TQRG/raw-osv-data huggingface dataset:
Vulnerability: PYSEC-2014-84
Aliases: CVE-2014-1839
Published: 2014-03-11T19:37:00Z

The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
Vulnerability: GHSA-9ccv-p7fg-m73x
Summary: XML Injection in python-libnmap
Aliases: CVE-2019-1010017
Severity: HIGH
CWE: CWE-91
Published: 2019-07-18T15:38:41Z

python-libnmap is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.
Vulnerability: GHSA-pfwg-rxf4-97c3
Summary: Open Redirect in Apache Superset
Aliases: CVE-2021-28125
Severity: MODERATE
CWE: CWE-601
Published: 2021-10-06T17:47:53Z

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Vulnerability: PYSEC-2020-21
Aliases: CVE-2020-17515, GHSA-86vp-x3pr-79rx
Published: 2020-12-11T14:15:00Z

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Vulnerability: GHSA-4xfp-4pfp-89wg
Summary: Reference binding to nullptr in `RaggedTensorToSparse`
Aliases: CVE-2021-37656
Severity: HIGH
CWE: CWE-824
Published: 2021-08-25T14:42:55Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToSparse`:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToSparse(
  rt_nested_splits=[[0, 38, 0]],
  rt_dense_values=[])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/ragged_tensor_to_sparse_kernel.cc#L30) has an incomplete validation of the splits values: it does not check that they are in increasing order.

### Patches
We have patched the issue in GitHub commit [1071f554dbd09f7e101324d366eec5f4fe5a3ece](https://github.com/tensorflow/tensorflow/commit/1071f554dbd09f7e101324d366eec5f4fe5a3ece).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2019-202
Aliases: CVE-2014-1938, GHSA-m8qc-mf6p-pfq9
Published: 2019-11-21T15:15:00Z

python-rply before 0.7.4 insecurely creates temporary files.
Vulnerability: PYSEC-2020-301
Aliases: CVE-2020-26270, GHSA-m648-33qf-v3gp
Published: 2020-12-10T23:15:00Z

In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.
Vulnerability: GHSA-j9m2-6hq2-4r3c
Summary: Cross-site Scripting in invenio-previewer
Aliases: CVE-2019-1020019
Severity: MODERATE
CWE: CWE-79
Published: 2019-07-16T00:52:22Z

## Cross-Site Scripting (XSS) vulnerability in JSON, Markdown and iPython Notebook previewers

### Impact
Several Cross-Site Scripting (XSS) vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or Notebook file with embedded scripts that would be executed by a victims browser.

### Patches
Invenio-Previewer v1.0.0a12 fixes the issue.

### Workarounds
You can remediate the vulnerability without upgrading by disabling the affected previewers. You do this by adding the following to your configuration:

```python
PREVIEWER_PREFERENCE = [
    'csv_dthreejs',
    'simple_image',
    # 'json_prismjs',
    'xml_prismjs',
    # 'mistune',
    'pdfjs',
    # 'ipynb',
    'zip',
]
```

Afterwards, you should not be able to preview JSON, Markdown or iPython Notebook files.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
Vulnerability: PYSEC-2015-11
Aliases: CVE-2015-8213
Published: 2015-12-07T20:59:00Z

The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Vulnerability: PYSEC-2021-751
Aliases: GHSA-95xm-g58g-3p88, CVE-2021-37640
Published: 2021-08-12T18:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements. The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0. We have patched the issue in GitHub commit 4923de56ec94fff7770df259ab7f2288a74feb41. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.
Vulnerability: PYSEC-2021-301
Aliases: CVE-2021-37679, GHSA-g8wg-cjwc-xhhp
Published: 2021-08-12T23:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions it is possible to nest a `tf.map_fn` within another `tf.map_fn` call. However, if the input tensor is a `RaggedTensor` and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap. The `t` and `z` outputs should be identical, however this is not the case. The last row of `t` contains data from the heap which can be used to leak other memory information. The bug lies in the conversion from a `Variant` tensor to a `RaggedTensor`. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_from_variant_op.cc#L177-L190) does not check that all inner shapes match and this results in the additional dimensions. The same implementation can result in data loss, if input tensor is tweaked. We have patched the issue in GitHub commit 4e2565483d0ffcadc719bd44893fb7f609bb5f12. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: GHSA-p5wr-vp8g-q5p4
Summary: Moderate severity vulnerability that affects Plone
Aliases: CVE-2017-5524
Severity: MODERATE
CWE: CWE-134
Published: 2018-07-12T14:45:15Z

