deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-38989
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38990
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38991
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38992
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38993
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38994
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38995
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38996
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect system availability.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38997
Published: 2022-09-16
Description: The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect data confidentiality.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38999
Published: 2022-09-16
Description: The AOD module has the improper update of reference count vulnerability. Successful exploitation of this vulnerability may affect data integrity, confidentiality, and availability.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39000
Published: 2022-09-16
Description: The iAware module has a vulnerability in managing malicious apps.Successful exploitation of this vulnerability will cause malicious apps to automatically start upon system startup.
CVSS Score: 9.8 (CRITICAL)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39001
Published: 2022-09-16
Description: The number identification module has a path traversal vulnerability. Successful exploitation of this vulnerability may cause data disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39002
Published: 2022-09-16
Description: Double free vulnerability in the storage module. Successful exploitation of this vulnerability will cause the memory to be freed twice.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39003
Published: 2022-09-16
Description: Buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability will affect the confidentiality and integrity of trusted components.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-120
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39004
Published: 2022-09-16
Description: The MPTCP module has the memory leak vulnerability. Successful exploitation of this vulnerability can cause memory leaks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39005
Published: 2022-09-16
Description: The MPTCP module has the memory leak vulnerability. Successful exploitation of this vulnerability can cause memory leaks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39006
Published: 2022-09-16
Description: The MPTCP module has the race condition vulnerability. Successful exploitation of this vulnerability may cause the device to restart.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39007
Published: 2022-09-16
Description: The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39008
Published: 2022-09-16
Description: The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39009
Published: 2022-09-16
Description: The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-39010
Published: 2022-09-16
Description: The HwChrService module has a vulnerability in permission control. Successful exploitation of this vulnerability may cause disclosure of user network information.
CVSS Score: 7.5 (HIGH)
References: https://consumer.huawei.com/en/support/bulletin/2022/9/; https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202209-[PII_REDACTED]; https://consumer.huawei.com/en/support/bulletin/2022/9/
CVE: CVE-2022-38621
Published: 2022-09-16
Description: Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/Doufox/Doufox/issues/7; https://github.com/Doufox/Doufox/issues/7
CVE: CVE-2022-39063
Published: 2022-09-16
Description: When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Response. Once UPF receives a request, it gets the f_teid_len from incoming message, and then uses it to copy data from incoming message to struct f_teid without checking the maximum length. If the pdi.local_f_teid.len exceeds the maximum length of the struct of f_teid, the memcpy() overwrites the fields (e.g., f_teid_len) after f_teid in the pdr struct. After parsing the request, the UPF starts to build a response. The f_teid_len with its overwritten value is used as a length for memcpy(). A segmentation fault occurs, as a result of a memcpy(), if this overwritten value is large enough.
CVSS Score: 7.5 (HIGH)
CWE: CWE-676
References: https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/; https://www.synopsys.com/blogs/software-security/cyrc-advisory-open5gs/
CVE: CVE-2022-3214
Published: 2022-09-16
Description: Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to 

1.9.03.009

 have this vulnerability. Executable files could be uploaded to certain directories using hard-coded bearer authorization, allowing remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-03; https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-03
CVE: CVE-2020-25491
Published: 2022-09-16
Description: 6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting (XSS) via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/mhmtayberk/969add4b6c77f122a3a3a0cb00e2975b; https://gist.github.com/mhmtayberk/969add4b6c77f122a3a3a0cb00e2975b
CVE: CVE-2022-35934
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor. This issue has been patched in GitHub commit 61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4w6-h4f5-wx45; https://github.com/tensorflow/tensorflow/commit/61f0f9b94df8c0411f0ad0ecc2fec2d3f3c33555
CVE: CVE-2022-35935
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by assuming `input(0)`, `input(1)`, and `input(2)` to be scalar. This issue has been patched in GitHub commit c65c67f88ad770662e8f191269a907bf2b94b1bf. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-97p7-w86h-vcf9; https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf
CVE: CVE-2022-35937
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. This issue has been patched in GitHub commit 595a65a3e224a0362d7e68c2213acfc2b499a196. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 7.0 (HIGH)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/blob/f463040eb3997e42e60a2ffc6dc72de7ef11dbb4/tensorflow/lite/kernels/gather_nd.cc#L105-L111; https://github.com/tensorflow/tensorflow/commit/595a65a3e224a0362d7e68c2213acfc2b499a196; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pxrw-j2fv-hx3h
