Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,352 results · page 13 of 28
Jul 3, 2022Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 sCVE-2022-34151 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2022Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controCVE-2022-33971 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2022Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controCVE-2022-33208 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of autCVE-2022-23717 · Other software · Ping Identity · reported by responsible-disclosure@pingidentity.comMedium 5
PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication.
- Product
- PingID Windows Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pingidentity.compingidentity.com
Jun 29, 2022Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute aCVE-2022-34043 · Other software · Nomachine · reported by MITREHigh 7.3
Incorrect permissions for the folder C:\ProgramData\NoMachine\var\uninstall of Nomachine v7.9.2 allows attackers to perform a DLL hijacking attack and execute arbitrary code.
- Product
- Nomachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022Subscription-Manager v1.0 /main.js has a cross-site scripting (XSS) vulnerability in the machineDetail parameter.CVE-2021-41415 · Other software · Subscription-manager Project · reported by MITREMedium 6.1
Subscription-Manager v1.0 /main.js has a cross-site scripting (XSS) vulnerability in the machineDetail parameter.
- Product
- Subscription-manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-29255 · Other software · vyperlang · reported by GitHubHigh 8.2
Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29216 · Other software · tensorflow · reported by GitHubHigh 7.8
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow's `saved_model_cli` tool is vulnerable to a code injection. This can be used to open a reverse shell. This code path was maintained for compatibility reasons as the maintainers had several test cases where numpy expressions were used as arguments. However, given that the tool is always run manually, the impact of this is still not severe. The maintainers have now removed the `safe=False` argument, so all parsing is done without calling `eval`. The patch is available in versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29213 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the `tf.compat.v1.signal.rfft2d` and `tf.compat.v1.signal.rfft3d` lack input validation and under certain condition can result in crashes (due to `CHECK`-failures). Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29212 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling `QuantizeMultiplierSmallerThanOneExp`, the `TFLITE_CHECK_LT` assertion would trigger and abort the process. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29211 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.histogram_fixed_width` is vulnerable to a crash when the values array contain `Not a Number` (`NaN`) elements. The implementation assumes that all floating point operations are defined and then converts a floating point result to an integer index. If `values` contains `NaN` then the result of the division is still `NaN` and the cast to `int32` would result in a crash. This only occurs on the CPU implementation. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29210 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In version 2.8.0, the `TensorKey` hash function used total estimated `AllocatedBytes()`, which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. `int32_t`). It also tried to access individual tensor bytes through `tensor.data()` of size `AllocatedBytes()`. This led to ASAN failures because the `AllocatedBytes()` is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the `.data()` buffer. The discoverers could not use this byte vector anyway because types such as `tstring` include pointers, whereas they needed to hash the string values themselves. This issue is patched in Tensorflow versions 2.9.0 and 2.8.1.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29209 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29208 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.EditDistance` has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service. In multiple places throughout the code, one may compute an index for a write operation. However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for `loc`. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29206 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorDenseAdd` does not fully validate the input arguments. In this case, a reference gets bound to a `nullptr` during kernel execution. This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29205 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of service in TensorFlow by calling `tf.compat.v1.*` ops which don't yet have support for quantized types, which was added after migration to TensorFlow 2.x. In these scenarios, since the kernel is missing, a `nullptr` value is passed to `ParseDimensionValue` for the `py_value` argument. Then, this is dereferenced, resulting in segfault. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29204 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative value would result in a `CHECK`-failure (assertion failure), as per TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29203 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SpaceToBatchND` (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow: The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a `CHECK`-failure (assertion failure), as in TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29202 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29201 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizedConv2D` does not fully validate the input arguments. In this case, references get bound to `nullptr` for each argument that is empty. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29207 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29200 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29199 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `initializing_values` is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29198 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToCSRSparseMatrix` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `dense_shape` is a vector and `indices` is a matrix (as part of requirements for sparse tensors) but there is no validation for this. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29197 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29196 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropFilterV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate that the `filter_sizes` argument is a vector. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29195 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `index` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29193 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29194 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29192 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022TensorFlow is an open source platform for machine learning.CVE-2022-29191 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the hoCVE-2022-20780 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Enterprise NFV Infrastructure Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
May 4, 2022Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the hoCVE-2022-20779 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Enterprise NFV Infrastructure Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
May 4, 2022Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the hoCVE-2022-20777 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.9
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco Enterprise NFV Infrastructure Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtools.cisco.com
Apr 28, 2022NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading.CVE-2021-33436 · Other software · Nomachine · reported by MITREHigh 7.3
NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITY\SYSTEM.