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
Vulnerability: PYSEC-2021-614
Aliases: GHSA-786j-5qwq-r36x, CVE-2021-41204
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-244
Aliases: GHSA-gv26-jpj9-c8gq, CVE-2021-29607
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data. The implementation(https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/sparse_sparse_binary_op_shared.cc) has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of `*_indices` matches the size of corresponding `*_shape`. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-qcx9-j53g-ccgf
Summary: Remote Code Execution via unsafe classes in otherwise permitted modules
Aliases: CVE-2021-32807
Severity: MODERATE
CWE: CWE-915
Published: 2021-08-05T17:01:30Z

### Impact
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. 

The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution.

By default, you need to have the admin-level Zope "Manager" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk.

### Patches
The problem has been fixed in AccessControl 4.3 and 5.2.
Only AccessControl versions 4 and 5 are vulnerable, and only on Python 3, not Python 2.7.

### Workarounds
A site administrator can restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [AccessControl issue tracker](https://github.com/zopefoundation/AccessControl/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: PYSEC-2020-244
Aliases: CVE-2020-7932
Published: 2020-06-17T17:15:00Z

OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.
Vulnerability: PYSEC-2014-2
Aliases: CVE-2014-0473
Published: 2014-04-23T15:55:00Z

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
Vulnerability: PYSEC-2021-497
Aliases: CVE-2021-29569, GHSA-3h8m-483j-7xxm
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The implementation(https://github.com/tensorflow/tensorflow/blob/ac328eaa3870491ababc147822cd04e91a790643/tensorflow/core/kernels/requantization_range_op.cc#L49-L50) assumes that the `input_min` and `input_max` tensors have at least one element, as it accesses the first element in two arrays. If the tensors are empty, `.flat<T>()` is an empty object, backed by an empty array. Hence, accesing even the 0th element is a read outside the bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-7
Aliases: GHSA-rxjp-mfm9-w4wr, CVE-2021-31542
Published: 2021-05-05T15:15:00Z

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Vulnerability: GHSA-fpjm-rp2g-3r4c
Summary: Django Rest Framework jwt allows obtaining new token from notionally invalidated token
Aliases: CVE-2020-10594
Severity: CRITICAL
CWE: CWE-287
Published: 2020-06-05T16:09:34Z

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
Vulnerability: PYSEC-2020-99
Aliases: GHSA-537h-rv9q-vvph, CVE-2020-13757
Published: 2020-06-01T19:15:00Z

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
Vulnerability: PYSEC-2020-76
Aliases: GHSA-cqhg-xjhh-p8hf, CVE-2020-10177
Published: 2020-06-25T19:15:00Z

