Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ess to the chat messages and files of the user. It is recommended that the Nextcloud Android Talk App is upgraded to 12.3.0. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-497c-c8hx-6qcf - https://github.com/nextcloud/talk-android/pull/1585
CVE ID: CVE-2021-41182 State: PUBLISHED Published: 2021-10-26T00:00:00.000Z Last Updated: 2025-02-13T16:28:30.239Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: jquery Products: jquery-ui Problem Types: CWE-79 Description: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources. Additional Analyst Notes:
tor. A workaround is to not accept the value of the `altField` option from untrusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jquery/jquery-ui/security/advisories/GHSA-9gj3-hwp5-pmwc - https://github.com/jquery/jquery-ui/pull/1954/commits/6809ce843e5ac4128108ea4c15cbc100653c2b63 - https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ - https://lists.fedoraproject.org/archi
age-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/ - https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html - https://www.drupal.org/sa-core-2022-002 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211118-0004/ - https://www.drupal.org/sa-contrib-2022-004 - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.tenable.com/security/tns-2022-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2R
s-2022-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-41183 State: PUBLISHED Published: 2021-10-26T00:00:00.000Z Last Updated: 2025-02-13T16:28:30.803Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: jquery Products: jquery-ui Problem Types: CWE-79 Description: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. Additional Analys
text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ - https://github.com/jquery/jquery-ui/security/advisories/GHSA-j7qv-pgf6-hvh4 - https://github.com/jquery/jquery-ui/pull/1953 - https://bugs.jqueryui.com/ticket/15284 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ - https://lists.fedoraproject.org/arch
kage-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/ - https://lists.debian.org/debian-lts-announce/2022/01/msg00014.html - https://www.drupal.org/sa-core-2022-002 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211118-0004/ - https://www.drupal.org/sa-contrib-2022-004 - https://www.drupal.org/sa-core-2022-001 - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.tenable.com/security/tns-2022-09 - https://lists.fedoraproject.org/archives/list/package-announce%40
.html - https://www.tenable.com/security/tns-2022-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-41184 State: PUBLISHED Published: 2021-10-26T00:00:00.000Z Last Updated: 2025-11-04T16:09:17.971Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: jquery Products: jquery-ui Problem Types: CWE-79 Description: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources. Additional Analyst Notes: - CVE Program Con
around is to not accept the value of the `of` option from untrusted sources. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/ - https://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327 - https://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ - https://lists.fedoraproject.org/archives/list/package-announce%40
roject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211118-0004/ - https://www.drupal.org/sa-core-2022-001 - https://www.oracle.com/security-alerts/cpujul2022.html - https://www.tenable.com/security/tns-2022-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDER
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2021-41185 State: PUBLISHED Published: 2021-10-26T14:45:13 Last Updated: 2024-08-04T03:08:31.274Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: kizniche Products: Mycodo Problem Types: CWE-22 Description: Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users may manually apply the changes from the fix commit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kizniche/Mycodo/
rom the fix commit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kizniche/Mycodo/security/advisories/GHSA-252r-94ph-m229 - https://github.com/kizniche/Mycodo/issues/1105 - https://github.com/kizniche/Mycodo/commit/23ac5dd422029c2b6ae1701a3599b6d41b66a6a9 - https://github.com/kizniche/Mycodo/releases/tag/v8.12.7
CVE ID: CVE-2021-41186 State: PUBLISHED Published: 2021-10-29T13:40:10 Last Updated: 2024-08-04T03:08:31.511Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: fluent Products: fluentd Problem Types: CWE-400 Description: Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two w
regular expression, resulting in the potential for a DoS attack. This issue is patched in version 1.14.2 There are two workarounds available. Either don't use parser_apache2 for parsing logs (which cannot guarantee generated by Apache), or put patched version of parser_apache2.rb into /etc/fluent/plugin directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662 - https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142 - https://github.com/github/securitylab-vulnerabilities/blob/52dc
thub.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142 - https://github.com/github/securitylab-vulnerabilities/blob/52dc4a2a828c6dc24231967c2937ad92038184a9/vendor_reports/GHSL-2021-102-fluent-fluentd.md
CVE ID: CVE-2021-41187 State: PUBLISHED Published: 2021-11-01T21:20:08 Last Updated: 2024-08-04T03:08:31.340Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: dhis2 Products: dhis2-core Problem Types: CWE-89 Description: DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the API endpoints for /api/trackedEntityInstances and api/events in DHIS2. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being
y from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. However, we strongly recommend that all DHIS2 implementations using versions 2.32, 2.33, 2.34, 2.35 and 2.36 install these patches as soon as possible. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this
ances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the /api/trackedEntityInstance and /api/events endpoints as a temporary workaround while waiting to upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dhis2/dhis2-core/security/advisories/GHSA-fvm5-gp3j-c7c6
