deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-21056
Published: 2023-03-24
Description: In lwis_slc_buffer_free of lwis_device_slc.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-245300559References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21057
Published: 2023-03-24
Description: In ProfSixDecomTcpSACKoption of RohcPacketCommon, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-244450646References: N/A
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21058
Published: 2023-03-24
Description: In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-246169606References: N/A
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21059
Published: 2023-03-24
Description: In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-247564044References: N/A
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21060
Published: 2023-03-24
Description: In sms_GetTpPiIe of sms_PduCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-253770924References: N/A
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21061
Published: 2023-03-24
Description: Product: AndroidVersions: Android kernelAndroid ID: A-229255400References: N/A
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21062
Published: 2023-03-24
Description: In DoSetTempEcc of imsservice.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243376770References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21063
Published: 2023-03-24
Description: In ParseWithAuthType of simdata.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243129862References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21064
Published: 2023-03-24
Description: In DoSetPinControl of miscservice.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243130078References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21065
Published: 2023-03-24
Description: In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630493References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21067
Published: 2023-03-24
Description: Product: AndroidVersions: Android kernelAndroid ID: A-254114726References: N/A
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21068
Published: 2023-03-24
Description: In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. This could lead to local escalation of privilege after preparing the device, hiding the warning, and passing the phone to a new user, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243433344References: N/A
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21069
Published: 2023-03-24
Description: In wl_update_hidden_ap_ie of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254029309References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21070
Published: 2023-03-24
Description: In add_roam_cache_list of wl_roam.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254028776References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21071
Published: 2023-03-24
Description: In dhd_prot_ioctcmplt_process of dhd_msgbuf.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254028518References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21072
Published: 2023-03-24
Description: In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257290781References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21073
Published: 2023-03-24
Description: In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257290396References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21075
Published: 2023-03-24
Description: In get_svc_hash of nan.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-261857862References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21076
Published: 2023-03-24
Description: In createTransmitFollowupRequest of nan.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-261857623References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21077
Published: 2023-03-24
Description: In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257289560References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21078
Published: 2023-03-24
Description: In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254840211References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-21079
Published: 2023-03-24
Description: In rtt_unpack_xtlv_cbfn of dhd_rtt.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-254839721References: N/A
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://source.android.com/security/bulletin/pixel/2023-03-01; https://source.android.com/security/bulletin/pixel/2023-03-01
CVE: CVE-2023-22812
Published: 2023-03-24
Description: SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromising confidentiality and integrity of data. 

CVSS Score: 7.4 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.westerndigital.com/support/product-security/wdc-23005-sandisk-privateaccess-software-update; https://www.westerndigital.com/support/product-security/wdc-23005-sandisk-privateaccess-software-update
CVE: CVE-2023-25350
Published: 2023-03-24
Description: Faveo Helpdesk 1.0-1.11.1 is vulnerable to SQL Injection. When the user logs in through the login box, he has no judgment on the validity of the user's input data. The parameters passed from the front end to the back end are controllable, which will lead to SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://gist.github.com/Whitehat-Su/8402323c00ea93b4abc21ab9a372101e; https://github.com/ladybirdweb/faveo-helpdesk/issues/7827; https://gist.github.com/Whitehat-Su/8402323c00ea93b4abc21ab9a372101e
CVE: CVE-2023-28151
Published: 2023-03-24
Description: An issue was discovered in Independentsoft JSpreadsheet before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28151; https://excellium-services.com/cert-xlm-advisory/CVE-2023-28151; https://www.independentsoft.de/jword/index.html
CVE: CVE-2023-28444
Published: 2023-03-24
Description: angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory.
During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file). With version 15.0.0 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html. This has NO IMPACT, in a plain Angular project that has no backend component. This vulnerability has been mitigated in version 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default. As a workaround, manually edit or create ngssc.json or run script after ngssc.json generation.

CVSS Score: 9.9 (CRITICAL)
CWE: CWE-200, CWE-538, CWE-200
References: https://github.com/kyubisation/angular-server-side-configuration/commit/d701f51260637a84ede278e248934e0437a7ff86; https://github.com/kyubisation/angular-server-side-configuration/releases/tag/v15.1.0; https://github.com/kyubisation/angular-server-side-configuration/security/advisories/GHSA-gwvm-vrp4-4pp5
CVE: CVE-2023-28446
Published: 2023-03-24
Description: Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text. This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run. This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). This issue has been patched in version 1.31.2.

