https://db.gcve.eu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 24 Jul 2026 11:58:14 +0000 https://db.gcve.eu/sighting/1caff3b3-75e7-4d34-a398-05c1bfc5a4b8/export {"uuid": "1caff3b3-75e7-4d34-a398-05c1bfc5a4b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36011", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13090", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36011\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:30:21.000Z\n\ud83d\udccf Modified: 2025-04-23T16:59:29.191Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fv43-93gv-vm8f\n2. https://github.com/tensorflow/tensorflow/commit/1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b", "creation_timestamp": "2025-04-23T17:05:06.000000Z"} {"uuid": "1caff3b3-75e7-4d34-a398-05c1bfc5a4b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36011", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13090", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36011\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives a null dereference. We have patched the issue in GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:30:21.000Z\n\ud83d\udccf Modified: 2025-04-23T16:59:29.191Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fv43-93gv-vm8f\n2. https://github.com/tensorflow/tensorflow/commit/1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b", "creation_timestamp": "2025-04-23T17:05:06.000000Z"} https://db.gcve.eu/sighting/1caff3b3-75e7-4d34-a398-05c1bfc5a4b8/export Wed, 23 Apr 2025 17:05:06 +0000 https://db.gcve.eu/sighting/ad47cf7e-81dd-49c7-b84f-54d447e1312e/export {"uuid": "ad47cf7e-81dd-49c7-b84f-54d447e1312e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36013", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13089", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36013\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:30:14.000Z\n\ud83d\udccf Modified: 2025-04-23T16:59:35.082Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-828c-5j5q-vrjq\n2. https://github.com/tensorflow/tensorflow/commit/a0f0b9a21c9270930457095092f558fbad4c03e5\n3. https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ir/importexport/graphdef_import.cc", "creation_timestamp": "2025-04-23T17:05:05.000000Z"} {"uuid": "ad47cf7e-81dd-49c7-b84f-54d447e1312e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36013", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13089", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36013\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:30:14.000Z\n\ud83d\udccf Modified: 2025-04-23T16:59:35.082Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-828c-5j5q-vrjq\n2. https://github.com/tensorflow/tensorflow/commit/a0f0b9a21c9270930457095092f558fbad4c03e5\n3. https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ir/importexport/graphdef_import.cc", "creation_timestamp": "2025-04-23T17:05:05.000000Z"} https://db.gcve.eu/sighting/ad47cf7e-81dd-49c7-b84f-54d447e1312e/export Wed, 23 Apr 2025 17:05:05 +0000 https://db.gcve.eu/sighting/580f4e88-b0cc-4db5-9825-495b282fd5d1/export {"uuid": "580f4e88-b0cc-4db5-9825-495b282fd5d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36016", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13080", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36016\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a `FullTypeDef& t` that is not exactly three args, it triggers a `CHECK`-fail instead of returning a status. We have patched the issue in GitHub commit 6104f0d4091c260ce9352f9155f7e9b725eab012. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:10:36.000Z\n\ud83d\udccf Modified: 2025-04-23T17:00:33.911Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g468-qj8g-vcjc\n2. https://github.com/tensorflow/tensorflow/commit/6104f0d4091c260ce9352f9155f7e9b725eab012\n3. https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/math_ops.cc", "creation_timestamp": "2025-04-23T17:04:51.000000Z"} {"uuid": "580f4e88-b0cc-4db5-9825-495b282fd5d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36016", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13080", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36016\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a `FullTypeDef& t` that is not exactly three args, it triggers a `CHECK`-fail instead of returning a status. We have patched the issue in GitHub commit 6104f0d4091c260ce9352f9155f7e9b725eab012. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:10:36.000Z\n\ud83d\udccf Modified: 2025-04-23T17:00:33.911Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g468-qj8g-vcjc\n2. https://github.com/tensorflow/tensorflow/commit/6104f0d4091c260ce9352f9155f7e9b725eab012\n3. https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/math_ops.cc", "creation_timestamp": "2025-04-23T17:04:51.000000Z"} https://db.gcve.eu/sighting/580f4e88-b0cc-4db5-9825-495b282fd5d1/export Wed, 23 Apr 2025 17:04:51 +0000 https://db.gcve.eu/sighting/7da85e6e-7ca2-43cf-a12c-6ff256f6ca78/export {"uuid": "7da85e6e-7ca2-43cf-a12c-6ff256f6ca78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36018", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13073", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36018\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 88f93dfe691563baa4ae1e80ccde2d5c7a143821. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:05:15.000Z\n\ud83d\udccf Modified: 2025-04-23T17:01:17.051Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m6cv-4fmf-66xf\n2. https://github.com/tensorflow/tensorflow/commit/88f93dfe691563baa4ae1e80ccde2d5c7a143821", "creation_timestamp": "2025-04-23T17:04:42.000000Z"} {"uuid": "7da85e6e-7ca2-43cf-a12c-6ff256f6ca78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36018", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13073", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36018\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 88f93dfe691563baa4ae1e80ccde2d5c7a143821. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:05:15.000Z\n\ud83d\udccf Modified: 2025-04-23T17:01:17.051Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m6cv-4fmf-66xf\n2. https://github.com/tensorflow/tensorflow/commit/88f93dfe691563baa4ae1e80ccde2d5c7a143821", "creation_timestamp": "2025-04-23T17:04:42.000000Z"} https://db.gcve.eu/sighting/7da85e6e-7ca2-43cf-a12c-6ff256f6ca78/export Wed, 23 Apr 2025 17:04:42 +0000 https://db.gcve.eu/sighting/5c9914cb-bb30-4d1e-b8e7-c4602c556559/export {"uuid": "5c9914cb-bb30-4d1e-b8e7-c4602c556559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36019", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13072", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36019\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:05:10.000Z\n\ud83d\udccf Modified: 2025-04-23T17:01:22.483Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0\n2. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9j4v-pp28-mxv7", "creation_timestamp": "2025-04-23T17:04:41.000000Z"} {"uuid": "5c9914cb-bb30-4d1e-b8e7-c4602c556559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36019", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13072", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-36019\n\ud83d\udd25 CVSS Score: 5.9 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)\n\ud83d\udd39 Description: TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2022-09-16T22:05:10.000Z\n\ud83d\udccf Modified: 2025-04-23T17:01:22.483Z\n\ud83d\udd17 References:\n1. https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0\n2. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9j4v-pp28-mxv7", "creation_timestamp": "2025-04-23T17:04:41.000000Z"} https://db.gcve.eu/sighting/5c9914cb-bb30-4d1e-b8e7-c4602c556559/export Wed, 23 Apr 2025 17:04:41 +0000 https://db.gcve.eu/sighting/669257fc-dc89-4111-bfe3-24e5b3b58a42/export {"uuid": "669257fc-dc89-4111-bfe3-24e5b3b58a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-3601", "type": "seen", "source": "https://t.me/cibsecurity/53561", "content": "\u203c CVE-2022-3601 \u203c\n\nThe Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-28T16:27:54.000000Z"} {"uuid": "669257fc-dc89-4111-bfe3-24e5b3b58a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-3601", "type": "seen", "source": "https://t.me/cibsecurity/53561", "content": "\u203c CVE-2022-3601 \u203c\n\nThe Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-28T16:27:54.000000Z"} https://db.gcve.eu/sighting/669257fc-dc89-4111-bfe3-24e5b3b58a42/export Mon, 28 Nov 2022 16:27:54 +0000 https://db.gcve.eu/sighting/2cce00f3-8a7e-4b53-ae26-ef3b90d1906e/export {"uuid": "2cce00f3-8a7e-4b53-ae26-ef3b90d1906e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36012", "type": "seen", "source": "https://t.me/cibsecurity/50009", "content": "\u203c CVE-2022-36012 \u203c\n\nTensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it crashes. We have patched the issue in GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-17T02:35:27.000000Z"} {"uuid": "2cce00f3-8a7e-4b53-ae26-ef3b90d1906e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36012", "type": "seen", "source": "https://t.me/cibsecurity/50009", "content": "\u203c CVE-2022-36012 \u203c\n\nTensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it crashes. We have patched the issue in GitHub commit ad069af92392efee1418c48ff561fd3070a03d7b. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-17T02:35:27.000000Z"} https://db.gcve.eu/sighting/2cce00f3-8a7e-4b53-ae26-ef3b90d1906e/export Sat, 17 Sep 2022 02:35:27 +0000 https://db.gcve.eu/sighting/9d310e34-0006-4563-9f09-9f62f45906f6/export {"uuid": "9d310e34-0006-4563-9f09-9f62f45906f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36019", "type": "seen", "source": "https://t.me/cibsecurity/50004", "content": "\u203c CVE-2022-36019 \u203c\n\nTensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-17T02:35:20.000000Z"} {"uuid": "9d310e34-0006-4563-9f09-9f62f45906f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36019", "type": "seen", "source": "https://t.me/cibsecurity/50004", "content": "\u203c CVE-2022-36019 \u203c\n\nTensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-17T02:35:20.000000Z"} https://db.gcve.eu/sighting/9d310e34-0006-4563-9f09-9f62f45906f6/export Sat, 17 Sep 2022 02:35:20 +0000 https://db.gcve.eu/sighting/1a435ab5-9dce-4a2e-9fc4-119219e97f72/export {"uuid": "1a435ab5-9dce-4a2e-9fc4-119219e97f72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36010", "type": "seen", "source": "https://t.me/cibsecurity/48171", "content": "\u203c CVE-2022-36010 \u203c\n\nThis library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js). To do this, Javascript's [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) function is used to execute strings that begin with \"function\" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous. One important note is that users who have defined a custom [`onSubmitValueParser`](https://github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser) callback prop on the [`JsonTree`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/JsonTree.js) component should be ***unaffected***. This vulnerability exists in the default `onSubmitValueParser` prop which calls [`parse`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/master/src/utils/parse.js#L30). Prop is added to `JsonTree` called `allowFunctionEvaluation`. This prop will be set to `true` in v2.2.2, which allows upgrade without losing backwards-compatibility. In v2.2.2, we switched from using `eval` to using [`Function`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) to construct anonymous functions. This is better than `eval` for the following reasons: - Arbitrary code should not be able to execute immediately, since the `Function` constructor explicitly *only creates* anonymous functions - Functions are created without local closures, so they only have access to the global scope If you use: - **Version `<2.2.2`**, you must upgrade as soon as possible. - **Version `^2.2.2`**, you must explicitly set `JsonTree`'s `allowFunctionEvaluation` prop to `false` to fully mitigate this vulnerability. - **Version `>=3.0.0`**, `allowFunctionEvaluation` is already set to `false` by default, so no further steps are necessary.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-15T22:38:04.000000Z"} {"uuid": "1a435ab5-9dce-4a2e-9fc4-119219e97f72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2022-36010", "type": "seen", "source": "https://t.me/cibsecurity/48171", "content": "\u203c CVE-2022-36010 \u203c\n\nThis library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js). To do this, Javascript's [`eval`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval) function is used to execute strings that begin with \"function\" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as a value within the JSON structure being displayed. Given that this component may often be used to display data from arbitrary, untrusted sources, this is extremely dangerous. One important note is that users who have defined a custom [`onSubmitValueParser`](https://github.com/oxyno-zeta/react-editable-json-tree/tree/09a0ca97835b0834ad054563e2fddc6f22bc5d8c#onsubmitvalueparser) callback prop on the [`JsonTree`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/JsonTree.js) component should be ***unaffected***. This vulnerability exists in the default `onSubmitValueParser` prop which calls [`parse`](https://github.com/oxyno-zeta/react-editable-json-tree/blob/master/src/utils/parse.js#L30). Prop is added to `JsonTree` called `allowFunctionEvaluation`. This prop will be set to `true` in v2.2.2, which allows upgrade without losing backwards-compatibility. In v2.2.2, we switched from using `eval` to using [`Function`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function) to construct anonymous functions. This is better than `eval` for the following reasons: - Arbitrary code should not be able to execute immediately, since the `Function` constructor explicitly *only creates* anonymous functions - Functions are created without local closures, so they only have access to the global scope If you use: - **Version `<2.2.2`**, you must upgrade as soon as possible. - **Version `^2.2.2`**, you must explicitly set `JsonTree`'s `allowFunctionEvaluation` prop to `false` to fully mitigate this vulnerability. - **Version `>=3.0.0`**, `allowFunctionEvaluation` is already set to `false` by default, so no further steps are necessary.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-15T22:38:04.000000Z"} https://db.gcve.eu/sighting/1a435ab5-9dce-4a2e-9fc4-119219e97f72/export Mon, 15 Aug 2022 22:38:04 +0000