Common Weakness Enumeration
CWE-681
AllowedIncorrect Conversion between Numeric Types
Abstraction: Base · Status: Draft
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
163 vulnerabilities reference this CWE, most recent first.
GHSA-V3VX-GXFC-R83R
Vulnerability from github – Published: 2024-07-09 18:30 – Updated: 2024-07-09 18:30
VLAI
Details
DHCP Server Service Remote Code Execution Vulnerability
Severity
7.2 (High)
{
"affected": [],
"aliases": [
"CVE-2024-38044"
],
"database_specific": {
"cwe_ids": [
"CWE-197",
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-09T17:15:32Z",
"severity": "HIGH"
},
"details": "DHCP Server Service Remote Code Execution Vulnerability",
"id": "GHSA-v3vx-gxfc-r83r",
"modified": "2024-07-09T18:30:51Z",
"published": "2024-07-09T18:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38044"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38044"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VMJW-C2VP-P33C
Vulnerability from github – Published: 2021-08-25 14:42 – Updated: 2024-11-13 21:00
VLAI
Summary
Crash in NMS ops caused by integer conversion to unsigned
Details
Impact
An attacker can cause denial of service in applications serving models using tf.raw_ops.NonMaxSuppressionV5 by triggering a division by 0:
import tensorflow as tf
tf.raw_ops.NonMaxSuppressionV5(
boxes=[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],
scores=[1.0,2.0,3.0],
max_output_size=-1,
iou_threshold=0.5,
score_threshold=0.5,
soft_nms_sigma=1.0,
pad_to_max_output_size=True)
The implementation uses a user controlled argument to resize a std::vector:
const int output_size = max_output_size.scalar<int>()();
// ...
std::vector<int> selected;
// ...
if (pad_to_max_output_size) {
selected.resize(output_size, 0);
// ...
}
However, as std::vector::resize takes the size argument as a size_t and output_size is an int, there is an implicit conversion to usigned. If the attacker supplies a negative value, this conversion results in a crash.
A similar issue occurs in CombinedNonMaxSuppression:
import tensorflow as tf
tf.raw_ops.NonMaxSuppressionV5(
boxes=[[[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]]]],
scores=[[[1.0,2.0,3.0],[1.0,2.0,3.0],[1.0,2.0,3.0]]],
max_output_size_per_class=-1,
max_total_size=10,
iou_threshold=score_threshold=0.5,
pad_per_class=True,
clip_boxes=True)
Patches
We have patched the issue in GitHub commit 3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d and commit b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0"
]
}
],
"aliases": [
"CVE-2021-37669"
],
"database_specific": {
"cwe_ids": [
"CWE-681"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-24T14:21:16Z",
"nvd_published_at": "2021-08-12T23:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nAn attacker can cause denial of service in applications serving models using `tf.raw_ops.NonMaxSuppressionV5` by triggering a division by 0:\n\n```python\nimport tensorflow as tf\n\ntf.raw_ops.NonMaxSuppressionV5(\n boxes=[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],\n scores=[1.0,2.0,3.0],\n max_output_size=-1,\n iou_threshold=0.5,\n score_threshold=0.5,\n soft_nms_sigma=1.0,\n pad_to_max_output_size=True)\n```\n \nThe [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/image/non_max_suppression_op.cc#L170-L271) uses a user controlled argument to resize a `std::vector`:\n\n```cc\n const int output_size = max_output_size.scalar\u003cint\u003e()();\n // ...\n std::vector\u003cint\u003e selected;\n // ...\n if (pad_to_max_output_size) {\n selected.resize(output_size, 0);\n // ...\n }\n```\n \nHowever, as `std::vector::resize` takes the size argument as a `size_t` and `output_size` is an `int`, there is an implicit conversion to usigned. If the attacker supplies a negative value, this conversion results in a crash.\n\nA similar issue occurs in `CombinedNonMaxSuppression`:\n\n```python\nimport tensorflow as tf\n\ntf.raw_ops.NonMaxSuppressionV5(\n boxes=[[[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]],[[0.1,0.1,0.1,0.1],[0.2,0.2,0.2,0.2],[0.3,0.3,0.3,0.3]]]],\n scores=[[[1.0,2.0,3.0],[1.0,2.0,3.0],[1.0,2.0,3.0]]],\n max_output_size_per_class=-1,\n max_total_size=10,\n iou_threshold=score_threshold=0.5,\n pad_per_class=True,\n clip_boxes=True)\n```\n \n### Patches\nWe have patched the issue in GitHub commit [3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d](https://github.com/tensorflow/tensorflow/commit/3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d) and commit [b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58](https://github.com/tensorflow/tensorflow/commit/b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58).\n\nThe fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.\n\n### For more information \nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.",
"id": "GHSA-vmjw-c2vp-p33c",
"modified": "2024-11-13T21:00:17Z",
"published": "2021-08-25T14:42:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-vmjw-c2vp-p33c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37669"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/3a7362750d5c372420aa8f0caf7bf5b5c3d0f52d"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/b5cdbf12ffcaaffecf98f22a6be5a64bb96e4f58"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-582.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-780.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-291.yaml"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Crash in NMS ops caused by integer conversion to unsigned"
}
GHSA-VVJ7-W55J-XGMW
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2026-10-14 12:31
VLAI
Details
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-27218"
],
"database_specific": {
"cwe_ids": [
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-15T17:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.",
"id": "GHSA-vvj7-w55j-xgmw",
"modified": "2026-10-14T12:31:17Z",
"published": "2022-05-24T17:42:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27218"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210319-0004"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202107-13"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JJMPNDO4GDVURYQFYKFOWY5HAF4FTEPN"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2REA7RVKN7ZHRLJOEGBRQKJIPZQPAELZ"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1944"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/1942"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W33C-445M-F8W7