CVSS Score: 8.8 (HIGH)
CWE: CWE-150
References: https://github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/js/40_process.js#L175; https://github.com/denoland/deno/releases/tag/v1.31.2; https://github.com/denoland/deno/security/advisories/GHSA-vq67-rp93-65qf
CVE: CVE-2023-28448
Published: 2023-03-24
Description: Versionize is a framework for version tolerant serializion/deserialization of Rust data structures, designed for usecases that need fast deserialization times and minimal size overhead. An issue was discovered in the ‘Versionize::deserialize’ implementation provided by the ‘versionize’ crate for ‘vmm_sys_utils::fam::FamStructWrapper', which can lead to out of bounds memory accesses. The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/firecracker-microvm/versionize/commit/a57a051ba006cfa3b41a0532f484df759e008d47; https://github.com/firecracker-microvm/versionize/pull/53; https://github.com/firecracker-microvm/versionize/security/advisories/GHSA-8vxc-r5wp-vgvc
CVE: CVE-2023-28435
Published: 2023-03-24
Description: Dataease is an open source data visualization and analysis tool. The permissions for the file upload interface is not checked so users who are not logged in can upload directly to the background. The file type also goes unchecked, users could upload any type of file. These vulnerabilities has been fixed in version 1.18.5.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/dataease/dataease/issues/4798; https://github.com/dataease/dataease/security/advisories/GHSA-625h-q3g9-rffc; https://github.com/dataease/dataease/issues/4798
CVE: CVE-2023-1583
Published: 2023-03-24
Description: A NULL pointer dereference was found in io_file_bitmap_get in io_uring/filetable.c in the io_uring sub-component in the Linux Kernel. When fixed files are unregistered, some context information (file_alloc_{start,end} and alloc_hint) is not cleared. A subsequent request that has auto index selection enabled via IORING_FILE_INDEX_ALLOC can cause a NULL pointer dereference. An unprivileged user can use the flaw to cause a system crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=02a4d923e4400a36d340ea12d8058f69ebf3a383; https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git/commit/?h=io_uring-6.3&id=761efd55a0227aca3a69deacdaa112fffd44fe37; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=02a4d923e4400a36d340ea12d8058f69ebf3a383
CVE: CVE-2023-26864
Published: 2023-03-24
Description: SQL injection vulnerability found in PrestaShop smplredirectionsmanager v.1.1.19 and before allow a remote attacker to gain privileges via the SmplTools::getMatchingRedirectionsFromPartscomponent.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://friends-of-presta.github.io/security-advisories/modules/2023/01/17/smplredirectionsmanager.html; https://friends-of-presta.github.io/security-advisories/modules/2023/01/17/smplredirectionsmanager.html
CVE: CVE-2023-27055
Published: 2023-03-24
Description: Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/StolidWaffle/AVer-PTZApp2; https://github.com/StolidWaffle/AVer-PTZApp2
CVE: CVE-2023-28150
Published: 2023-03-24
Description: An issue was discovered in Independentsoft JODF before 1.1.110. The API is prone to XML external entity (XXE) injection via a remote DTD in a DOCX file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2023-28150; https://excellium-services.com/cert-xlm-advisory/CVE-2023-28150; https://www.independentsoft.de/jword/index.html
CVE: CVE-2022-45597
Published: 2023-03-24
Description: ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability because the report is only about use of certificates at the application layer (not the transport layer) and "Certificates are exchanged in a controlled fashion between entities within a trust relationship. This is why self-signed certificates may be used and why validating certificates isn’t as important as doing so for the transport layer certificates."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: http://componentspace.com; http://componentspacesaml2.com; https://www.componentspace.com/documentation/saml-for-asp-net-core/ComponentSpace%20SAML%20for%20ASP.NET%20Core%20Release%20Notes.pdf
CVE: CVE-2023-23149
Published: 2023-03-24
Description: DEK-1705 <=Firmware:34.23.1 device was discovered to have a command execution vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://gist.github.com/yinfei6/5430dc75683c642b7dc09e61c21a4ef4; https://gist.github.com/yinfei6/5430dc75683c642b7dc09e61c21a4ef4
CVE: CVE-2023-27042
Published: 2023-03-24
Description: Tenda AX3 V16.03.12.11 is vulnerable to Buffer Overflow via /goform/SetFirewallCfg.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/hujianjie123/vuln/blob/main/Tenda/SetFirewallCfg/readme.md; https://github.com/hujianjie123/vuln/blob/main/Tenda/SetFirewallCfg/readme.md
CVE: CVE-2023-25658
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, an out of bounds read is in GRUBlockCellGrad. A fix is included in TensorFlow 2.12.0 and 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/commit/ff459137c2716a2a60f7d441b855fcb466d778cb; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-68v3-g9cm-rmm6; https://github.com/tensorflow/tensorflow/commit/ff459137c2716a2a60f7d441b855fcb466d778cb
CVE: CVE-2023-25659
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the parameter `indices` for `DynamicStitch` does not match the shape of the parameter `data`, it can trigger an stack OOB read. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/commit/ee004b18b976eeb5a758020af8880236cd707d05; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-93vr-9q9m-pj8p; https://github.com/tensorflow/tensorflow/commit/ee004b18b976eeb5a758020af8880236cd707d05
CVE: CVE-2023-25660
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/tensorflow/tensorflow/commit/6d423b8bcc9aa9f5554dc988c1c16d038b508df1; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qjqc-vqcf-5qvj; https://github.com/tensorflow/tensorflow/commit/6d423b8bcc9aa9f5554dc988c1c16d038b508df1
CVE: CVE-2023-25662
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 are vulnerable to integer overflow in EditDistance. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/commit/08b8e18643d6dcde00890733b270ff8d9960c56c; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw; https://github.com/tensorflow/tensorflow/commit/08b8e18643d6dcde00890733b270ff8d9960c56c
CVE: CVE-2023-25663
Published: 2023-03-25
Description: TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when `ctx->step_containter()` is a null ptr, the Lookup function will be executed with a null pointer. A fix is included in TensorFlow 2.12.0 and 2.11.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/tensorflow/tensorflow/commit/239139d2ae6a81ae9ba499ad78b56d9b2931538a; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-64jg-wjww-7c5w; https://github.com/tensorflow/tensorflow/commit/239139d2ae6a81ae9ba499ad78b56d9b2931538a