deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-16211
Published: 2020-09-25
Description: Brocade SANnav versions before v2.1.0, contain a Plaintext Password Storage vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1076; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1076
CVE: CVE-2019-16212
Published: 2020-09-25
Description: A vulnerability in Brocade SANnav versions before v2.1.0 could allow a remote authenticated attacker to conduct an LDAP injection. The vulnerability could allow a remote attacker to bypass the authentication process.
CVSS Score: 8.8 (HIGH)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1074; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1074
CVE: CVE-2020-15369
Published: 2020-09-25
Description: Supportlink CLI in Brocade Fabric OS Versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c does not obfuscate the password field, which could expose users’ credentials of the remote server. An authenticated user could obtain the exposed password credentials to gain access to the remote host.
CVSS Score: 8.8 (HIGH)
CWE: CWE-521
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1078; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1078
CVE: CVE-2020-15370
Published: 2020-09-25
Description: Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerability is due to incorrectly logging the user password in log files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1079; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1079
CVE: CVE-2020-15371
Published: 2020-09-25
Description: Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CBN3, contains code injection and privilege escalation vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1080; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1080
CVE: CVE-2020-15372
Published: 2020-09-25
Description: A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local authenticated attacker to modify shell variables, which may lead to an escalation of privileges or bypassing the logging.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-913
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1081; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1081
CVE: CVE-2020-15373
Published: 2020-09-25
Description: Multiple buffer overflow vulnerabilities in REST API in Brocade Fabric OS versions v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c could allow remote unauthenticated attackers to perform various attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1082; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1082
CVE: CVE-2020-15374
Published: 2020-09-25
Description: Rest API in Brocade Fabric OS v8.2.1 through v8.2.1d, and 8.2.2 versions before v8.2.2c is vulnerable to multiple instances of reflected input.
CVSS Score: 9.8 (CRITICAL)
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1084; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2020-1084
CVE: CVE-2020-25130
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL Injection sanitization. Authenticated users are able to inject malicious SQL queries. This vulnerability leads to full database leak including ckeys that can be used in the authentication process without knowing the username and cleartext password. This can occur via the ajax/actions.php group_id field.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/mariuszpoplawski/243d1e7c07adc736bae8069fe831745c; https://gist.github.com/mariuszpoplawski/243d1e7c07adc736bae8069fe831745c
CVE: CVE-2020-25131
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the role_name or role_descr parameter to the roles/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/mariuszpoplawski/9eab675bdafb7974d0114578f1ec1845; https://gist.github.com/mariuszpoplawski/9eab675bdafb7974d0114578f1ec1845
CVE: CVE-2020-5929
Published: 2020-09-25
Description: In versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium Nitrox SSL hardware acceleration cards, a Virtual Server configured with a Client SSL profile, and using Anonymous (ADH) or Ephemeral (DHE) Diffie-Hellman key exchange and Single DH use option not enabled in the options list may be vulnerable to crafted SSL/TLS Handshakes that may result with a PMS (Pre-Master Secret) that starts in a 0 byte and may lead to a recovery of plaintext messages as BIG-IP TLS/SSL ADH/DHE sends different error messages acting as an oracle. Similar error messages when PMS starts with 0 byte coupled with very precise timing measurement observation may also expose this vulnerability.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://support.f5.com/csp/article/K91158923; https://support.f5.com/csp/article/K91158923
CVE: CVE-2020-5930
Published: 2020-09-25
Description: In BIG-IP 15.0.0-15.1.0.4, 14.1.0-14.1.2.7, 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 and BIG-IQ 5.2.0-7.1.0, unauthenticated attackers can cause disruption of service via undisclosed methods.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K20622530; https://support.f5.com/csp/article/K20622530
CVE: CVE-2020-19450
Published: 2020-09-25
Description: SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com_jdownloads/helpers/jdownloadshelper.php, getUserLimits function in the list parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.cnvd.org.cn/flaw/show/CNVD-2019-09869; http://www.cnvd.org.cn/flaw/show/CNVD-2019-09869
CVE: CVE-2020-19451
Published: 2020-09-25
Description: SQL injection exists in the jdownloads 3.2.63 component for Joomla! via com_jdownloads/helpers/jdownloadshelper.php, updateLog function via the X-forwarded-for Header parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.cnvd.org.cn/flaw/show/CNVD-2019-09871; http://www.cnvd.org.cn/flaw/show/CNVD-2019-09871
CVE: CVE-2020-25132
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injection sanitization. Users are able to inject malicious statements in multiple functions. This vulnerability leads to full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability. This can occur via the Cookie header to the default URI, within includes/authenticate.inc.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/mariuszpoplawski/e70bc0afe5853e283d3fd3511a1ce09d; https://gist.github.com/mariuszpoplawski/e70bc0afe5853e283d3fd3511a1ce09d
CVE: CVE-2020-25133
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /ports/?format=../ URIs to pages/ports.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://gist.github.com/mariuszpoplawski/e9796c9d83e820302ea2ffec5ff9b298; https://gist.github.com/mariuszpoplawski/e9796c9d83e820302ea2ffec5ff9b298
CVE: CVE-2020-25134
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /settings/?format=../ URIs to pages/settings.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://gist.github.com/mariuszpoplawski/a3d18fc3d7113cf9c004161ebd9420c9; https://gist.github.com/mariuszpoplawski/a3d18fc3d7113cf9c004161ebd9420c9
CVE: CVE-2020-25135
