Ecosystem
PyPI
7,110 known vulnerabilities.
Most affected packages
7,091 results · Feed
-
Medium 5.9
Segfault in `QuantizedBiasAdd` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have pat…
-
Medium 5.9
Segfault in `QuantizedMatMul` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHu…
-
Medium 5.9
`CHECK` fail in `FakeQuantWithMinMaxVars` in TensorFlow
TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVars` is given `min` or `max` tensors of a nonzero rank, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHu…
-
Medium 5.9
`CHECK` fail in `Conv2DBackpropInput` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of `Conv2DBackpropInput` requires `input_sizes` to be 4-dimensional. Otherwise, it gives a `CHECK` failure which can be used to trigger a denial of service attack. We have patched …
-
Medium 5.9
Segfault in `QuantizedInstanceNorm` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub …
-
Medium 5.9
`CHECK` fail in `AvgPoolGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does not fully validate the input `orig_input_shape`. This results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched th…
-
Medium 5.9
Segfault in `QuantizedAvgPool` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedAvgPool` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitH…
-
Medium 5.9
Segfault in `QuantizedAdd` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizedAdd` is given `min_input` or `max_input` tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub c…
-
Medium 5.9
Segfault in `BlockLSTMGradV2` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` does not fully validate its inputs. This results in a a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub co…
-
Medium 5.9
Segfault in `LowerBound` and `UpperBound` in TensorFlow
TensorFlow is an open source platform for machine learning. If `LowerBound` or `UpperBound` is given an empty`sorted_inputs` input, it results in a `nullptr` dereference, leading to a segfault that can be used to trigger a denial of service attack. We have pa…
-
Medium 5.9
`CHECK` failures in `FractionalAvgPoolGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of `FractionalAvgPoolGrad` does not fully validate the input `orig_input_tensor_shape`. This results in an overflow that results in a `CHECK` failure which can be used to trigger a…
-
Medium 5.9
`CHECK` failure in `TensorListReserve` in TensorFlow
TensorFlow is an open source platform for machine learning. In `core/kernels/list_kernels.cc's TensorListReserve`, `num_elements` is assumed to be a tensor of size 1. When a `num_elements` of more than 1 element is provided, then `tf.raw_ops.TensorListReserve…
-
Medium 5.9
`CHECK` failures in `AvgPool3DGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of `AvgPool3DGradOp` does not fully validate the input `orig_input_shape`. This results in an overflow that results in a `CHECK` failure which can be used to trigger a denial of se…
-
Medium 5.9
`CHECK` failures in `UnbatchGradOp` in TensorFlow
TensorFlow is an open source platform for machine learning. The `UnbatchGradOp` function takes an argument `id` that is assumed to be a scalar. A nonscalar `id` can trigger a `CHECK` failure and crash the program. It also requires its argument `batch_index` t…
-
Medium 5.9
Int overflow in `RaggedRangeOp` in Tensoflow
TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used to construct a `TensorShape` as an `int64`. If `limits` is a very large float, it can overflow when converted to an `int…
-
Medium 5.9
`CHECK` failure in `AvgPoolOp` in Tensorflow
TensorFlow is an open source platform for machine learning. The `AvgPoolOp` function takes an argument `ksize` that must be positive but is not checked. A negative `ksize` can trigger a `CHECK` failure and crash the program. We have patched the issue in GitHu…
-
High 7.0
OOB read in `Gather_nd` op in TensorFlow Lite
TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is trig…
-
High 7.0
Out of bounds write in `scatter_nd` op in TensorFlow Lite
TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the …
-
Medium 5.9
`CHECK` failure in `SobolSample` via missing validation in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by assuming `input(0)`, `input(1)`, and `input(2)` to be scalar. This issue has b…
-
Medium 5.9
`CHECK` failure in tf.reshape in Tensorflow
TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor. This issue has b…
-
High 8.8
Cross-Site Request Forgery (CSRF) in ikus060/rdiffweb
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3.
-
Low —
Python-TUF vulnerable to incorrect threshold signature computation for new root metadata
### Impact The function `_verify_root_self_signed()`, introduced in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0), and which verifies self-signatures in a new root metadata file, counted multiple signatures by any new root key towa…
-
Critical 9.8
VNCAuthProxy authentication bypass vulnerability
OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentication-bypass vulnerability that could allow a malicious actor to gain unauthorized access to a VNC session or to disconnect a legitimate use…
-
Medium 5.5
LIEF contains a segmentation violation
LIEF commit 365a16a was discovered to contain a segmentation violation via the component CoreFile.tcc:69.
-
Medium 5.5
LIEF commit 365a16a was discovered to contain a reachable assertion abort via the component BinaryStream.hpp.
-
High 7.8
LIEF vulnerable to heap based buffer overflow via print_binary function
LIEF commit 365a16a was discovered to contain a heap-buffer overflow via the function print_binary at /c/macho_reader.c.
-
Medium 5.5
LIEF contains segmentation violation
LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::file_offset() at /MachO/SegmentCommand.cpp.
-
Medium 5.5
LIEF vulnerable to heap based buffer overflow
LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc.
-
High 7.1
Weak Password Requirements in ikus060/rdiffweb
Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
-
High 7.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
-
Medium 5.3
Missing Custom Error Page in ikus060/rdiffweb
Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.
-
Critical 9.1
Casdoor arbitrary file write vulnerability
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
-
High 7.5
Hyperledger Indy DOS vulnerability
indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable …
-
Medium 5.7
OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions…
-
Critical 10.0
Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb
Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
-
Medium 5.3
mangadex-downloader vulnerable to unauthorized file reading
mangadex-downloader is a command-line tool to download manga from MangaDex. When using `file:<location>` command and `<location>` is a web URL location (http, https), mangadex-downloader between versions 1.3.0 and 1.7.2 will try to open and read a file in loc…
-
High 7.3
Poetry Argument Injection vulnerability can lead to local Code Execution
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When bui…
-
High 7.3
Poetry's Untrusted Search Path can lead to Local Code Execution on Windows
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the executable’s name and not its absolute path. This can lead to t…
-
High 7.5
MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
-
High 7.5
mako is vulnerable to Regular Expression Denial of Service
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.