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
Vulnerability: PYSEC-2021-478
Aliases: GHSA-f78g-q7r4-9wcv, CVE-2021-29550
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.FractionalAvgPool`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_avg_pool_op.cc#L85-L89) computes a divisor quantity by dividing two user controlled values. The user controls the values of `input_size[i]` and `pooling_ratio_[i]` (via the `value.shape()` and `pooling_ratio` arguments). If the value in `input_size[i]` is smaller than the `pooling_ratio_[i]`, then the floor operation results in `output_size[i]` being 0. The `DCHECK_GT` line is a no-op outside of debug mode, so in released versions of TF this does not trigger. Later, these computed values are used as arguments(https://github.com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_avg_pool_op.cc#L96-L99) to `GeneratePoolingSequence`(https://github.com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_pool_common.cc#L100-L108). There, the first computation is a division in a modulo operation. Since `output_length` can be 0, this results in runtime crashing. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-182
Aliases: CVE-2021-29545, GHSA-hmg3-c7xj-6qwm
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a denial of service via a `CHECK`-fail in converting sparse tensors to CSR Sparse matrices. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/800346f2c03a27e182dd4fba48295f65e7790739/tensorflow/core/kernels/sparse/kernels.cc#L66) does a double redirection to access an element of an array allocated on the heap. If the value at `indices(i, 0)` is such that `indices(i, 0) + 1` is outside the bounds of `csr_row_ptr`, this results in writing outside of bounds of heap allocated data. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: GHSA-q263-fvxm-m5mw
Summary: Heap out of bounds access in MakeEdge in TensorFlow
Aliases: CVE-2020-26271
Severity: LOW
CWE: CWE-125, CWE-908
Published: 2020-12-10T19:07:34Z

### Impact
Under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The [`MakeEdge` function](https://github.com/tensorflow/tensorflow/blob/3616708cb866365301d8e67b43b32b46d94b08a0/tensorflow/core/common_runtime/graph_constructor.cc#L1426-L1438) creates an edge between one output tensor of the `src` node (given by `output_index`) and the input slot of the `dst` node (given by `input_index`). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding `DataType` values and comparing these for equality:

```cc
  DataType src_out = src->output_type(output_index);
  DataType dst_in = dst->input_type(input_index);
  //...
```

However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays.

In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library.

### Patches
We have patched the issue in GitHub commit [0cc38aaa4064fd9e79101994ce9872c6d91f816b](https://github.com/tensorflow/tensorflow/commit/0cc38aaa4064fd9e79101994ce9872c6d91f816b) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: PYSEC-2021-20
Aliases: GHSA-jr9p-r423-9m2r, CVE-2021-26813
Published: 2021-03-03T16:15:00Z

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
Vulnerability: GHSA-4m72-rmm9-2qjr
Summary: Moderate severity vulnerability that affects feedparser
Aliases: CVE-2011-1158
Severity: MODERATE
CWE: CWE-79
Published: 2018-07-23T19:51:43Z

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
Vulnerability: PYSEC-2021-395
Aliases: CVE-2021-41202, GHSA-xrqm-fpgr-6hhx
Published: 2021-11-05T22:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions while calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-33c7-2mpw-hg34
Summary: Log injection in uvicorn
Aliases: CVE-2020-7694
Severity: HIGH
CWE: CWE-94, CWE-116
Published: 2020-07-29T18:07:16Z

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).
Vulnerability: GHSA-48mj-p7x2-5jfm
Summary: Basic auth bypass in esphome
Aliases: CVE-2021-41104
Severity: HIGH
CWE: CWE-306
Published: 2021-09-29T17:09:14Z

### Impact

Anyone with web_server enabled and HTTP basic auth configured on 2021.9.1 or older

`web_server` allows OTA update without checking user defined basic auth username & password

### Patches

Patch released in 2021.9.2

### Workarounds

Disable/remove `web_server`
Vulnerability: PYSEC-2017-57
Aliases: CVE-2016-4043
Published: 2017-02-24T20:59:00Z

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.
Vulnerability: PYSEC-2013-14
Aliases: CVE-2013-4439
Published: 2013-11-05T18:55:00Z

Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
Vulnerability: GHSA-r838-q6jp-58xx
Summary: Improper Restriction of Excessive Authentication Attempts in py-bcrypt
Aliases: CVE-2013-1895
Severity: HIGH
CWE: CWE-307
Published: 2021-10-12T16:31:22Z

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Vulnerability: GHSA-jh82-c5jw-pxpc
Summary: Denial of Service in Onionshare
Aliases: CVE-2022-21689
Severity: HIGH
CWE: CWE-400
Published: 2022-01-21T23:20:27Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/).

- Vulnerability ID: OTF-012
- Vulnerability type: Denial of Service
- Threat level: Moderate

## Description:

The receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script.

## Technical description:

The following script uses GNU parallel and curl with around 6000 requests in parallel to send 10000 requests. A change in the `ulimit -n` configuration is required for it to work. This is sufficient to block file upload on a (public) receive instance.

```
seq 10000 | parallel --max-args 0 --jobs 6000 "curl -i -s -x socks5h://localhost:9150 -k -X $'POST' -H $'Host: csqrp3qciewvj5axph4o62jnr6aevhmpxfkydmi3256bprhbusr2ltid.onion' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------19182376703918074873375387042' -H $'Content-Length: 329' -H $'Connection: close' --data-binary $'-----------------------------19182376703918074873375387042\x0d\x0aContent-Disposition: form-data; name=\"file[]\"; filename=\"poc.txt\"\x0d\x0aContent-Type: text/plain\x0d\x0a\x0d\x0aA\x0d\x0a-----------------------------19182376703918074873375387042\x0d\x0aContent-Disposition: form-data; name=\"text\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------19182376703918074873375387042--\x0d\x0a' $'http://csqrp3qciewvj5axph4o62jnr6aevhmpxfkydmi3256bprhbusr2ltid.onion/upload-ajax'"
```

Attack duration was around 80 seconds.

Cases where over 99 requests were sent per second:

```
Every 0.1s: ls | grep...   onionvm: Tue Oct 5 12:17:00 2021
78
```

Cases where files were successfully written to disk:

```
Every 0.1s: ls | wc -w   onionvm: Tue Oct 5 12:17:00 2021
8399
```

This means that during the attack time 1601 requests of 10000 were dropped. We tried to upload multiple files in the web interface during the attack and were not successful.

The failsafe is used to prevent creating more than 100 directories per second:

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/receive_mode.py#L386-L427

The limit of 100 requests/second is significantly lower than the possible network bandwidth and greatly reduces the attack complexity for denial of service. Our test was conducted over the tor network, which showed no limitation for the required bandwidth.

## Impact:

An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.

## Recommendation:

- Remove this limitation, or
- Derive directory name from milliseconds
Vulnerability: GHSA-fxpg-gg9g-76gj
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2010-3082
Severity: MODERATE
CWE: CWE-79
Published: 2018-07-23T19:52:42Z

Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.
Vulnerability: PYSEC-2021-680
Aliases: GHSA-qg48-85hg-mqc5, CVE-2021-29554
Published: 2021-05-14T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division. Since `data` is given by the `values` argument, `num_batch_elements` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.
Vulnerability: PYSEC-2019-150
Aliases: CVE-2017-1002152
Published: 2019-01-10T21:29:00Z

Bodhi 2.9.0 and lower is vulnerable to cross-site scripting resulting in code injection caused by incorrect validation of bug titles.
Vulnerability: GHSA-rrfp-j2mp-hq9c
Summary: Segfault in `tf.quantization.quantize_and_dequantize`
Aliases: CVE-2020-15265
Severity: LOW
CWE: CWE-125
Published: 2020-11-13T17:13:04Z

### Impact
An attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`:

```python
tf.quantization.quantize_and_dequantize(
    input=[2.5, 2.5], input_min=[0,0], input_max=[1,1], axis=10)
```

This results in accessing [a dimension outside the rank of the input tensor](https://github.com/tensorflow/tensorflow/blob/0225022b725993bfc19b87a02a2faaad9a53bc17/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L74) in the C++ kernel implementation:
```
const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);
```

However, [`dim_size` only does a `DCHECK`](https://github.com/tensorflow/tensorflow/blob/0225022b725993bfc19b87a02a2faaad9a53bc17/tensorflow/core/framework/tensor_shape.cc#L292-L307) to validate the argument and then uses it to access the corresponding element of an array:
```
int64 TensorShapeBase<Shape>::dim_size(int d) const {
  DCHECK_GE(d, 0);
  DCHECK_LT(d, dims());
  DoStuffWith(dims_[d]);
}
```

Since in normal builds, `DCHECK`-like macros are no-ops, this results in segfault and access out of bounds of the array.

### Patches

We have patched the issue in eccb7ec454e6617738554a255d77f08e60ee0808 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in #42105
Vulnerability: PYSEC-2009-7
Aliases: CVE-2009-4405
Published: 2009-12-23T21:30:00Z

Multiple unspecified vulnerabilities in Trac before 0.11.6 have unknown impact and attack vectors, possibly related to (1) "policy checks in report results when using alternate formats" or (2) a "check for the 'raw' role that is missing in docutils < 0.6."
Vulnerability: PYSEC-2022-30
Aliases: GHSA-3v7g-4pg3-7r6j, CVE-2022-24288
Published: 2022-02-25T09:15:00Z

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Vulnerability: GHSA-c545-c4f9-rf6v
Summary: Heap OOB in TFLite
Aliases: CVE-2021-37685
Severity: MODERATE
CWE: CWE-125
Published: 2021-08-25T14:40:09Z

### Impact
TFLite's [`expand_dims.cc`](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/expand_dims.cc#L36-L50) contains a vulnerability which allows reading one element outside of bounds of heap allocated data:

```cc
  if (axis < 0) { 
    axis = input_dims.size + 1 + axis;
  }   
  TF_LITE_ENSURE(context, axis <= input_dims.size);

  TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);
  for (int i = 0; i < output_dims->size; ++i) {
    if (i < axis) {
      output_dims->data[i] = input_dims.data[i];
    } else if (i == axis) {
      output_dims->data[i] = 1;
    } else {
      output_dims->data[i] = input_dims.data[i - 1];
    }
  }
```

If `axis` is a large negative value (e.g., `-100000`), then after the first `if` it would still be negative. The check following the `if` statement will pass and the `for` loop would read one element before the start of `input_dims.data` (when `i = 0`).

### Patches
We have patched the issue in GitHub commit [d94ffe08a65400f898241c0374e9edc6fa8ed257](https://github.com/tensorflow/tensorflow/commit/d94ffe08a65400f898241c0374e9edc6fa8ed257).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: PYSEC-2021-403
Aliases: CVE-2021-41211, GHSA-cvgx-3v3q-m36c
Published: 2021-11-05T21:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for `QuantizeV2` can trigger a read outside of bounds of heap allocated array. This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer. The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
Vulnerability: GHSA-gwp7-vqr5-h33h
Summary: Open Redirect in autobahn
Aliases: CVE-2020-35678
Severity: MODERATE
CWE: CWE-601
Published: 2021-04-20T16:13:45Z

Autobahn|Python before 20.12.3 allows redirect header injection.
Vulnerability: GHSA-gjj5-998g-v36v
Summary: Improper Access Control in Onionshare
Aliases: CVE-2022-21692
Severity: MODERATE
CWE: CWE-287
Published: 2022-01-21T23:20:21Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-003
- Vulnerability type: Improper Access Control
- Threat level: Moderate

## Description:

Anyone with access to the chat environment can write messages disguised as another chat participant.

## Technical description:

Prerequisites:

- Alice and Bob are legitimate users
- A third user has access to the chat environment

![otf-003-a](https://user-images.githubusercontent.com/156128/140665707-1ecc897e-d33b-4f5b-b585-eb4475c1599f.png)

This screenshot shows Alice (`glimpse-depress`) and Bob (`blinker-doorpost`) joined a chatroom and are the only participants in the chatroom. Then the non-listed user squad-nursing writes a message in the chatroom without being visible in the list of users. The sending of the message itself is not required but was done here to show the initial access. The non-listed participant now renames himself to Bob and writes another message, seemingly coming from Bob.

This can be reproduced by slightly modifying the client-side JavaScript. The `joined` emit needs to be removed from the `socket.on(connect) `event handler. Therefore a client is not listed in the userlist and has no active session.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/resources/static/js/chat.js#L16-L18

This can be done either via a crafted client or runtime modification of the `chat.js` script in the browser's internal debugger.