- Product
- Nomachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comknowledgebase.nomachine.com
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24845 · Other software · vyperlang · reported by GitHubHigh 8.8
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions. Users are advised to upgrade. There is no known workaround for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2022Vyper is a pythonic Smart Contract Language for the ethereum virtual machine.CVE-2022-24788 · Other software · vyperlang · reported by GitHubHigh 7.1
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themesCVE-2022-26982 · Other software · Simplemachines · reported by MITREHigh 7.2
SimpleMachinesForum 2.1.1 and earlier allows remote authenticated administrators to execute arbitrary code by inserting a vulnerable php code because the themes can be modified by an administrator. NOTE: the vendor's position is that administrators are intended to have the ability to modify themes, and can thus choose any PHP code that they wish to have executed on the server.
- Product
- Simple Machines Forum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 4, 2022Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine.CVE-2022-24787 · Other software · vyperlang · reported by GitHubHigh 7.5
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the length. A patch is available and expected to be part of the 0.3.2 release. There are currently no known workarounds.
- Product
- vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2022It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without autheCVE-2021-20238 · Other software · Redhat · reported by Red HatLow 3.7
It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint (port 22623) provides ignition configuration used for bootstrapping Nodes and can include some sensitive data, e.g. registry pull secrets. There are two scenarios where this data can be accessed. The first is on Baremetal, OpenStack, Ovirt, Vsphere and KubeVirt deployments which do not have a separate internal API endpoint and allow access from outside the cluster to port 22623 from the standard OpenShift API Virtual IP address. The second is on cloud deployments when using unsupported network plugins, which do not create iptables rules that prevent to port 22623. In this scenario, the ignition config is exposed to all pods within the cluster and cannot be accessed externally.
- Product
- Openshift Container Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 17, 2022Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) alloCVE-2022-26504 · Other software · Veeam · reported by MITREHigh 8.8
Improper authentication in Veeam Backup & Replication 9.5U3, 9.5U4,10.x and 11.x component used for Microsoft System Center Virtual Machine Manager (SCVMM) allows attackers execute arbitrary code via Veeam.Backup.PSManager.exe
- Product
- Veeam Backup & Replication
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2022`gradio` is an open source framework for building interactive machine learning models and demos.CVE-2022-24770 · Other software · gradio-app · reported by GitHubHigh 8.8
`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs.
- Product
- gradio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is rCVE-2022-22795 · Other software · Signiant · reported by cna@cyber.gov.ilMedium 6.8
Signiant - Manager+Agents XML External Entity (XXE) - Extract internal files of the affected machine An attacker can read all the system files, the product is running with root on Linux systems and nt/authority on windows systems, which allows him to access and extract any file on the systems, such as passwd, shadow, hosts and so on. By gaining access to these files, attackers can steal sensitive information from the victims machine.
- Product
- Signiant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 7, 2022Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network.CVE-2022-24738 · Other software · tharsis · reported by GitHubHigh 8.1
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- evmos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryDCVE-2022-25089 · Other software · Kofax · reported by MITRECritical 9.8
Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.
- Product
- Printix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23595 · Other software · tensorflow · reported by GitHubMedium 5.3
Tensorflow is an Open Source Machine Learning Framework. When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference. In the default scenario, all devices are allowed, so `flr->config_proto` is `nullptr`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23594 · Other software · tensorflow · reported by GitHubHigh 8.8
Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect. If an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible. These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23593 · Other software · tensorflow · reported by GitHubMedium 5.9
Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23592 · Other software · tensorflow · reported by GitHubHigh 8.1
Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx` variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23591 · Other software · tensorflow · reported by GitHubHigh 7.5
Tensorflow is an Open Source Machine Learning Framework. The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`. This would result in a stack overflow during execution as resolving each `NodeDef` means resolving the function itself and its nodes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.