Vulnerability from github – Published: 2023-07-12 21:30 – Updated: 2023-07-13 17:01
VLAI
Summary
Okio Signed to Unsigned Conversion Error vulnerability
Details
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup.okio:okio"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-RC1"
},
{
"fixed": "3.4.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup.okio:okio"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.squareup.okio:okio-jvm"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0-RC1"
},
{
"fixed": "3.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-3635"
],
"database_specific": {
"cwe_ids": [
"CWE-195",
"CWE-681"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-13T17:01:48Z",
"nvd_published_at": "2023-07-12T19:15:08Z",
"severity": "MODERATE"
},
"details": "GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.\n\n",
"id": "GHSA-w33c-445m-f8w7",
"modified": "2023-07-13T17:01:48Z",
"published": "2023-07-12T21:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3635"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/pull/1280"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/pull/1334"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/commit/81bce1a30af244550b0324597720e4799281da7b"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/commit/b4fa875dc24950680c386e4b1c593660ce4f7839"
},
{
"type": "PACKAGE",
"url": "https://github.com/square/okio"
},
{
"type": "WEB",
"url": "https://github.com/square/okio/blob/master/CHANGELOG.md#version-1176"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/okio-gzip-source-unhandled-exception-dos-xray-523195"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Okio Signed to Unsigned Conversion Error vulnerability"
}
GHSA-W6WH-QR7X-H932
Vulnerability from github – Published: 2022-09-02 00:01 – Updated: 2022-09-08 00:00
VLAI
Details
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-2639"
],
"database_specific": {
"cwe_ids": [
"CWE-192",
"CWE-681",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-01T21:15:00Z",
"severity": "HIGH"
},
"details": "An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size() function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This flaw allows a local user to crash or potentially escalate their privileges on the system.",
"id": "GHSA-w6wh-qr7x-h932",
"modified": "2022-09-08T00:00:29Z",
"published": "2022-09-02T00:01:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2639"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/cefa91b2332d7009bc0be5d951d6cbbf349f90f8"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2084479"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WMCQ-6RPV-M375
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-10-15 12:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
bpf: zero extend the result of an arena 32-bit cmpxchg
bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before bpf_opt_subreg_zext_lo32_rnd_hi32().
That pass emits an explicit zero extension for a 32-bit cmpxchg even when bpf_jit_needs_zext() is false. This is done because on some architectures 32-bit cmpxchg requires explicit zero extension for the dst register. E.g. on x86-64 'lock cmpxchg' does not change the %eax if comparison is successful, while BPF semantics declare that each operation on a 32-bit register zero extends it's upper half.
is_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena cmpxchg misses said zero extension adjustment. This patch adjusts is_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-98049"
],
"database_specific": {
"cwe_ids": [
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:33Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: zero extend the result of an arena 32-bit cmpxchg\n\nbpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from\nBPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before\nbpf_opt_subreg_zext_lo32_rnd_hi32().\n\nThat pass emits an explicit zero extension for a 32-bit cmpxchg even\nwhen bpf_jit_needs_zext() is false. This is done because on some\narchitectures 32-bit cmpxchg requires explicit zero extension for the\ndst register. E.g. on x86-64 \u0027lock cmpxchg\u0027 does not change the %eax\nif comparison is successful, while BPF semantics declare that each\noperation on a 32-bit register zero extends it\u0027s upper half.\n\nis_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena\ncmpxchg misses said zero extension adjustment. This patch adjusts\nis_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC.",
"id": "GHSA-wmcq-6rpv-m375",
"modified": "2026-10-15T12:30:54Z",
"published": "2026-09-25T12:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98049"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1c1b476d43a8b6c9bc04600369dd8cc39950d98e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4814ed6406f3493bd554ad046da5f7fc04833571"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6bb6ae5ab1beffda51dabf41612f501d07f10fc6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X379-72WQ-8VWF
Vulnerability from github – Published: 2024-02-06 09:31 – Updated: 2024-02-06 09:31
VLAI
Details
Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.
Severity
6.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-28063"
],
"database_specific": {
"cwe_ids": [
"CWE-195",
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T08:15:46Z",
"severity": "MODERATE"
},
"details": "\nDell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to denial of service.\n\n",
"id": "GHSA-x379-72wq-8vwf",
"modified": "2024-02-06T09:31:38Z",
"published": "2024-02-06T09:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28063"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000214780/dsa-2023-176-dell-client-bios-security-update-for-a-signed-to-unsigned-conversion-error-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X4XQ-7W28-Q486
Vulnerability from github – Published: 2026-04-07 18:31 – Updated: 2026-04-08 15:31
VLAI
Details
Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.
