漏洞公告

Null pointer dereference in TFLite MLIR optimizations

Use after free and segfault in shape inference functions

FPE in LSH in TFLite

Segfault on strings tensors with mistmatched dimensions, due to Go code

Cross-Site Scripting via SVG media files

Authenticated server-side request forgery in file upload via URL.

Uncaught Exception in jsoup

Improper Handling of Unexpected Data Type in ced

Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.

CKEditor 4 vulnerabilities in versions <4.16.1

parse-server new anonymous user session acts as if it's created with password

Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`

Argo Server TLS requests could be forged by attacker with network access

Privilege escalation via form generator

PHP file inclusion via insert tags

Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality

Widget feature vulnerability allowing to execute JavaScript code using undo functionality

Special Element Injection in notebook

JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

Cross-Site Scripting via Rich-Text Content

Improper Authorization and Origin Validation Error in OneFuzz

Timing based private key exposure in Bouncy Castle

Padding oracle attacks