CVE-2021-37678CRITICALAug 12, 2021

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input. Given that YAML format support requires

CVE-2021-37678CRITICALAug 12, 2021

CVE-2021-31556CRITICALAug 12, 2021

An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key will fit in a MySQL blob.

CVE-2021-29377CRITICALAug 12, 2021

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt.

CVE-2021-28890CRITICALAug 12, 2021

J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId parameter to fast/sys/role/authUser/list, related to the use of ${} to join SQL statements.

CVE-2021-28121CRITICALAug 12, 2021

Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.

CVE-2020-36363CRITICALAug 12, 2021

Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entities consider to be weak ciphers.

CVE-2021-37599CRITICALAug 12, 2021

The exporter/Login.aspx login form in the Exporter in Nuance Winscribe Dictation 4.1.0.99 is vulnerable to SQL injection that allows a remote, unauthenticated attacker to read the database (and execute code in some situations) via the txtPassword parameter.

CVE-2021-33199CRITICALAug 12, 2021

In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead of the fixed file names of icon.png and icon.svg.

CVE-2021-26432CRITICALAug 12, 2021

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

CVE-2021-26424CRITICALAug 12, 2021

Windows TCP/IP Remote Code Execution Vulnerability

CVE-2021-38606CRITICALAug 12, 2021

reNgine through 0.5 relies on a predictable directory name.

CVE-2021-20509CRITICALAug 12, 2021

IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 198243.

CVE-2021-20314CRITICALAug 12, 2021

Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.

CVE-2020-20979CRITICALAug 12, 2021

An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code.

CVE-2020-20975CRITICALAug 12, 2021

In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.

CVE-2020-28165CRITICALAug 12, 2021

The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. An attacker can upload arbitrary webshell to the server by using the downloadZipPackage() function.

CVE-2021-37222CRITICALAug 12, 2021

Parsers in the open source project RCDCAP before 1.0.5 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via specially crafted packets.

CVE-2021-38574CRITICALAug 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows SQL Injection via crafted data at the end of a string.

CVE-2021-38573CRITICALAug 11, 2021

An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows writing to arbitrary files because a CombineFiles pathname is not validated.

Security Feed