Severity
6.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-4931"
],
"database_specific": {
"cwe_ids": [
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-07T16:16:30Z",
"severity": "MODERATE"
},
"details": "Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settle a large debt position for a negligible asset cost.",
"id": "GHSA-x4xq-7w28-q486",
"modified": "2026-04-08T15:31:43Z",
"published": "2026-04-07T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4931"
},
{
"type": "WEB",
"url": "https://cvefeed.io/cwe/detail/cwe-681-incorrect-conversion-between-numeric-types"
},
{
"type": "WEB",
"url": "https://github.com/MarginalProtocol"
},
{
"type": "WEB",
"url": "https://marginal.gitbook.io/docs"
},
{
"type": "WEB",
"url": "https://medium.com/@clarkcorrin/cve-2026-4931-how-spearbits-cantina-denied-a-critical-vulnerability-using-verifiably-false-0a27b92ac2db"
},
{
"type": "WEB",
"url": "https://scs.owasp.org/SCWE/SCSVS-CODE/SCWE-041"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X7GM-RFGV-W973
Vulnerability from github – Published: 2020-09-28 19:05 – Updated: 2024-09-16 22:10
VLAI
Summary
Potential DoS with NumberFilter conversion to integer values.
Details
Impact
Automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents.
Patches
Version 2.4.0+ applies a MaxValueValidator with a a default limit_value of 1e50 to the form field used by NumberFilter instances.
In addition, NumberFilter implements the new get_max_validator() which should return a configured validator instance to customise the limit, or else None to disable the additional validation.
Workarounds
Users may manually apply an equivalent validator if they are not able to upgrade.
For more information
If you have any questions or comments about this advisory: * Open an issue in the django-filter repo
Thanks to Marcin Waraksa for the report.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django-filter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-15225"
],
"database_specific": {
"cwe_ids": [
"CWE-681"
],
"github_reviewed": true,
"github_reviewed_at": "2020-09-28T19:04:39Z",
"nvd_published_at": "2021-04-29T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nAutomatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. \n\n### Patches\n\nVersion 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. \n\nIn addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. \n\n### Workarounds\n\nUsers may manually apply an equivalent validator if they are not able to upgrade. \n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the django-filter repo](https://github.com/carltongibson/django-filter)\n\nThanks to Marcin Waraksa for the report. \n",
"id": "GHSA-x7gm-rfgv-w973",
"modified": "2024-09-16T22:10:02Z",
"published": "2020-09-28T19:05:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/carltongibson/django-filter/security/advisories/GHSA-x7gm-rfgv-w973"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15225"
},
{
"type": "WEB",
"url": "https://github.com/carltongibson/django-filter/commit/340cf7a23a2b3dcd7183f6a0d6c383e85b130d2b"
},
{
"type": "PACKAGE",
"url": "https://github.com/carltongibson/django-filter"
},
{
"type": "WEB",
"url": "https://github.com/carltongibson/django-filter/releases/tag/2.4.0"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django-filter/PYSEC-2021-64.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPHENTRHRAYFXYPPBT7JRHZRWILRY44S"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FAT2ZAEF6DM3VFSOHKB7X3ASSHGQHJAK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVJ7AYU6FUSU3F653YCGW5LFD3IULRSX"
},
{
"type": "WEB",
"url": "https://pypi.org/project/django-filter"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210604-0010"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Potential DoS with NumberFilter conversion to integer values."
}
GHSA-XHJJ-JG7J-PQRX
Vulnerability from github – Published: 2022-05-01 18:29 – Updated: 2024-02-02 03:30
VLAI
Details
Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2007-4988"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-681"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-09-24T22:17:00Z",
"severity": "MODERATE"
},
"details": "Sign extension error in the ReadDIBImage function in ImageMagick before 6.3.5-9 allows context-dependent attackers to execute arbitrary code via a crafted width value in an image file, which triggers an integer overflow and a heap-based buffer overflow.",
"id": "GHSA-xhjj-jg7j-pqrx",
"modified": "2024-02-02T03:30:31Z",
"published": "2022-05-01T18:29:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4988"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36737"
},
{
"type": "WEB",
"url": "https://issues.rpath.com/browse/RPL-1743"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9656"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=186030"
},
{
"type": "WEB",
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=597"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26926"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27048"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27309"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27364"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27439"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28721"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29786"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36260"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200710-27.xml"
},
{
"type": "WEB",
"url": "http://studio.imagemagick.org/pipermail/magick-announce/2007-September/000037.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1858"
},
{
"type": "WEB",
"url": "http://www.imagemagick.org/script/changelog.php"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:035"
},
{
"type": "WEB",
"url": "http://www.novell.com/linux/security/advisories/2007_23_sr.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0145.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/483572/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25765"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1018729"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-523-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/3245"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Implementation
Avoid making conversion between numeric types. Always check for the allowed ranges.
No CAPEC attack patterns related to this CWE.