deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-18451
Published: 2021-08-12
Description: Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/AutismJH/damicms/issues/2; https://github.com/AutismJH/damicms/issues/2
CVE: CVE-2020-18454
Published: 2021-08-12
Description: Cross Site Request Forgery (CSRF) vulnerability in bycms v1.3 via admin.php/systems/index/module_id/70/group_id/1.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/hillerlin/bycms/issues/1; https://github.com/hillerlin/bycms/issues/1
CVE: CVE-2020-18455
Published: 2021-08-12
Description: Cross Site Scripting (XSS) vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/hillerlin/bycms/issues/2; https://github.com/hillerlin/bycms/issues/2
CVE: CVE-2020-18456
Published: 2021-08-12
Description: Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title parameter in the mod function in SingleController.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Pbootcms/Pbootcms/issues/4; https://github.com/Pbootcms/Pbootcms/issues/4
CVE: CVE-2020-18457
Published: 2021-08-12
Description: Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/hillerlin/bycms/issues/3; https://github.com/hillerlin/bycms/issues/3
CVE: CVE-2021-26423
Published: 2021-08-12
Description: .NET Core and Visual Studio Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26423; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26423
CVE: CVE-2021-26424
Published: 2021-08-12
Description: Windows TCP/IP Remote Code Execution Vulnerability
CVSS Score: 9.9 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26424; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26424
CVE: CVE-2021-26425
Published: 2021-08-12
Description: Windows Event Tracing Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26425; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26425
CVE: CVE-2021-26426
Published: 2021-08-12
Description: Windows User Account Profile Picture Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26426; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26426
CVE: CVE-2021-26428
Published: 2021-08-12
Description: Azure Sphere Information Disclosure Vulnerability
CVSS Score: 4.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26428; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26428
CVE: CVE-2021-26429
Published: 2021-08-12
Description: Azure Sphere Elevation of Privilege Vulnerability
CVSS Score: 7.7 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26429; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26429
CVE: CVE-2021-26430
Published: 2021-08-12
Description: Azure Sphere Denial of Service Vulnerability
CVSS Score: 6.0 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26430; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26430
CVE: CVE-2021-26431
Published: 2021-08-12
Description: Windows Recovery Environment Agent Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26431; https://www.zerodayinitiative.com/advisories/ZDI-21-1053/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26431
CVE: CVE-2021-26432
Published: 2021-08-12
Description: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
CVSS Score: 9.8 (CRITICAL)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26432; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26432
CVE: CVE-2021-26433
Published: 2021-08-12
Description: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26433; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26433
CVE: CVE-2021-33762
Published: 2021-08-12
Description: Azure CycleCloud Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33762; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33762
CVE: CVE-2021-34471
Published: 2021-08-12
Description: Microsoft Windows Defender Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34471; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34471
CVE: CVE-2021-34478
Published: 2021-08-12
Description: Microsoft Office Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34478; https://www.zerodayinitiative.com/advisories/ZDI-21-1024/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34478
CVE: CVE-2021-34480
Published: 2021-08-12
Description: Scripting Engine Memory Corruption Vulnerability
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://packetstormsecurity.com/files/164121/Internet-Explorer-JIT-Optimization-Memory-Corruption.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34480; http://packetstormsecurity.com/files/164121/Internet-Explorer-JIT-Optimization-Memory-Corruption.html
CVE: CVE-2021-34483
Published: 2021-08-12
Description: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34483; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34483
CVE: CVE-2021-34484
Published: 2021-08-12
Description: Windows User Profile Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34484; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34484; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34484
CVE: CVE-2021-34485
Published: 2021-08-12
Description: .NET Core and Visual Studio Information Disclosure Vulnerability
CVSS Score: 5.0 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34485; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34485
CVE: CVE-2021-34486
Published: 2021-08-12
Description: Windows Event Tracing Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34486; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34486; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-34486
CVE: CVE-2021-34487
Published: 2021-08-12
Description: Windows Event Tracing Elevation of Privilege Vulnerability
CVSS Score: 7.0 (HIGH)
CWE: CWE-269, CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34487; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34487
CVE: CVE-2021-34524
Published: 2021-08-12
Description: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34524; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34524
CVE: CVE-2021-34530
Published: 2021-08-12
Description: Windows Graphics Component Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34530; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34530
CVE: CVE-2021-34532
Published: 2021-08-12
Description: ASP.NET Core and Visual Studio Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34532; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34532
CVE: CVE-2021-34533
Published: 2021-08-12
Description: Windows Graphics Component Font Parsing Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34533; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34533
CVE: CVE-2021-34534
Published: 2021-08-12
Description: Windows MSHTML Platform Remote Code Execution Vulnerability
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34534; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34534
CVE: CVE-2021-34535
Published: 2021-08-12
Description: Remote Desktop Client Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34535; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34535
CVE: CVE-2021-34536
Published: 2021-08-12
Description: Storage Spaces Controller Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34536; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34536
CVE: CVE-2021-34537
Published: 2021-08-12
Description: Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34537; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34537
