CVE-2018-8825: Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).

Summary: Google TensorFlow version 1.7 and below contains a buffer overflow (a bug where a program writes data beyond the memory space it's supposed to use), which allows an attacker to execute arbitrary code locally on the affected system. This vulnerability is tracked as CVE-2018-8825 and was identified as a weakness in how the software restricts operations within memory boundaries.


CVE-2018-7576: Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-depen

Summary: Google TensorFlow version 1.6.x and earlier contains a null pointer dereference vulnerability (a type of bug where software tries to access memory that doesn't exist, causing it to crash or behave unexpectedly). The vulnerability's impact depends on the specific context in which TensorFlow is being used.

Solution: N/A -- no mitigation discussed in source.


CVE-2019-10844: nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) through v1.0.14 relies on the HOME environm

Summary: CVE-2019-10844 is a vulnerability in Sony Neural Network Libraries (nnabla) through version v1.0.14 where the logger component relies on the HOME environment variable (a system setting that tells programs where a user's personal files are stored), which may be untrusted and could potentially be exploited. The vulnerability affects the libnnabla.a library file used in the software.


CVE-2018-17247: Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a

Summary: Elasticsearch Security versions 6.5.0 and 6.5.1 have an XXE flaw (XML external entity injection, where an attacker exploits how the software processes XML data) in the Machine Learning find_file_structure API. If Elasticsearch's Java Security Manager allows external network access, an attacker could send a crafted request to leak local files from the server, potentially exposing sensitive information.


CVE-2018-1000844: Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Ent

Summary: Square's Retrofit library (a tool for making web requests in Java) contained an XXE vulnerability (XML External Entity attack, where an attacker tricks the system into reading files by embedding malicious instructions in XML data) in its JAXB component. An attacker could exploit this to read files from the system or perform SSRF (server-side request forgery, where an attacker makes the server send requests to unintended targets).

Solution: The vulnerability was fixed after commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437. Users should update to a version of Retrofit that includes this commit.


CVE-2018-20301: An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In pa

Summary: CVE-2018-20301 is a mass assignment vulnerability (a flaw where an attacker can modify data fields they shouldn't be able to change) in Steve Pallen Coherence before version 0.5.2. The vulnerability allows users registering for accounts to update any field in the system, including automatically confirming their own accounts by adding a confirmed_at parameter to their registration request.


CVE-2018-3824: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker i

Summary: X-Pack Machine Learning (a tool for automated data analysis in Elasticsearch) versions before 6.2.4 and 5.6.9 contained a cross-site scripting vulnerability (XSS, a flaw where attackers inject malicious code into web pages). An attacker could inject harmful data into a database index being analyzed by the machine learning tool, and when another user views the results, the attacker could steal sensitive information or perform actions as that user.

Solution: Update X-Pack Machine Learning to version 6.2.4 or 5.6.9 or later.


CVE-2018-3823: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manag

Summary: X-Pack Machine Learning (a tool for building predictive models in Elastic) versions before 6.2.4 and 5.6.9 contained a cross-site scripting vulnerability (XSS, where attackers inject malicious code that runs in users' browsers). Users with manage_ml permissions could hide malicious data in job configurations that would execute when other users viewed the results, allowing attackers to steal sensitive information or perform harmful actions on behalf of those users.

Solution: Update X-Pack Machine Learning to version 6.2.4 or 5.6.9 or later. The source references a security update at https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422.


CVE-2017-5719: A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a

Summary: CVE-2017-5719 is a vulnerability in Intel Deep Learning Training Tool Beta 1 that allows a network attacker to remotely execute code (run commands on a system without authorization) as a local user. The vulnerability has a CVSS score (a 0-10 rating of how severe a vulnerability is) of 4.0. The specific weakness type could not be determined from available information.


CVE-2017-10349: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP). Supported versions that

Summary: A vulnerability in Oracle Java SE's JAXP component (a tool for processing XML, a common data format) allows attackers to partially disable Java programs over the network without needing to log in. This mainly affects Java applications running in sandboxes (isolated environments) that execute untrusted code from the internet, and does not affect servers running only trusted code.


CVE-2016-8739: The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyRea

Summary: CVE-2016-8739 is a vulnerability in the JAX-RS module (a Java API for building web services) of Apache CXF versions before 3.0.12 and 3.1.x before 3.1.9, involving the Atom JAX-RS MessageBodyReader component. The provided content only lists reference links to advisories and does not include details about the vulnerability's impact or nature.


CVE-2017-3526: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported vers

Summary: A vulnerability in Oracle Java SE's JAXP component (a library for processing XML documents) allows attackers over the network to crash Java applications without authentication, affecting Java versions 6u141, 7u131, 8u121 and related products. The attack is difficult to exploit but can be delivered through multiple methods, including malicious Java Web Start applications (Java programs downloaded and run from the web) and web services. The vulnerability has a CVSS score (a 0-10 severity rating) of 5.9, indicating moderate impact focused on availability disruption.


CVE-2017-5653: JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response w

Summary: CVE-2017-5653 is a security flaw in Apache CXF (a framework for building web services) versions before 3.1.11 and 3.0.13, where JAX-RS (Java API for REST web services) XML clients do not properly validate responses from services. This could allow attackers to exploit how the software processes XML data from web services it communicates with.


CVE-2016-0466: Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u

Summary: CVE-2016-0466 is an unspecified vulnerability in Oracle Java SE (the Java programming language and runtime environment) versions 6u105, 7u91, and 8u66 that affects system availability. The flaw exists in JAXP (Java API for XML Processing, a library for handling XML documents) and can be exploited remotely through Java Web Start applications, Java applets, or web services that use the affected Java components.


CVE-2013-2415: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and

Summary: CVE-2013-2415 is an unspecified vulnerability in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, that affects the JAX-WS (Java API for XML Web Services, a tool for building web services) component and may leak sensitive information. The vulnerability requires local access (an attacker already on your computer) to exploit and cannot be used through untrusted applets or Java Web Start applications.


CVE-2013-1518: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 U

Summary: A vulnerability exists in Oracle Java SE versions 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier, as well as OpenJDK 6 and 7, related to JAXP (Java API for XML Processing, a tool for handling XML documents). Remote attackers can exploit this unspecified flaw to compromise the confidentiality, integrity, and availability of affected systems.


CVE-2012-5074: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

Summary: CVE-2012-5074 is an unspecified vulnerability in Oracle Java SE 7 Update 7 and earlier versions that affects the Java Runtime Environment (JRE, the software that runs Java programs on your computer). The vulnerability can only be exploited through untrusted Java Web Start applications and untrusted Java applets (small programs that run in web browsers), which are limited by the Java sandbox (a restricted environment that prevents programs from accessing sensitive system resources).