It is still possible to call the text method and send text to the chat via websocket.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/chat_mode.py#L131-L139

It is also possible to call the `update_username` function and choose an existing username from the chat.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/chat_mode.py#L141-L162

Afterwards the hidden user can send messages that are displayed as coming from the impersonated user. There is no way to distinguish between the fake and original message.

## Impact:

An adversary with access to the chat environment can impersonate existing chat participants and write messages but not read the conversation. The similar exploit described in OTF-004 (page 19) has only slightly more requirements but also allows for reading.

## Recommendation:

- Implement proper session handling
Vulnerability: GHSA-9c84-4hx6-xmm4
Summary: Integer overflow in TFLite concatentation
Aliases: CVE-2021-29601
Severity: MODERATE
CWE: CWE-190
Published: 2021-05-21T14:28:08Z

### Impact
The TFLite implementation of concatenation is [vulnerable to an integer overflow issue](https://github.com/tensorflow/tensorflow/blob/7b7352a724b690b11bfaae2cd54bc3907daf6285/tensorflow/lite/kernels/concatenation.cc#L70-L76):

```cc
for (int d = 0; d < t0->dims->size; ++d) {
  if (d == axis) { 
    sum_axis += t->dims->data[axis]; 
  } else {
    TF_LITE_ENSURE_EQ(context, t->dims->data[d], t0->dims->data[d]);
  }
}
```

An attacker can craft a model such that the dimensions of one of the concatenation input overflow the values of `int`. TFLite uses `int` to represent tensor dimensions, whereas TF uses `int64`. Hence, valid TF models can trigger an integer overflow when converted to TFLite format.

### Patches
We have patched the issue in GitHub commit [4253f96a58486ffe84b61c0415bb234a4632ee73](https://github.com/tensorflow/tensorflow/commit/4253f96a58486ffe84b61c0415bb234a4632ee73).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2021-116
Aliases: CVE-2021-23422, SNYK-PYTHON-BIKESHED-1537646, GHSA-87cj-px37-rc3x
Published: 2021-08-16T08:15:00Z

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.
Vulnerability: GHSA-qx2v-j445-g354
Summary: Improper Input Validation in Google TensorFlow
Aliases: CVE-2018-7577
Severity: HIGH
CWE: CWE-20
Published: 2019-04-30T15:37:34Z

Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.
Vulnerability: PYSEC-2014-47
Aliases: CVE-2012-5505
Published: 2014-09-30T14:55:00Z

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.
Vulnerability: GHSA-37m5-42qp-4qpr
Summary: Cross-site scripting in LocalStack
Aliases: CVE-2021-32091
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-18T18:38:09Z

A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack.
Vulnerability: PYSEC-2021-546
Aliases: GHSA-xqfj-cr6q-pc8w, CVE-2021-29618
Published: 2021-05-14T20:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2020-116
Aliases: CVE-2020-15193, GHSA-rjjg-hgv6-h69v
Published: 2020-09-25T19:15:00Z

In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor. However, there is nothing stopping users from passing in a Python object instead of a tensor. The uninitialized memory address is due to a `reinterpret_cast` Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.
Vulnerability: PYSEC-2021-815
Aliases: GHSA-57wx-m983-2f88, CVE-2021-41208
Published: 2021-11-05T22:15:00Z

TensorFlow is an open source platform for machine learning. In affected versions the code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures) as well as abuse undefined behavior (binding references to `nullptr`s). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call. Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. We will deprecate TensorFlow's boosted trees APIs in subsequent releases. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Vulnerability: GHSA-fcf9-3qw3-gxmj
Summary: High severity vulnerability that affects cryptography
Aliases: CVE-2018-10903
Severity: HIGH
CWE: CWE-20
Published: 2018-07-31T18:28:09Z

