Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4,626 results · page 80 of 93
Dec 1, 2021Discourse is an open source discussion platform.CVE-2021-43793 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021Discourse is an open source discussion platform.CVE-2021-43792 · Other software · discourse · reported by GitHubMedium 4.3
Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visible only to the following groups" feature. A tag group may only allow a certain group (e.g. staff) to view certain tags. Users who were tracking or watching the tags via /preferences/tags, then have their staff status revoked will still see notifications related to the tag, but will not see the tag on each topic. This issue has been patched in stable version 2.7.11. Users are advised to upgrade as soon as possible.
- Product
- discourse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2021Nodebb is an open source Node.js based forum software.CVE-2021-43788 · Other software · NodeBB · reported by GitHubMedium 5
Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Nov 29, 2021Nodebb is an open source Node.js based forum software.CVE-2021-43787 · Other software · NodeBB · reported by GitHubCritical 9
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Nov 29, 2021Nodebb is an open source Node.js based forum software.CVE-2021-43786 · Other software · NodeBB · reported by GitHubCritical 9.8
Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.
- Product
- NodeBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comgithub.com
Nov 26, 2021BaserCMS is an open source content management system with a focus on Japanese language support.CVE-2021-41279 · Other software · baserproject · reported by GitHubHigh 7.7
BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible.
- Product
- basercms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2021OroCRM is an open source Client Relationship Management (CRM) application.CVE-2021-39198 · Other software · oroinc · reported by GitHubMedium 4.2
OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an undCVE-2021-41275 · Other software · spree · reported by GitHubCritical 9.3
spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of spree_auth_devise are affected if protect_from_forgery method is both: Executed whether as: A before_action callback (the default). A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find). Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception). Users are advised to update their spree_auth_devise gem. For users unable to update it may be possible to change your strategy to :exception. Please see the linked GHSA for more workaround details. ### Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forg
- Product
- spree_auth_devise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021CKEditor4 is an open source WYSIWYG HTML editor.CVE-2021-41165 · Other software · ckeditor · reported by GitHubHigh 8.2
CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021CKEditor4 is an open source WYSIWYG HTML editor.CVE-2021-41164 · Other software · ckeditor · reported by GitHubHigh 8.2
CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
- Product
- ckeditor4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Kirby is an open source file structured CMS.CVE-2021-41258 · Other software · getkirby · reported by GitHubHigh 7.3
Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters to protect against cross-site scripting (XSS) attacks. The default snippet for the image block unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source, alt and link fields of the image block, which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. Attackers must be in your group of authenticated Panel users in order to exploit this weakness. Users who do not make use of the blocks field are not affected. This issue has been patched in Kirby version 3.5.8 by escaping special HTML characters in the output from the default image block snippet. Please update to this or a later version to fix the vulnerability.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code.CVE-2021-41252 · Other software · getkirby · reported by GitHubHigh 7.3
Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting (XSS) attacks, otherwise the formatting would be lost. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Because the writer field did not securely sanitize its contents on save, it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. Attackers must be in your group of authenticated Panel users in order to exploit this weakness. Users who do not make use of the writer field are not affected. This issue has been patched in Kirby 3.5.8 by sanitizing all writer field contents on the backend whenever the content is modified via Kirby's API. Please update to this or a later version to fix the vulnerability.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021Pomerium is an open source identity-aware access proxy.CVE-2021-41230 · Other software · pomerium · reported by GitHubMedium 5.3
Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.