CVE ID: CVE-2021-41188 State: PUBLISHED Published: 2021-10-26T15:00:16 Last Updated: 2024-08-04T03:08:31.242Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: shopware Products: shopware Problem Types: CWE-79 Description: Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the `.htaccess` file will protect against cross-site scripting in this case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub S
case. There is also a config for those using nginx as a server. The plugin and the configs can be found on the GitHub Security Advisory page for this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopware/shopware/security/advisories/GHSA-4p3x-8qw9-24w9 - https://github.com/shopware/shopware/commit/37213e91d525c95df262712cba80d1497e395a58 - https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021 - https://github.com/shopware/shopware/releases/tag/v5.7.6 - https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
CVE ID: CVE-2021-41189 State: PUBLISHED Published: 2021-10-29T17:25:10 Last Updated: 2024-08-04T03:08:31.307Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: DSpace Products: DSpace Problem Types: CWE-863 Description: DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings. Additi
arily disable the ability for community or collection administrators to manage permissions or workflows settings. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DSpace/DSpace/security/advisories/GHSA-cf2j-vf36-c6w8 - https://github.com/DSpace/DSpace/issues/7928 - https://github.com/DSpace/DSpace/commit/277b499a5cd3a4f5eb2370513a1b7e4ec2a6e041 - https://github.com/DSpace/DSpace/commit/c3bea16ab911606e15ae96c97a1575e1ffb14f8a
CVE ID: CVE-2021-41190 State: PUBLISHED Published: 2021-11-17T19:20:11 Last Updated: 2024-08-04T03:08:31.262Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: opencontainers Products: distribution-spec Problem Types: CWE-843 Description: The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying
“manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the
“manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m - https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923 - http://www.openwall.com/lists/oss-security/2021/11/19/10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4O
ttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM/ - https://lists.fedoraproject.org/arch
kage-announce%40lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX/
CVE ID: CVE-2021-41191 State: PUBLISHED Published: 2021-10-27T20:30:11 Last Updated: 2024-08-04T03:08:31.339Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Redon-Tech Products: Roblox-Purchasing-Hub Problem Types: CWE-116 Description: Roblox-Purchasing-Hub is an open source Roblox product purchasing hub. A security risk in versions 1.0.1 and prior allowed people who have someone's API URL to get product files without an API key. This issue is fixed in version 1.0.2. As a workaround, add `@require_apikey` in `BOT/lib/cogs/website.py` under the route for `/v1/products`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Redon-T
he route for `/v1/products`. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Redon-Tech/Roblox-Purchasing-Hub/security/advisories/GHSA-76mx-6584-4v8q - https://github.com/Redon-Tech/Roblox-Purchasing-Hub/commit/58a22260eca40b1a0377daf61ccd8c4dc1440e03 - https://github.com/Redon-Tech/Roblox-Purchasing-Hub/releases/tag/V1.0.2
CVE ID: CVE-2021-41192 State: PUBLISHED Published: 2021-11-23T23:50:10 Last Updated: 2024-08-04T03:08:31.434Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: getredash Products: redash Problem Types: CWE-1188 Description: Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where
ble to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH_COOKIE_SECRET or REDASH_SECRET_KEY` environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the `REDASH_COOKIE_SECRET` environment variable. If it is `c292a0a3aa32397cdb050e233733900f`, should follow the steps to secure the instance, outlined in the
variable. If it is `c292a0a3aa32397cdb050e233733900f`, should follow the steps to secure the instance, outlined in the GitHub Security Advisory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv - https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a214 - https://ian.sh/redash
CVE ID: CVE-2021-41193 State: PUBLISHED Published: 2022-03-01T18:25:22.000Z Last Updated: 2025-04-23T18:59:49.177Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: wireapp Products: wire-avs Problem Types: CWE-134 Description: wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wir
rounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-avs/security/advisories/GHSA-2j6v-xpf3-xvrv - https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe
CVE ID: CVE-2021-41194 State: PUBLISHED Published: 2021-10-28T19:40:12 Last Updated: 2024-08-04T03:08:31.328Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: jupyterhub Products: firstuseauthenticator Problem Types: CWE-284 Description: FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized access to any user's account if `create_users=True` and the username is known or guessed. One may upgrade to version 1.0.0 or apply a patch manually to mitigate the vulnerability. For
name is known or guessed. One may upgrade to version 1.0.0 or apply a patch manually to mitigate the vulnerability. For those who cannot upgrade, there is no complete workaround, but a partial mitigation exists. One can disable user creation with `c.FirstUseAuthenticator.create_users = False`, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until a patch or upgrade occurs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/firstuseauthenticator/secur
ditional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyterhub/firstuseauthenticator/security/advisories/GHSA-5xvc-vgmp-jgc3 - https://github.com/jupyterhub/firstuseauthenticator/pull/38 - https://github.com/jupyterhub/firstuseauthenticator/pull/38.patch
CVE ID: CVE-2021-41195 State: PUBLISHED Published: 2021-11-05T19:50:12 Last Updated: 2024-08-04T03:08:31.297Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: tensorflow Products: tensorflow Problem Types: CWE-190 Description: TensorFlow is an open source platform for machine learning. In affected versions the implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large. This is similar to CVE-2021-29584 (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the implementation (both on CPU and GPU) computes the output shape using `Add