deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-44378
Published: 2022-11-18
Description: Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete_mechanic.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/suikirakira/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md; https://github.com/suikirakira/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md
CVE: CVE-2022-44379
Published: 2022-11-18
Description: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/suikirakira/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md; https://github.com/suikirakira/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md
CVE: CVE-2022-45473
Published: 2022-11-18
Description: In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/drachtio/drachtio-server/commit/f791a9313c58a911ce09f465f4bba594243b29ec; https://github.com/drachtio/drachtio-server/issues/241; https://github.com/drachtio/drachtio-server/commit/f791a9313c58a911ce09f465f4bba594243b29ec
CVE: CVE-2022-45474
Published: 2022-11-18
Description: drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: https://github.com/drachtio/drachtio-server/commit/860f025468feb31c43227153d8fb3f34210a522e; https://github.com/drachtio/drachtio-server/issues/240; https://github.com/drachtio/drachtio-server/commit/860f025468feb31c43227153d8fb3f34210a522e
CVE: CVE-2022-38075
Published: 2022-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/mantenimiento-web/wordpress-mantenimiento-web-plugin-0-13-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve; https://patchstack.com/database/vulnerability/mantenimiento-web/wordpress-mantenimiento-web-plugin-0-13-cross-site-request-forgery-csrf-vulnerability-leading-to-stored-cross-site-scripting-xss?_s_id=cve
CVE: CVE-2022-38974
Published: 2022-11-18
Description: Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change the status of the translation jobs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-plugin-4-5-10-broken-access-control-vulnerability-2?_s_id=cve; https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-plugin-4-5-10-broken-access-control-vulnerability-2?_s_id=cve
CVE: CVE-2022-40686
Published: 2022-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/creative-mail-by-constant-contact/wordpress-creative-mail-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/creative-mail-by-constant-contact/wordpress-creative-mail-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-40687
Published: 2022-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/creative-mail-by-constant-contact/wordpress-creative-mail-easier-wordpress-woocommerce-email-marketing-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/creative-mail-by-constant-contact/wordpress-creative-mail-easier-wordpress-woocommerce-email-marketing-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-41652
Published: 2022-11-18
Description: Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-bypass-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-bypass-vulnerability?_s_id=cve
CVE: CVE-2022-41692
Published: 2022-11-18
Description: Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/appointment-hour-booking/wordpress-appointment-hour-booking-plugin-1-3-71-missing-authorization-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/appointment-hour-booking/wordpress-appointment-hour-booking-plugin-1-3-71-missing-authorization-vulnerability?_s_id=cve
CVE: CVE-2022-41781
Published: 2022-11-18
Description: Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/permalink-manager/wordpress-permalink-manager-lite-plugin-2-2-20-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/permalink-manager/wordpress-permalink-manager-lite-plugin-2-2-20-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-41805
Published: 2022-11-18
Description: Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://patchstack.com/database/vulnerability/woocommerce-jetpack/wordpress-booster-for-woocommerce-plugin-5-6-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-jetpack/wordpress-booster-for-woocommerce-plugin-5-6-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-41840
Published: 2022-11-18
Description: Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://patchstack.com/database/vulnerability/usc-e-shop/wordpress-welcart-e-commerce-plugin-2-7-7-unauth-directory-traversal-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/usc-e-shop/wordpress-welcart-e-commerce-plugin-2-7-7-unauth-directory-traversal-vulnerability?_s_id=cve
CVE: CVE-2022-43463
Published: 2022-11-18
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/yikes-inc-easy-custom-woocommerce-product-tabs/wordpress-custom-product-tabs-for-woocommerce-plugin-1-7-9-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/yikes-inc-easy-custom-woocommerce-product-tabs/wordpress-custom-product-tabs-for-woocommerce-plugin-1-7-9-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2022-44413
Published: 2022-11-18
Description: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/manage_mechanic.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-3.md; https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-3.md
CVE: CVE-2022-44414
Published: 2022-11-18
Description: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/services/manage_service.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md; https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-1.md
CVE: CVE-2022-44415
Published: 2022-11-18
Description: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view_mechanic.php?id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md; https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-2.md
CVE: CVE-2022-44820
Published: 2022-11-18
Description: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=transactions/manage_transaction&id=.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-4.md; https://github.com/huchengrong/bug_report/blob/main/vendors/oretnom23/automotive-shop-management-system/SQLi-4.md
CVE: CVE-2022-42461
Published: 2022-11-18
Description: Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: https://patchstack.com/database/vulnerability/miniorange-2-factor-authentication/wordpress-miniorange-s-google-authenticator-plugin-5-6-1-broken-access-control-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/miniorange-2-factor-authentication/wordpress-miniorange-s-google-authenticator-plugin-5-6-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2022-43482
Published: 2022-11-18
Description: Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/appointment-booking-calendar/wordpress-appointment-booking-calendar-plugin-1-3-69-missing-authorization-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/appointment-booking-calendar/wordpress-appointment-booking-calendar-plugin-1-3-69-missing-authorization-vulnerability?_s_id=cve
CVE: CVE-2022-43673
Published: 2022-11-18