- Product
- pomerium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41228 · Other software · tensorflow · reported by GitHubHigh 7.5
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it calls `eval` on user supplied strings. This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs. However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41227 · Other software · tensorflow · reported by GitHubMedium 6.6
TensorFlow is an open source platform for machine learning. In affected versions the `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents. This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41225 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41222 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SplitV` can trigger a segfault is an attacker supplies negative arguments. This occurs whenever `size_splits` contains more than one value and at least one value is negative. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41221 · Other software · tensorflow · reported by GitHubHigh 7.8
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow. This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41220 · Other software · tensorflow · reported by GitHubHigh 7.8
TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41216 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the shape inference function for `Transpose` is vulnerable to a heap buffer overflow. This occurs whenever `perm` contains negative elements. The shape inference function does not validate that the indices in `perm` are all valid. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41213 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock` Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive `tf.function`, although this is not a frequent scenario. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41218 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `AllToAll` can be made to execute a division by 0. This occurs whenever the `split_count` argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41209 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41208 · Other software · tensorflow · reported by GitHubHigh 8.8
TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures) as well as abuse undefined behavior (binding references to `nullptr`s). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call. Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. We will deprecate TensorFlow's boosted trees APIs in subsequent releases. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41207 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `ParallelConcat` misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41206 · Other software · tensorflow · reported by GitHubHigh 7
TensorFlow is an open source platform for machine learning. In affected versions several TensorFlow operations are missing validation for the shapes of the tensor arguments involved in the call. Depending on the API, this can result in undefined behavior and segfault or `CHECK`-fail related crashes but in some scenarios writes and reads from heap populated arrays are also possible. We have discovered these issues internally via tooling while working on improving/testing GPU op determinism. As such, we don't have reproducers and there will be multiple fixes for these issues. These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41202 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41226 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseBinCount` is vulnerable to a heap OOB access. This is because of missing validation between the elements of the `values` argument and the shape of the sparse output. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41224 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `SparseFillEmptyRows` can be made to trigger a heap OOB access. This occurs whenever the size of `indices` does not match the size of `values`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41223 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `FusedBatchNorm` kernels is vulnerable to a heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41219 · Other software · tensorflow · reported by GitHubHigh 7.8
TensorFlow is an open source platform for machine learning. In affected versions the code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to `nullptr`. This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41217 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the process of building the control flow graph for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not. This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node). When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41215 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `DeserializeSparse` can trigger a null pointer dereference. This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension). The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41214 · Other software · tensorflow · reported by GitHubHigh 7.8
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` has an undefined behavior due to binding a reference to `nullptr`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41212 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `tf.ragged.cross` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41211 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds of heap allocated array. This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer. The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41205 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for the `QuantizeAndDequantizeV*` operations can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41204 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41203 · Other software · tensorflow · reported by GitHubHigh 7.8
TensorFlow is an open source platform for machine learning. In affected versions an attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow. This is because the checkpoints loading infrastructure is missing validation for invalid file formats. The fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41210 · Other software · tensorflow · reported by GitHubHigh 7.1
TensorFlow is an open source platform for machine learning. In affected versions the shape inference functions for `SparseCountSparseOutput` can trigger a read outside of bounds of heap allocated array. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41201 · Other software · tensorflow · reported by GitHubHigh 7.8
TensorFlow is an open source platform for machine learning. In affeced versions during execution, `EinsumHelper::ParseEquation()` is supposed to set the flags in `input_has_ellipsis` vector and `*output_has_ellipsis` boolean to indicate whether there is ellipsis in the corresponding inputs and output. However, the code only changes these flags to `true` and never assigns `false`. This results in unitialized variable access if callers assume that `EinsumHelper::ParseEquation()` always sets these flags. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41200 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions if `tf.summary.create_file_writer` is called with non-scalar arguments code crashes due to a `CHECK`-fail. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41199 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions if `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41198 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions if `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow. The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41197 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow allows tensor to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an `int64_t`. If an overflow occurs, `MultiplyWithoutOverflow` would return a negative result. In the majority of TensorFlow codebase this then results in a `CHECK`-failure. Newer constructs exist which return a `Status` instead of crashing the binary. This is similar to CVE-2021-29584. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41196 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative. This is due to the TensorFlow's implementation of pooling operations where the values in the sliding window are not checked to be strictly positive. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2021TensorFlow is an open source platform for machine learning.CVE-2021-41195 · Other software · tensorflow · reported by GitHubMedium 5.5
TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using `AddDim`. However, if the number of elements in the tensor overflows an `int64_t` value, `AddDim` results in a `CHECK` failure which provokes a `std::abort`. Instead, code should use `AddDimWithStatus`. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
- Product
- tensorflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021JupyterHub is an open source multi-user server for Jupyter notebooks.CVE-2021-41247 · Other software · jupyterhub · reported by GitHubLow 3.5
JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.
- Product
- jupyterhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications.CVE-2021-41238 · Other software · HangfireIO · reported by GitHubHigh 8.6
Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate process required. Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. By default when no custom authorization filters specified, `LocalRequestsOnlyAuthorizationFilter` filter is being used to allow only local requests and prohibit all the remote requests to provide sensible, protected by default settings. However due to the recent changes, in version 1.7.25 no authorization filters are used by default, allowing remote requests to succeed. If you are using `UseHangfireDashboard` method with default `DashboardOptions.Authorization` property value, then your installation is impacted. If any other authorization filter is specified in the `DashboardOptions.Authorization` property, the you are not impacted. Patched versions (1.7.26) are available both on Nuget.org and as a tagged release on the github repo. Default authorization rules now prohibit remote requests by default again by including the `LocalRequestsOnlyAuthorizationFilter` filter to the default settings. Please upgrade t
- Product
- Hangfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Thunderdome is an open source agile planning poker tool in the theme of Battling for points.CVE-2021-41232 · Other software · StevenWeathers · reported by GitHubHigh 8.1
Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use.
- Product
- thunderdome-planning-poker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.