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the graph_title parameter to the graphs/ URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/mariuszpoplawski/9eb94a617a7193c6d3b455f5348bcc1e; https://gist.github.com/mariuszpoplawski/9eb94a617a7193c6d3b455f5348bcc1e
CVE: CVE-2020-25136
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=routing&proto=../ URIs to device/routing.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://gist.github.com/mariuszpoplawski/5ae335a080ba40996d[PII_REDACTED]e02f; https://gist.github.com/mariuszpoplawski/5ae335a080ba40996d[PII_REDACTED]e02f
CVE: CVE-2020-19455
Published: 2020-09-25
Description: SQL injection exists in the jdownloads 3.2.63 component for Joomla! via components/com_jdownloads/helpers/categories.php, order function via the filter_order parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.cnvd.org.cn/flaw/show/CNVD-2019-09868; http://www.cnvd.org.cn/flaw/show/CNVD-2019-09868
CVE: CVE-2020-25137
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the alert_name or alert_message parameter to the /alert_check URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/mariuszpoplawski/015b605a9bd31f43a8080a105c4312a8; https://gist.github.com/mariuszpoplawski/015b605a9bd31f43a8080a105c4312a8
CVE: CVE-2020-25138
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alert_check/action=delete_alert_checker/alert_test_id= because of pages/alert_check.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/mariuszpoplawski/bfb6dea73586dbb668d280d412ecb6d8; https://gist.github.com/mariuszpoplawski/bfb6dea73586dbb668d280d412ecb6d8
CVE: CVE-2020-25139
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for delete_syslog_rule, because of syslog_rules.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/mariuszpoplawski/1e7526027aec7a89e78950e5e57d007d; https://gist.github.com/mariuszpoplawski/1e7526027aec7a89e78950e5e57d007d
CVE: CVE-2020-25140
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur in pages/contacts.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://docs.observium.org/changelog/; https://docs.observium.org/changelog/
CVE: CVE-2020-4531
Published: 2020-09-25
Description: IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 182715.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-252
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182715; https://www.ibm.com/support/pages/node/6336935; https://exchange.xforce.ibmcloud.com/vulnerabilities/182715
CVE: CVE-2020-4727
Published: 2020-09-25
Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187976; https://www.ibm.com/support/pages/node/6336897; https://exchange.xforce.ibmcloud.com/vulnerabilities/187976
CVE: CVE-2020-14495
Published: 2020-09-25
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-16242
Published: 2020-09-25
Description: The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02
CVE: CVE-2020-25141
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via a /device/device=140/tab=wifi/view= URI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/ahpaleus/da50a83eb286cc64ddffa4a0aa9adda5; https://gist.github.com/ahpaleus/da50a83eb286cc64ddffa4a0aa9adda5
CVE: CVE-2020-25142
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable if any links and forms lack an unpredictable CSRF token. Without such a token, attackers can forge malicious requests, such as for adding Device Settings via the /addsrv URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/ahpaleus/76aa81ec82644a89c2088ab3ea99f07c; https://gist.github.com/ahpaleus/76aa81ec82644a89c2088ab3ea99f07c
CVE: CVE-2020-25143
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via /ajax/device_entities.php?entity_type=netscalervsvr&device_id[]= because of /ajax/device_entities.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/ahpaleus/e[PII_REDACTED]1ce52616967ba9ec63820; https://gist.github.com/ahpaleus/e[PII_REDACTED]1ce52616967ba9ec63820
CVE: CVE-2020-25144
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /apps/?app=../ URIs.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://gist.github.com/ahpaleus/f2843deea7f90e5b371e5c0370fb7775; https://gist.github.com/ahpaleus/f2843deea7f90e5b371e5c0370fb7775
CVE: CVE-2020-25145
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=ports&view=../ URIs because of device/port.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://gist.github.com/ahpaleus/578186667e18607bb37bab9b0f66ad99; https://gist.github.com/ahpaleus/578186667e18607bb37bab9b0f66ad99
CVE: CVE-2020-25146
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for edit_syslog_rule.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/ahpaleus/7f6360e112e79539feb166660bbb7193; https://gist.github.com/ahpaleus/7f6360e112e79539feb166660bbb7193
CVE: CVE-2020-25147
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username[0] to the default URI, because of includes/authenticate.inc.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/ahpaleus/c9ee1108d146a94470f191fc423bee10; https://gist.github.com/ahpaleus/c9ee1108d146a94470f191fc423bee10
CVE: CVE-2020-25148
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. this can occur via /iftype/type= because of pages/iftype.inc.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/ahpaleus/fde01d1a944fe237010a1e524dd19180; https://gist.github.com/ahpaleus/fde01d1a944fe237010a1e524dd19180
CVE: CVE-2020-25149
Published: 2020-09-25
Description: An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=health&metric=../ because of device/health.inc.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-434
References: https://gist.github.com/ahpaleus/cfa6dd1c3bf6924b268f1ca38198b40d; https://gist.github.com/ahpaleus/cfa6dd1c3bf6924b268f1ca38198b40d
CVE: CVE-2020-15190
Published: 2020-09-25
Description: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-476, CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html; https://github.com/tensorflow/tensorflow/commit/da8558533d925694483d2c136a9220d6d49d843c; https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
CVE: CVE-2020-15191
Published: 2020-09-25
Description: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind to `nullptr` while setting a `status` variable to the error condition. However, this `status` argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-476, CWE-252
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html; https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8; https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1
CVE: CVE-2020-15192
Published: 2020-09-25
Description: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure. The issue occurs because the `status` argument during validation failures is not properly checked. Since each of the above methods can return an error status, the `status` value must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html; https://github.com/tensorflow/tensorflow/commit/22e07fb204386768e5bcbea563641ea11f96ceb8; https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1