Description: Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for a limited period of time) from the AppData\Roaming\Wire\IndexedDB\https_app.wire.com_0.indexeddb.leveldb database.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://wire.com/; https://www.secuvera.de/advisories/secuvera-SA-2022-01.txt; https://wire.com/
CVE: CVE-2022-37197
Published: 2022-11-18
Description: IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-428
References: https://www.exploit-db.com/exploits/51029; https://www.exploit-db.com/exploits/51029
CVE: CVE-2022-41883
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will crash. We have patched the issue in GitHub commit f5381e0e10b5a61344109c1b7c174c68110f7629. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/dynamic_stitch_op.cc; https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/data_flow_ops.cc; https://github.com/tensorflow/tensorflow/commit/f5381e0e10b5a61344109c1b7c174c68110f7629
CVE: CVE-2022-42904
Published: 2022-11-18
Description: Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2022-42904.html; https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2022-42904.html
CVE: CVE-2022-44641
Published: 2022-11-18
Description: In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-776, CWE-776
References: https://lists.debian.org/debian-lts-announce/2023/01/msg00016.html; https://lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY/; https://www.debian.org/security/2023/dsa-5318
CVE: CVE-2022-41880
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. When the `BaseCandidateSamplerOp` function receives a value in `true_classes` larger than `range_max`, a heap oob read occurs. We have patched the issue in GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/candidate_sampler_ops.cc; https://github.com/tensorflow/tensorflow/commit/b389f5c944cadfdfe599b3f1e4026e036f30d2d4; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8w5g-3wcv-9g2j
CVE: CVE-2022-41884
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. We have patched the issue in GitHub commit 2b56169c16e375c521a3bc8ea658811cc0793784. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-670
References: https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636; https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784
CVE: CVE-2022-41885
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-131, CWE-131
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cc; https://github.com/tensorflow/tensorflow/commit/d66e1d568275e6a2947de97dca7a102a211e01ce; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-762h-vpvw-3rcx
CVE: CVE-2022-41886
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-131
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/image_ops.cc; https://github.com/tensorflow/tensorflow/commit/8faa6ea692985dbe6ce10e1a3168e0bd60a723ba; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-54pp-c6pp-7fpx
CVE: CVE-2022-41887
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched the issue in GitHub commit c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1 and 2.9.3, as these are also affected and still in supported range. However, we will not cherrypick this commit into TensorFlow 2.8.x, as it depends on Eigen behavior that changed between 2.8 and 2.9.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-131
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/cwise_ops_common.h; https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/keras/losses.py; https://github.com/tensorflow/tensorflow/commit/c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c
CVE: CVE-2022-41888
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must be of rank 4 but is not checked. We have patched the issue in GitHub commit cf35502463a88ca7185a99daa7031df60b3c1c98. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc; https://github.com/tensorflow/tensorflow/commit/cf35502463a88ca7185a99daa7031df60b3c1c98; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6x99-gv2v-q76v
CVE: CVE-2022-41889
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a `nullptr`, which is not caught. An example can be seen in `tf.compat.v1.extract_volume_patches` by passing in quantized tensors as input `ksizes`. We have patched the issue in GitHub commit e9e95553e5411834d215e6770c81a83a3d0866ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc; https://github.com/tensorflow/tensorflow/commit/e9e95553e5411834d215e6770c81a83a3d0866ce; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xxcj-rhqg-m46g
CVE: CVE-2022-41890
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in `tf.experimental.numpy.outer` by passing in large input to the input `b`. We have patched the issue in GitHub commit 8310bf8dd188ff780e7fc[PII_REDACTED]5a05bdbe5. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-704
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h; https://github.com/tensorflow/tensorflow/commit/8310bf8dd188ff780e7fc[PII_REDACTED]5a05bdbe5; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
CVE: CVE-2022-41891
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit fc33f3dc4c14051a83eec6535b608abe1d355fde. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.h; https://github.com/tensorflow/tensorflow/commit/fc33f3dc4c14051a83eec6535b608abe1d355fde; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-66vq-54fq-6jvv
CVE: CVE-2022-41893
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.cc; https://github.com/tensorflow/tensorflow/commit/888e34b49009a4e734c27ab0c43b0b5102682c56; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-67pf-62xr-q35m
CVE: CVE-2022-41894
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. The reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result. Instead of `data_ptr += num_channels;` it should be `data_ptr += output_num_channels;` as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if num_channels > output_num_channels. An attacker can craft a model with a specific number of input channels. It is then possible to write specific values through the bias of the layer outside the bounds of the buffer. This attack only works if the reference kernel resolver is used in the interpreter. We have patched the issue in GitHub commit 72c0bdcb25305b0b36842d746cc61d72658d2941. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 7.1 (HIGH)
CWE: CWE-120
References: https://github.com/tensorflow/tensorflow/blob/091e63f0ea33def7ecad661a5ac01dcafbafa90b/tensorflow/lite/kernels/internal/reference/conv3d_transpose.h#L121; https://github.com/tensorflow/tensorflow/commit/72c0bdcb25305b0b36842d746cc61d72658d2941; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6q3-vv32-2cq5
CVE: CVE-2022-41895
Published: 2022-11-18
Description: TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We have patched the issue in GitHub commit 717ca98d8c3bba348ff62281fdf38dcb5ea1ec92. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc; https://github.com/tensorflow/tensorflow/commit/717ca98d8c3bba348ff62281fdf38dcb5ea1ec92; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gq2j-cr96-gvqx