Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,128 results · page 55 of 83
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23561 · Other software · tensorflow · reported by GitHubHigh 8.8
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23560 · Other software · tensorflow · reported by GitHubHigh 8.8
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors. The fix is included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. Users are advised to upgrade as soon as possible.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23559 · Other software · tensorflow · reported by GitHubHigh 8.8
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23558 · Other software · tensorflow · reported by GitHubHigh 7.6
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in `TfLiteIntArrayCreate`. The `TfLiteIntArrayGetSizeInBytes` returns an `int` instead of a `size_t. An attacker can control model inputs such that `computed_size` overflows the size of `int` datatype. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23557 · Other software · tensorflow · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in `BiasAndClamp` implementation. There is no check that the `bias_size` is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21741 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is strictly positive. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21740 · Computers, phones & browsers · Google · reported by GitHubHigh 7.6
Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21739 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of `QuantizedMaxPool` has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21738 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21737 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in `CHECK` failures later when the output tensors get allocated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23569 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). This is similar to TFSA-2021-198 and has similar fixes. We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21735 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalMaxPool` can be made to crash a TensorFlow process via a division by 0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21734 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of `MapStage` is vulnerable a `CHECK`-fail if the key tensor is not a scalar. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21729 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a division by zero caused by an integer overflow bug. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21725 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can be made to execute a division by 0. The function fails to check that the stride argument is strictly positive. Hence, the fix is to add a check for the stride argument to ensure it is valid. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23568 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of `AddManySparseToTensorsMap` is vulnerable to an integer overflow which results in a `CHECK`-fail when building new `TensorShape` objects (so, an assert failure based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-23567 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so, assert failures based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21736 · Computers, phones & browsers · Google · reported by GitHubHigh 7.6
Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseTensorSliceDataset` has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value. The 3 input arguments to `SparseTensorSliceDataset` represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21733 · Computers, phones & browsers · Google · reported by GitHubMedium 4.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21732 · Computers, phones & browsers · Google · reported by GitHubMedium 4.3
Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger a denial of service attack by allocating too much memory. This is because the `num_threads` argument is only checked to not be negative, but there is no upper bound on its value. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21731 · Computers, phones & browsers · Google · reported by GitHubMedium 6.5
Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack via a segfault caused by a type confusion. The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then, a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank. However, `WithRankAtLeast` receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented. Due to the fact that `min_rank` is a 32-bits value and the value of `axis`, the `rank` argument is a negative value, so the error check is bypassed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21730 · Computers, phones & browsers · Google · reported by GitHubHigh 8.1
Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalAvgPoolGrad` does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21728 · Computers, phones & browsers · Google · reported by GitHubHigh 8.1
Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate the value of `batch_dim` and can result in a heap OOB read. There is a check to make sure the value of `batch_dim` does not go over the rank of the input, but there is no check for negative values. Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of `Dim` would access elements before the start of an array. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21727 · Computers, phones & browsers · Google · reported by GitHubHigh 7.6
Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `Dequantize` is vulnerable to an integer overflow weakness. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes `axis + 1`, an attacker can trigger an integer overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tensorflow is an Open Source Machine Learning Framework.CVE-2022-21726 · Computers, phones & browsers · Google · reported by GitHubHigh 8.1
Tensorflow is an Open Source Machine Learning Framework. The implementation of `Dequantize` does not fully validate the value of `axis` and can result in heap OOB accesses. The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
- Product
- Tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022Symfony is a PHP framework for web and console applications and a set of reusable PHP components.CVE-2022-23601 · Other software · symfony · reported by GitHubHigh 8.1
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks. This issue has been resolved in the patch versions listed and users are advised to update. There are no known workarounds for this issue.
- Product
- symfony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Flask-AppBuilder is an application development framework, built on top of the Flask web framework.CVE-2022-21659 · Other software · Dpgaspar · reported by GitHubMedium 5.3
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.
- Product
- Flask-appbuilder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022This affects the package juce-framework/JUCE before 6.1.5.CVE-2021-23521 · Other software · Juce · reported by report@snyk.ioMedium 5.5
This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases, this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.
- Product
- Juce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function CVE-2021-23520 · Other software · Juce · reported by report@snyk.ioMedium 5.5
The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.
- Product
- Juce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022Next.js is a React framework.CVE-2022-21721 · Other software · Vercel · reported by GitHubMedium 5.9
Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service attack for anyone using i18n functionality. In order to be affected by this CVE, one must use next start or a custom server and the built-in i18n support. Deployments on Vercel, along with similar environments where invalid requests are filtered before reaching Next.js, are not affected. A patch has been released, `next@12.0.9`, that mitigates this issue. As a workaround, one may ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until it becomes feasible to upgrade.
