Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-33510Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.PyPI · plone · fixed in 5.2.5
- CVE-2021-33511Plone though 5.2.4 allows SSRF via the lxml parser.PyPI · plone · fixed in 5.2.5
- CVE-2021-33512Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.PyPI · plone · fixed in 5.2.5
- CVE-2021-33513Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.PyPI · plone · fixed in 5.2.5
- CVE-2021-32633Remote Code Execution via traversal in TAL expressionsPyPI · zope · fixed in 4.6, 5.2
- CVE-2021-3313Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functiPyPI · plone · fixed in 5.2.4
- CVE-2021-32618Open Redirect VulnerabilityPyPI · flask-security-too · fixed in 4.1.0
- CVE-2021-29513Type confusion during tensor casts lead to dereferencing null pointersPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.0rc0, 2.3.0rc0, 2.3.4 and more
- CVE-2021-29514Heap out of bounds write in `RaggedBinCount`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.3, 2.4.2, 2.2.0rc0 and more
- CVE-2021-29515Reference binding to null pointer in `MatrixDiag*` opsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29516Null pointer dereference via invalid Ragged TensorsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29517Division by zero in `Conv3D`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29518Session operations in eager mode lead to null pointer dereferencesPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29519CHECK-fail in SparseCross due to type confusionPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29520Heap buffer overflow in `Conv3DBackprop*`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29521Segfault in SparseCountSparseOutputPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.3, 2.4.2
- CVE-2021-29522Division by 0 in `Conv3DBackprop*`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29523CHECK-fail in AddManySparseToTensorsMapPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29524Division by 0 in `Conv2DBackpropFilter`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29585Division by zero in padding computation in TFLitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29586Division by zero in optimized pooling implementations in TFLitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29615Stack overflow in `ParseAttrValue` with nested tensorsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29616Null dereference in Grappler's `TrySimplify`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.0rc0, 2.3.0rc0, 2.3.4 and more
- CVE-2021-29617Crash in `tf.strings.substr` due to `CHECK`-failPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.2.0rc0, 2.3.0rc0, 2.3.4 and more
- CVE-2021-29618Crash in `tf.transpose` with complex inputsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29619Segfault in `tf.raw_ops.SparseCountSparseOutput`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29587Division by zero in TFLite's implementation of `SpaceToDepth`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29588Division by zero in TFLite's implementation of `TransposeConv`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29589Division by zero in TFLite's implementation of `GatherNd`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more
- CVE-2021-29590Heap OOB read in TFLite's implementation of `Minimum` or `Maximum`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.1.4, 2.2.3, 2.3.3 and more