CVE: CVE-2022-35938
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been patched in GitHub commit 4142e47e9e31db481781b955ed3ff807a781b494. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 7.0 (HIGH)
CWE: CWE-125
References: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3m3g-pf5v-5hpj; https://github.com/tensorflow/tflite-micro/blob/1bc98621180a350eb4e8d3318ea8e228c7559b37/tensorflow/lite/micro/kernels/gather_nd.cc#L143-L154; https://github.com/tensorflow/tflite-micro/commit/4142e47e9e31db481781b955ed3ff807a781b494
CVE: CVE-2022-35939
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have patched the issue in GitHub commit b4d4b4cb019bd7240a52daa4ba61e3cc814f0384. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://github.com/tensorflow/tensorflow/blob/266558ac4c1f361e9a178ee9d3f0ce2e648ae499/tensorflow/lite/kernels/internal/reference/reference_ops.h#L659-L698; https://github.com/tensorflow/tensorflow/commit/b4d4b4cb019bd7240a52daa4ba61e3cc814f0384; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ffjm-4qwc-7cmf
CVE: CVE-2022-35940
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used to construct a `TensorShape` as an `int64`. If `limits` is a very large float, it can overflow when converted to an `int64`. This triggers an `InvalidArgument` but also throws an abort signal that crashes the program. We have patched the issue in GitHub commit 37cefa91bee4eace55715eeef43720b958a01192. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/kernels/ragged_range_op.cc#L74-L88; https://github.com/tensorflow/tensorflow/commit/37cefa91bee4eace55715eeef43720b958a01192; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-x989-q2pq-4q5x
CVE: CVE-2022-35941
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The `AvgPoolOp` function takes an argument `ksize` that must be positive but is not checked. A negative `ksize` can trigger a `CHECK` failure and crash the program. We have patched the issue in GitHub commit 3a6ac52664c6c095aa2b114e742b0aa17fdce78f. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds to this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/avgpooling_op.cc#L56-L98; https://github.com/tensorflow/tensorflow/commit/3a6ac52664c6c095aa2b114e742b0aa17fdce78f; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mgmh-g2v6-mqw5
CVE: CVE-2022-35952
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The `UnbatchGradOp` function takes an argument `id` that is assumed to be a scalar. A nonscalar `id` can trigger a `CHECK` failure and crash the program. It also requires its argument `batch_index` to contain three times the number of elements as indicated in its `batch_index.dim_size(0)`. An incorrect `batch_index` can trigger a `CHECK` failure and crash the program. We have patched the issue in GitHub commit 5f945fc6409a3c1e90d6970c9292f805f6e6ddf2. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/tensorflow/tensorflow/blob/769eddaf479c8debead9a59a72617d6ed6f0fe10/tensorflow/core/kernels/batch_kernels.cc#L891; https://github.com/tensorflow/tensorflow/commit/5f945fc6409a3c1e90d6970c9292f805f6e6ddf2; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h5vq-gw2c-pq47
CVE: CVE-2022-35959
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The implementation of `AvgPool3DGradOp` does not fully validate the input `orig_input_shape`. This results in an overflow that results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 9178ac9d6389bdc54638ab913ea0e419234d14eb. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/commit/9178ac9d6389bdc54638ab913ea0e419234d14eb; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wxjj-cgcx-r3vq; https://github.com/tensorflow/tensorflow/commit/9178ac9d6389bdc54638ab913ea0e419234d14eb
CVE: CVE-2022-35960
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. In `core/kernels/list_kernels.cc's TensorListReserve`, `num_elements` is assumed to be a tensor of size 1. When a `num_elements` of more than 1 element is provided, then `tf.raw_ops.TensorListReserve` fails the `CHECK_EQ` in `CheckIsAlignedAndSingleElement`. We have patched the issue in GitHub commit b5f6fbfba76576202b[PII_REDACTED]1e3bd4f179c7. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/blob/c8ba76d48567aed347508e0552a[PII_REDACTED]24d/tensorflow/core/kernels/list_kernels.cc#L322-L325; https://github.com/tensorflow/tensorflow/commit/b5f6fbfba76576202b[PII_REDACTED]1e3bd4f179c7; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-v5xg-3q2c-c2r4
CVE: CVE-2022-35963
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The implementation of `FractionalAvgPoolGrad` does not fully validate the input `orig_input_tensor_shape`. This results in an overflow that results in a `CHECK` failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 03a659d7be9a1154fdf5eeac221e5950fec07dad. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/commit/03a659d7be9a1154fdf5eeac221e5950fec07dad; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-84jm-4cf3-9jfm; https://github.com/tensorflow/tensorflow/commit/03a659d7be9a1154fdf5eeac221e5950fec07dad
CVE: CVE-2022-38611
Published: 2022-09-16
Description: Incorrect access control in Watchdog Anti-Virus v1.4.158 allows attackers to perform a DLL hijacking attack and execute arbitrary code via a crafted binary.
CVSS Score: 7.8 (HIGH)
References: https://gist.github.com/dru1d-foofus/835423de77c3522d53b9e7bdf5a28dfe; https://gist.github.com/dru1d-foofus/835423de77c3522d53b9e7bdf5a28dfe
CVE: CVE-2022-35964
Published: 2022-09-16
Description: TensorFlow is an open source platform for machine learning. The implementation of `BlockLSTMGradV2` does not fully validate its inputs. This results in a a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 2a458fc4866505be27c62f81474ecb2b870498fa. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://github.com/tensorflow/tensorflow/commit/2a458fc4866505be27c62f81474ecb2b870498fa; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f7r5-q7cx-h668; https://github.com/tensorflow/tensorflow/commit/2a458fc4866505be27c62f81474ecb2b870498fa