- Product
- Next.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Gerapy is a distributed crawler management framework.CVE-2021-32849 · Other software · Gerapy · reported by GitHubHigh 8.8
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
- Product
- gerapy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework.CVE-2022-21715 · Other software · codeigniter4 · reported by GitHubMedium 5.4
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.
- Product
- CodeIgniter4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeigniter4.github.iogithub.com
Jan 24, 2022elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files.CVE-2022-21711 · Other software · liyansong2018 · reported by GitHubHigh 7.1
elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special format ELF file, the information of any address can be leaked. elfspirit version 1.1 contains a patch for this issue.
- Product
- elfspirit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework).CVE-2022-21392 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Policy Framework). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Enterprise Manager Base Platform accessible data as well as unauthorized update, insert or delete access to some of Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Product
- Enterprise Manager Base Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).CVE-2022-21387 · Websites & servers · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that are affected are 11.3.0, 11.3.1 and 11.3.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Commerce Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework).CVE-2022-21359 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Optimization Framework). Supported versions that are affected are 8.57, 8.58 and 8.59. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- PeopleSoft Enterprise PT PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: General Framework).CVE-2022-21338 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.6
Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: General Framework). The supported version that is affected is 3.0.2.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Convergence. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Convergence accessible data as well as unauthorized read access to a subset of Oracle Communications Convergence accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
- Product
- Communications Convergence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2022Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language.CVE-2022-21700 · Other software · micronaut-projects · reported by GitHubMedium 5.3
Micronaut is a JVM-based, full stack Java framework designed for building JVM web applications with support for Java, Kotlin and the Groovy language. In affected versions sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. ### Impact Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state. ### Patches The problem is patched in Micronaut 3.2.7 and above. ### Workarounds The default content type binder can be replaced in an existing Micronaut application to mitigate the issue: ```java package example; import java.util.List; import io.micronaut.context.annotation.Replaces; import io.micronaut.core.convert.ConversionService; import io.micronaut.http.MediaType; import io.micronaut.http.bind.DefaultRequestBinderRegistry; import io.micronaut.http.bind.binders.RequestArgumentBinder; import jakarta.inject.Singleton; @Singleton @Replaces(DefaultRequestBinderRegistry.class) class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry { public FixedRequestBinderRegistry(ConversionService conversionServi
- Product
- micronaut-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.CVE-2021-32650 · Other software · octobercms · reported by GitHubHigh 8.8
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework.CVE-2021-32649 · Other software · octobercms · reported by GitHubHigh 8.8
October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. The issue has been patched in Build 473 (v1.0.473) and v1.1.6. Those unable to upgrade may apply the patch to their installation manually as a workaround.
- Product
- october
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022Flatpak is a Linux application sandboxing and distribution framework.CVE-2022-21682 · Other software · flatpak · reported by GitHubHigh 7.7
Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.
- Product
- flatpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022Flatpak is a Linux application sandboxing and distribution framework.CVE-2021-43860 · Other software · flatpak · reported by GitHubHigh 8.2
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there's a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the *actual* metadata, from the "metadata" file to ensure it wasn't lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Use
- Product
- flatpak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2022.NET Framework Denial of Service VulnerabilityCVE-2022-21911 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET Framework Denial of Service Vulnerability
- Product
- Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Windows User-mode Driver Framework Reflector Driver Elevation of Privilege VulnerabilityCVE-2022-21834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 10, 2022In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the iCVE-2021-22060 · Other software · VMware · reported by security@vmware.comMedium 4.3
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Product
- Spring Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtanzu.vmware.comoracle.com
Jan 4, 2022CodeIgniter is an open source PHP full-stack web framework.CVE-2022-21647 · Other software · codeigniter4 · reported by GitHubHigh 7.7
CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.
- Product
- CodeIgniter4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2021Gerapy is a distributed crawler management framework.CVE-2021-43857 · Other software · Gerapy · reported by GitHubCritical 9.8
Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.
- Product
- Gerapy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 27, 2021In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and aCVE-2021-45232 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.
- Product
- Apache APISIX Dashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Dec 22, 2021Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET.CVE-2021-43853 · Other software · michaelschwarz · reported by GitHubHigh 8.7
Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.
- Product
- Ajax.NET-Professional
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2021OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.CVE-2020-19316 · Other software · Laravel · reported by MITREHigh 8.8
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
- Product
- Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetbytesec.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.