### Patches The problem has been patched in v1.0…
-
Low 3.3
File exposure in pleaser
please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.
-
Low 3.3
Security problem with settings and littlefs
Security problem with settings and littlefs. Zephyr versions >= 1.14.2, >= 2.3.0 contain Incorrect Default Permissions (CWE-276). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5qhg-j6wc-4f6q
-
Low 2.5
Incorrect Error Handling in Bluetooth HCI core
Incorrect Error Handling in Bluetooth HCI core. Zephyr versions >= v1.14.2, >= v2.2.0 contain NULL Pointer Dereference (CWE-476). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-gc66-xfrc-24qr
-
Low 3.8
Missing Size Checks in Bluetooth HCI over SPI
Missing Size Checks in Bluetooth HCI over SPI. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Length Parameter Inconsistency (CWE-130). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hg2w-62…
-
Low —
accounts: Hash account number using Salt
@alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack. **What did you expect to see?** I expected salt (some random number from configuration) to be used in [hash.AccountNumber…
-
Low 3.1
IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information by injecting parameters …
-
Low —
A failed upgrade may lead to hung goroutines
### Impact Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade. The Go runtime has annoying behaviour around setting and clearing O_NONBLOCK: exec.Cmd.Start() ends up calling os.File.Fd() for any file in exec.…
-
Low —
Network policy may be bypassed by some ICMP Echo Requests
## Impact Under certain conditions, ICMP Echo Request sent to a Cilium endpoint from an actor may bypass a network policy which _disallows_ access from the actor to the endpoint, but _allows_ from the endpoint to the actor. This does _NOT_ apply to UDP and TC…
-
Low —
Local directory executable lookup in sops (Windows-only)
### Impact Windows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe` This attack is only viable if an attacker is able to place a malicious bina…
-
Low 2.4
CSRF allowing modification of commands, modules, banphrases through hidden iFrames
Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters of the bot should upgrade to `v1.52` or `stable` to install the patch or, as a workaround, can add one modern dependency.
-
Low 3.1
IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failur…
-
Low 3.7
IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses f…
-
Low 3.8
Cross-site Scripting in Wildfly
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
-
Low —
User enumeration in authentication mechanisms
Description ----------- The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing t…
-
Low —
User enumeration in authentication mechanisms
Description ----------- The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. Resolution ---------- We now ensure that a generic message is returned whether t…
-
Low 3.1
Open Redirect Vulnerability
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow re…
-
Low 2.5
Type confusion during tensor casts lead to dereferencing null pointers
TensorFlow is an end-to-end open source platform for machine learning. Calling TF operations with tensors of non-numeric types when the operations expect numeric tensors result in null pointer dereferences. The conversion from Python array to C++ array(https:…
-
Low 2.5
Heap out of bounds write in `RaggedBinCount`
TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap…
-
Low 2.5
Reference binding to null pointer in `MatrixDiag*` ops
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `MatrixDiag*` operations(https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-…
-
Low 2.5
Null pointer dereference via invalid Ragged Tensors
TensorFlow is an end-to-end open source platform for machine learning. Calling `tf.raw_ops.RaggedTensorToVariant` with arguments specifying an invalid ragged tensor results in a null pointer dereference. The implementation of `RaggedTensorToVariant` operation…
-
Low 2.5
Division by zero in `Conv3D`
TensorFlow is an end-to-end open source platform for machine learning. A malicious user could trigger a division by 0 in `Conv3D` implementation. The implementation(https://github.com/tensorflow/tensorflow/blob/42033603003965bffac51ae171b51801565e002d/tensorf…
-
Low 2.5
Session operations in eager mode lead to null pointer dereferences
TensorFlow is an end-to-end open source platform for machine learning. In eager mode (default in TF 2.0 and later), session operations are invalid. However, users could still call the raw ops associated with them and trigger a null pointer dereference. The im…
-
Low 2.5
CHECK-fail in SparseCross due to type confusion
TensorFlow is an end-to-end open source platform for machine learning. The API of `tf.raw_ops.SparseCross` allows combinations which would result in a `CHECK`-failure and denial of service. This is because the implementation(https://github.com/tensorflow/tens…
-
Low 2.5
Heap buffer overflow in `Conv3DBackprop*`
TensorFlow is an end-to-end open source platform for machine learning. Missing validation between arguments to `tf.raw_ops.Conv3DBackprop*` operations can result in heap buffer overflows. This is because the implementation(https://github.com/tensorflow/tensor…
-
Low 2.5
Segfault in SparseCountSparseOutput
TensorFlow is an end-to-end open source platform for machine learning. Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a segmentation fault being thrown out from the standard library as `std::vector` invariants are broken.…
-
Low 2.5
Division by 0 in `Conv3DBackprop*`
TensorFlow is an end-to-end open source platform for machine learning. The `tf.raw_ops.Conv3DBackprop*` operations fail to validate that the input tensors are not empty. In turn, this would result in a division by 0. This is because the implementation(https:/…
-
Low 2.5
CHECK-fail in AddManySparseToTensorsMap
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.AddManySparseToTensorsMap`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/6…
-
Low 2.5
Division by 0 in `Conv2DBackpropFilter`
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropFilter`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/496c2630e51c1a478f095b084329a…
-
Low 2.5
Division by zero in padding computation in TFLite
TensorFlow is an end-to-end open source platform for machine learning. The TFLite computation for size of output after padding, `ComputeOutSize`(https://github.com/tensorflow/tensorflow/blob/0c9692ae7b1671c983569e5d3de5565843d500cf/tensorflow/lite/kernels/pad…
-
Low 2.5
Division by zero in optimized pooling implementations in TFLite
TensorFlow is an end-to-end open source platform for machine learning. Optimized pooling implementations in TFLite fail to check that the stride arguments are not 0 before calling `ComputePaddingHeightWidth`(https://github.com/tensorflow/tensorflow/blob/3f24c…
-
Low 2.5
Stack overflow in `ParseAttrValue` with nested tensors
TensorFlow is an end-to-end open source platform for machine learning. The implementation of `ParseAttrValue`(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be…
-
Low 2.5
Null dereference in Grappler's `TrySimplify`
TensorFlow is an end-to-end open source platform for machine learning. The implementation of TrySimplify(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmetic_optimizer.cc#L390-L4…
-
Low 2.5
Crash in `tf.strings.substr` due to `CHECK`-fail
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit …
-
Low 2.5
Crash in `tf.transpose` with complex inputs
TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick…
-
Low 2.5
Segfault in `tf.raw_ops.SparseCountSparseOutput`
TensorFlow is an end-to-end open source platform for machine learning. Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSparseOutput` results in segfault. The fix will be included in TensorFlow 2.5.0. We will also cherrypick …
-
Low 2.5
Division by zero in TFLite's implementation of `SpaceToDepth`
TensorFlow is an end-to-end open source platform for machine learning. The `Prepare` step of the `SpaceToDepth` TFLite operator does not check for 0 before division(https://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorf…
-
Low 2.5
Division by zero in TFLite's implementation of `TransposeConv`
TensorFlow is an end-to-end open source platform for machine learning. The optimized implementation of the `TransposeConv` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179…
-
Low 2.5
Division by zero in TFLite's implementation of `GatherNd`
TensorFlow is an end-to-end open source platform for machine learning. The reference implementation of the `GatherNd` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e…
-
Low 2.5
Heap OOB read in TFLite's implementation of `Minimum` or `Maximum`
TensorFlow is an end-to-end open source platform for machine learning. The implementations of the `Minimum` and `Maximum` TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty…