Archive
9 February 2022
Vulnerabilities first published on this day (UTC), newest first.
276 results · Feed
-
Critical 9.3
NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
### Impact The [code for boosted trees in TensorFlow](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/kernels/boosted_trees/stats_ops.cc) is still missing validation. This allows malicious users to read a…
-
High 7.0
Improper Validation of Integrity Check Value in TensorFlow
### Impact The implementation of [`tf.sparse.split`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_split_op.cc#L26-L102) does not fully validate the input arguments. Hence, a malicious us…
-
Medium 5.5
Integer Overflow or Wraparound in TensorFlow
### Impact The Grappler component of TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) in [constant folding](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/…
-
Medium —
Signatures are mistakenly recognized to be valid in jsrsasign
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
-
Medium —
User object created with invalid provider data in GoTrue
### Impact _What kind of vulnerability is it? Who is impacted?_ Under certain circumstances a valid user object would have been created with invalid provider metadata. This vulnerability affects everyone running an instance of GoTrue as a service. We advise y…
-
High —
Cross Site Request Forgery in concrete5/concrete5
A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
-
Unscored —
An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection insta…
-
Unscored —CVE-2022-0529 Public exploit
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Unscored —
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads…
-
Unscored —
In Bluetooth, there is a possible memory corruption due to a logic error. This could lead to local denial of service wi…
-
High 7.8
SecuwaySSL OS command injection vulnerability
An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.
-
Unscored —
In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privile…
-
Unscored —
In Bluetooth, there is a possible service crash due to a use after free. This could lead to local escalation of privile…
-
Unscored —
In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local e…
-
Unscored —
In Bluetooth, there is a possible information disclosure due to incorrect error handling. This could lead to local info…
-
Unscored —
In Bluetooth, there is a possible escalation of privilege due to a missing permission check. This could lead to local e…
-
Unscored —
In power_hal_manager_service, there is a possible permission bypass due to a stack-based buffer overflow. This could le…
-
Unscored —
In ccu driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of…
-
Unscored —
In ccu driver, there is a possible memory corruption due to an incorrect bounds check. This could lead to local escalat…
-
Unscored —
In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local in…
-
Unscored —
In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local in…
-
Unscored —
In vcu driver, there is a possible information disclosure due to a use after free. This could lead to local escalation …
-
Unscored —
In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could …
-
Unscored —
In camera driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local inf…
-
Unscored —
In ion driver, there is a possible information disclosure due to an incorrect bounds check. This could lead to local in…
-
Unscored —
In vow driver, there is a possible memory corruption due to a race condition. This could lead to local information disc…
-
Unscored —
In fb driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of pri…
-
Unscored —
In cmdq driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local infor…
-
Unscored —
In vow driver, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local e…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Unscored —
In system service, there is a possible permission bypass due to a missing permission check. This could lead to local es…
-
High 8.4
Vulnerability in TP-LinK TL-WR841N wireless router
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to interc…
-
High 8.1
tobesoft nexacro arbitrary file creation vulnerability
improper input validation vulnerability in nexacro permits copying file to the startup folder using rename method.
-
Unscored —
Solution Manager (Diagnostics Root Cause Analysis Tools) - version 720, allows an administrator to execute code on all …
-
Unscored —
Due to improper HTML encoding in input control summary, an authorized attacker can execute XSS vulnerability in SAP Bus…
-
Unscored —
A high privileged user who has access to transaction SM59 can read connection details stored with the destination for h…
-
Unscored —
SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53,…