CVE: CVE-2021-36921
Published: 2021-08-12
Description: AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 has Improper Authentication. An attacker can gain administrative access by modifying the response to an authentication check request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0021/FEYE-2021-0021.md; https://github.com/monitorapp-aicc/report/wiki/CVE-2021-36921; https://www.monitorapp.com/waf/
CVE: CVE-2021-36926
Published: 2021-08-12
Description: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36926; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36926
CVE: CVE-2021-36927
Published: 2021-08-12
Description: Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36927; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36927
CVE: CVE-2021-36932
Published: 2021-08-12
Description: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36932; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36932
CVE: CVE-2021-36933
Published: 2021-08-12
Description: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36933; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36933
CVE: CVE-2021-36936
Published: 2021-08-12
Description: Windows Print Spooler Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36936; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36936
CVE: CVE-2021-36937
Published: 2021-08-12
Description: Windows Media MPEG-4 Video Decoder Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36937; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36937
CVE: CVE-2021-36938
Published: 2021-08-12
Description: Windows Cryptographic Primitives Library Information Disclosure Vulnerability
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36938; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36938
CVE: CVE-2021-36940
Published: 2021-08-12
Description: Microsoft SharePoint Server Spoofing Vulnerability
CVSS Score: 7.6 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36940; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36940
CVE: CVE-2021-36941
Published: 2021-08-12
Description: Microsoft Word Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36941; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36941
CVE: CVE-2021-36942
Published: 2021-08-12
Description: Windows LSA Spoofing Vulnerability
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36942; https://www.kb.cert.org/vuls/id/405600; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36942
CVE: CVE-2021-36943
Published: 2021-08-12
Description: Azure CycleCloud Elevation of Privilege Vulnerability
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36943; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36943
CVE: CVE-2021-36945
Published: 2021-08-12
Description: Windows 10 Update Assistant Elevation of Privilege Vulnerability
CVSS Score: 7.3 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36945; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36945
CVE: CVE-2021-36946
Published: 2021-08-12
Description: Microsoft Dynamics Business Central Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36946
CVE: CVE-2021-36947
Published: 2021-08-12
Description: Windows Print Spooler Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36947; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36947
CVE: CVE-2021-36948
Published: 2021-08-12
Description: Windows Update Medic Service Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36948; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36948; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36948
CVE: CVE-2021-36949
Published: 2021-08-12
Description: Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability
CVSS Score: 7.1 (HIGH)
CWE: CWE-287
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36949; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36949
CVE: CVE-2021-36950
Published: 2021-08-12
Description: Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36950; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36950
CVE: CVE-2021-36958
Published: 2021-08-12
Description: <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36958; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36958; https://www.kb.cert.org/vuls/id/131152
CVE: CVE-2021-36982
Published: 2021-08-12
Description: AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 allows OS Command Injection because of missing input validation on one of the parameters of an HTTP request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0022/FEYE-2021-0022.md; https://github.com/monitorapp-aicc/report/wiki/CVE-2021-36982; https://www.monitorapp.com/waf/
CVE: CVE-2021-37636
Published: 2021-08-12
Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a[PII_REDACTED]ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit d9204be9f49520cdaaeb2541d1dc5187b23f31d9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/d9204be9f49520cdaaeb2541d1dc5187b23f31d9; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hp4c-x6r7-6555; https://github.com/tensorflow/tensorflow/commit/d9204be9f49520cdaaeb2541d1dc5187b23f31d9
CVE: CVE-2021-37640
Published: 2021-08-12
Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements. The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0. We have patched the issue in GitHub commit 4923de56ec94fff7770df259ab7f2288a74feb41. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/4923de56ec94fff7770df259ab7f2288a74feb41; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-95xm-g58g-3p88; https://github.com/tensorflow/tensorflow/commit/4923de56ec94fff7770df259ab7f2288a74feb41
CVE: CVE-2021-37642
Published: 2021-08-12
Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/resource_variable_ops.cc#L865) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit 4aacb30888638da75023e[PII_REDACTED]b39763d76. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e[PII_REDACTED]b39763d76; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ch4f-829c-v5pw; https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e[PII_REDACTED]b39763d76
CVE: CVE-2021-37653
Published: 2021-08-12
Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a floating point exception in `tf.raw_ops.ResourceGather`. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L725-L731) computes the value of a value, `batch_size`, and then divides by it without checking that this value is not 0. We have patched the issue in GitHub commit ac117ee8a8ea57b73d34665cdf00ef3303bc0b11. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/ac117ee8a8ea57b73d34665cdf00ef3303bc0b11; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qjj8-32p7-h289; https://github.com/tensorflow/tensorflow/commit/ac117ee8a8ea57b73d34665cdf00ef3303bc0b11
CVE: CVE-2021-37660
Published: 2021-08-12
Description: TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`. We have patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/commit/e86605c0a336c088b638da02135ea6f9f6753618; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cm5x-837x-jf3c; https://github.com/tensorflow/tensorflow/commit/e86605c0a336c088b638da02135ea6f9f6753618
CVE: CVE-2020-18458
Published: 2021-08-12
Description: Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://github.com/AutismJH/damicms/issues/5; https://github.com/AutismJH/damicms/issues/5