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
Vulnerability: PYSEC-2018-64
Aliases: GHSA-cf3c-fffp-34qh, CVE-2018-14572
Published: 2018-08-28T19:29:00Z

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
Vulnerability: GHSA-mhhc-q96p-mfm9
Summary: Infinite loop in TFLite
Aliases: CVE-2021-37686
Severity: MODERATE
CWE: CWE-835
Published: 2021-08-25T14:39:58Z

### Impact
The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definition](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/strided_slice.cc#L103-L122):

```cc
  for (int i = 0; i < effective_dims;) {
    if ((1 << i) & op_context->params->ellipsis_mask) {
      // ...
      int ellipsis_end_idx =
          std::min(i + 1 + num_add_axis + op_context->input_dims - begin_count,
                   effective_dims);
      // ...
      for (; i < ellipsis_end_idx; ++i) {
        // ...
      }
      continue;
    }
    // ...
    ++i;
  }
```

An attacker can craft a model such that `ellipsis_end_idx` is smaller than `i` (e.g., always negative). In this case, the inner loop does not increase `i` and the `continue` statement causes execution to skip over the preincrement at the end of the outer loop.

### Patches
We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695).

The fix will be included in TensorFlow 2.6.0. This is the only affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: PYSEC-2020-268
Aliases: CVE-2020-5262, GHSA-2wx6-wc87-rmjm
Published: 2020-03-19T17:15:00Z

In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.
Vulnerability: GHSA-q5hq-fp76-qmrc
Summary: Uncontrolled Resource Consumption in Pillow
Aliases: CVE-2021-28677
Severity: HIGH
CWE: CWE-400
Published: 2021-06-08T18:49:36Z

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Vulnerability: GHSA-5m69-3chg-6f8m
Summary: Cross Site Scripting (XSS) in Quokka
Aliases: CVE-2020-18702
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-30T16:23:26Z

Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.
Vulnerability: PYSEC-2022-2
Aliases: CVE-2021-45116, GHSA-8c5j-9r9f-c6w8
Published: 2022-01-05T00:15:00Z

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
Vulnerability: PYSEC-2021-268
Aliases: CVE-2021-37646, GHSA-h6jh-7gv5-28vg
Published: 2021-08-12T21:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.StringNGrams` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/string_ngrams_op.cc#L184) calls `reserve` on a `tstring` with a value that sometimes can be negative if user supplies negative `ngram_widths`. The `reserve` method calls `TF_TString_Reserve` which has an `unsigned long` argument for the size of the buffer. Hence, the implicit conversion transforms the negative value to a large integer. We have patched the issue in GitHub commit c283e542a3f422420cfdb332414543b62fc4e4a5. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-792
Aliases: CVE-2021-37681, GHSA-7xwj-5r4v-429p
Published: 2021-08-12T22:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of SVDF in TFLite is [vulnerable to a null pointer error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/svdf.cc#L300-L313). The [`GetVariableInput` function](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/kernel_util.cc#L115-L119) can return a null pointer but `GetTensorData` assumes that the argument is always a valid tensor. Furthermore, because `GetVariableInput` calls [`GetMutableInput`](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/kernel_util.cc#L82-L90) which might return `nullptr`, the `tensor->is_variable` expression can also trigger a null pointer exception. We have patched the issue in GitHub commit 5b048e87e4e55990dae6b547add4dae59f4e1c76. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Vulnerability: PYSEC-2021-638
Aliases: GHSA-4278-2v5v-65r4, CVE-2021-29512
Published: 2021-05-14T19:15:00Z

TensorFlow is an end-to-end open source platform for machine learning. If the `splits` argument of `RaggedBincount` does not specify a valid `SparseTensor`(https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the `splits` tensor buffer in the implementation of the `RaggedBincount` op(https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L433). Before the `for` loop, `batch_idx` is set to 0. The user controls the `splits` array, making it contain only one element, 0. Thus, the code in the `while` loop would increment `batch_idx` and then try to read `splits(1)`, which is outside of bounds. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected.