deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-29182
Published: 2022-05-20
Description: GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-based cross-site scripting attack via a pipeline run's Stage Details > Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script that will run within the user's browser context and GoCD session via abuse of a messaging channel used for communication between with the parent page and the stage details graph's iframe. This could allow an attacker to steal a GoCD user's session cookies and/or execute malicious code in the user's context. This issue is fixed in GoCD 22.1.0. There are currently no known workarounds.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/gocd/gocd/pull/10190/commits/a256d05de1445e6c77843f098581fc6a66fe4477; https://github.com/gocd/gocd/releases/tag/22.1.0; https://github.com/gocd/gocd/security/advisories/GHSA-qcg6-4q44-3589
CVE: CVE-2022-29183
Published: 2022-05-20
Description: GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison function's error handling to render arbitrary HTML into the returned page. This could allow an attacker to trick a victim into executing code which would allow the attacker to operate on, or gain control over the same resources as the victim had access to. This issue is fixed in GoCD 21.4.0. As a workaround, block access to `/go/compare/.*` prior to GoCD Server via a reverse proxy, web application firewall or equivalent, which would prevent use of the pipeline comparison function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/gocd/gocd/pull/9829/commits/bda81084c0401234b168437cf35a63390e3064d1; https://github.com/gocd/gocd/releases/tag/21.4.0; https://github.com/gocd/gocd/security/advisories/GHSA-3vvq-q4qv-x2gf
CVE: CVE-2021-36833
Published: 2022-05-20
Description: Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ibericode's MC4WP plugin <= 4.8.6 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/mailchimp-for-wp/wordpress-mc4wp-plugin-4-8-6-authenticated-stored-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/mailchimp-for-wp/#developers; https://patchstack.com/database/vulnerability/mailchimp-for-wp/wordpress-mc4wp-plugin-4-8-6-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-21195
Published: 2022-05-20
Description: All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1333
References: https://github.com/AlexFlipnote/url_regex/blob/master/url_regex/url_regex.py; https://snyk.io/vuln/SNYK-PYTHON-URLREGEX-2347643; https://github.com/AlexFlipnote/url_regex/blob/master/url_regex/url_regex.py
CVE: CVE-2022-24434
Published: 2022-05-20
Description: This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
CVSS Score: 7.5 (HIGH)
References: https://github.com/mscdex/busboy/issues/250; https://github.com/mscdex/dicer/pull/22; https://github.com/mscdex/dicer/pull/22/commits/b7fca2e93e8e9d4439d8acc5c02f5e54a0112dac
CVE: CVE-2022-29184
Published: 2022-05-20
Description: GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on the GoCD server via configuring a malicious branch name which abuses Mercurial hooks/aliases to exploit a command injection weakness. An attacker would require access to an account with existing GoCD administration permissions to either create/edit (`hg`-based) configuration repositories; create/edit pipelines and their (`hg`-based) materials; or, where "pipelines-as-code" configuration repositories are used, to commit malicious configuration to such an external repository which will be automatically parsed into a pipeline configuration and (`hg`) material definition by the GoCD server. This issue is fixed in GoCD 22.1.0. As a workaround, users who do not use/rely upon Mercurial materials can uninstall/remove the `hg`/Mercurial binary from the underlying GoCD Server operating system or Docker image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-88, CWE-77
References: https://github.com/gocd/gocd/commit/37d35115db2ada2190173f9413cfe1bc6c295ecb; https://github.com/gocd/gocd/releases/tag/22.1.0; https://github.com/gocd/gocd/security/advisories/GHSA-vf5r-r7j2-cf2h
CVE: CVE-2022-29185
Published: 2022-05-20
Description: totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless. Starting with patched version 1.1.0, the library uses constant-time comparison. There are currently no known workarounds.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-203, CWE-208, CWE-203
References: https://github.com/constantoine/totp-rs/issues/13; https://github.com/constantoine/totp-rs/releases/tag/v1.1.0; https://github.com/constantoine/totp-rs/security/advisories/GHSA-8vxv-2g8p-2249
CVE: CVE-2022-29424
Published: 2022-05-20
Description: Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 at WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-authenticated-reflected-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/image-hover-effects-ultimate/#developers; https://patchstack.com/database/vulnerability/image-hover-effects-ultimate/wordpress-image-hover-effects-ultimate-plugin-9-7-1-authenticated-reflected-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29425
Published: 2022-05-20
Description: Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/checkout-files-upload-woocommerce/wordpress-checkout-files-upload-for-woocommerce-plugin-2-1-2-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/checkout-files-upload-woocommerce/#developers; https://patchstack.com/database/vulnerability/checkout-files-upload-woocommerce/wordpress-checkout-files-upload-for-woocommerce-plugin-2-1-2-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29448
Published: 2022-05-20
Description: Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-706
References: https://patchstack.com/database/vulnerability/mwp-herd-effect/wordpress-herd-effects-plugin-5-2-local-file-inclusion-lfi-vulnerability; https://wordpress.org/plugins/mwp-herd-effect/#developers; https://patchstack.com/database/vulnerability/mwp-herd-effect/wordpress-herd-effects-plugin-5-2-local-file-inclusion-lfi-vulnerability
CVE: CVE-2022-22972
Published: 2022-05-20
Description: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
CVSS Score: 9.8 (CRITICAL)
References: https://www.vmware.com/security/advisories/VMSA-2022-0014.html; https://www.vmware.com/security/advisories/VMSA-2022-0014.html
CVE: CVE-2022-22973
Published: 2022-05-20
Description: VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
CVSS Score: 7.8 (HIGH)
References: https://www.vmware.com/security/advisories/VMSA-2022-0014.html; https://www.vmware.com/security/advisories/VMSA-2022-0014.html
CVE: CVE-2022-28618
Published: 2022-05-20
Description: A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays that could allow an attacker to execute arbitrary commands on a Nimble appliance. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04276en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04276en_us
CVE: CVE-2022-29186
Published: 2022-05-20
Description: Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized_keys files on remote host, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier, not Debian, RPM or .WAR. Additionally, the id_rsa.pub file would have to be copied from the Docker image filesystem contents without overwriting it and used to configure SSH access on a host. A patch on Rundeck's `main` branch has removed the pre-generated SSH key pair, but it does not remove exposed keys that have been configured. To patch, users must run a script on hosts in their environment to search for exposed keys and rotate them. Two workarounds are available: Do not use any pre-existing public key file from the rundeck docker images to allow SSH access by adding it to authorized_keys files and, if you have copied the public key file included in the docker image, remove it from any authorized_keys files.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://github.com/rundeck/rundeck/commit/16ef7a70b202492f9fbb54d8af4bb8ea0afa10ad; https://github.com/rundeck/rundeck/security/advisories/GHSA-qxjx-xr2m-hgqx; https://github.com/rundeck/rundeck/commit/16ef7a70b202492f9fbb54d8af4bb8ea0afa10ad
CVE: CVE-2022-29191
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L94-L112; https://github.com/tensorflow/tensorflow/commit/48305e8ffe5246d67570b64096a96f8e315a7281; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29192
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L148-L226; https://github.com/tensorflow/tensorflow/commit/098e7762d909bac47ce1dbabe6dfd06294cb9d58; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29194
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTensor` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L128-L144; https://github.com/tensorflow/tensorflow/commit/cff267650c6a1b266e4b4500f69fbc49cdd773c5; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29426
Published: 2022-05-20
Description: Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <= 1.3.54 at WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/2j-slideshow/wordpress-slideshow-image-slider-by-2j-plugin-1-3-54-authenticated-reflected-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/2j-slideshow/#developers; https://patchstack.com/database/vulnerability/2j-slideshow/wordpress-slideshow-image-slider-by-2j-plugin-1-3-54-authenticated-reflected-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29427
Published: 2022-05-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/disable-right-click-for-wp/wordpress-disable-right-click-for-wp-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability; https://wordpress.org/plugins/disable-right-click-for-wp/#developers; https://patchstack.com/database/vulnerability/disable-right-click-for-wp/wordpress-disable-right-click-for-wp-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability
CVE: CVE-2022-29428
Published: 2022-05-20
Description: Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/simple-slider-ssp/wordpress-wp-slider-plugin-1-4-5-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/simple-slider-ssp/#developers; https://patchstack.com/database/vulnerability/simple-slider-ssp/wordpress-wp-slider-plugin-1-4-5-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29430
Published: 2022-05-20
Description: Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable parameter &jpg_quality.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://patchstack.com/database/vulnerability/png-to-jpg/wordpress-png-to-jpg-plugin-4-0-cross-site-request-forgery-csrf-leading-to-persistent-cross-site-scripting-xss-vulnerability; https://wordpress.org/plugins/png-to-jpg/#developers; https://patchstack.com/database/vulnerability/png-to-jpg/wordpress-png-to-jpg-plugin-4-0-cross-site-request-forgery-csrf-leading-to-persistent-cross-site-scripting-xss-vulnerability
CVE: CVE-2022-29431
Published: 2022-05-20
Description: Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/remove-cpt-base/wordpress-remove-cpt-base-plugin-5-8-cross-site-request-forgery-csrf-vulnerability-leading-to-cpt-base-deletion; https://wordpress.org/plugins/remove-cpt-base/#developers; https://patchstack.com/database/vulnerability/remove-cpt-base/wordpress-remove-cpt-base-plugin-5-8-cross-site-request-forgery-csrf-vulnerability-leading-to-cpt-base-deletion
CVE: CVE-2022-29432
Published: 2022-05-20
Description: Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.
CVSS Score: 3.4 (LOW)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities; https://wordpress.org/plugins/wpdatatables/#developers; https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
CVE: CVE-2022-29434
Published: 2022-05-20
Description: Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-edit-delete-event-via-idor-vulnerability; https://wordpress.org/plugins/spiffy-calendar/#developers; https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-edit-delete-event-via-idor-vulnerability
CVE: CVE-2022-29447
Published: 2022-05-20
Description: Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-552, CWE-552
References: https://patchstack.com/database/vulnerability/hover-effects/wordpress-hover-effects-plugin-2-1-authenticated-local-file-inclusion-lfi-vulnerability; https://wordpress.org/plugins/hover-effects/#developers; https://patchstack.com/database/vulnerability/hover-effects/wordpress-hover-effects-plugin-2-1-authenticated-local-file-inclusion-lfi-vulnerability
CVE: CVE-2022-1803
Published: 2022-05-20
Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://github.com/polonel/trudesk/commit/6ea9db7a5cf300e3cbf0eab7e1d6da1155a2f7f8; https://huntr.dev/bounties/47cc6621-2474-40f9-ab68-3cf62389a124; https://github.com/polonel/trudesk/commit/6ea9db7a5cf300e3cbf0eab7e1d6da1155a2f7f8
CVE: CVE-2022-29193
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/summary_tensor_op.cc#L33-L58; https://github.com/tensorflow/tensorflow/commit/290bb05c80c327ed74fae1d089f1001b1e2a4ef7; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29195
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `index` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/stage_op.cc#L26; https://github.com/tensorflow/tensorflow/commit/cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29196
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropFilterV2` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate that the `filter_sizes` argument is a vector. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-1284
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/conv_grad_ops_3d.cc; https://github.com/tensorflow/tensorflow/commit/174c5096f303d5be7ed2ca2662b08371bff4ab88; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29197
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/unsorted_segment_join_op.cc#L92-L95; https://github.com/tensorflow/tensorflow/commit/13d38a07ce9143e044aa737cfd7bb759d0e9b400; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29198
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToCSRSparseMatrix` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `dense_shape` is a vector and `indices` is a matrix (as part of requirements for sparse tensors) but there is no validation for this. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/sparse/sparse_tensor_to_csr_sparse_matrix_op.cc#L65-L119; https://github.com/tensorflow/tensorflow/commit/ea50a40e84f6bff15a0912728e35b657548cef11; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
CVE: CVE-2022-29199
Published: 2022-05-20
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `initializing_values` is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/load_and_remap_matrix_op.cc#L70-L98; https://github.com/tensorflow/tensorflow/commit/3150642acbbe254e3c3c5d2232143fa591855ac9; https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4