米国時間の2月10日にAndroidの次期メジャーバージョン「Android 13」が発表され、開発…
Android 13 Developer Preview 1リリース：変更点と新機能
2022年2月10日10:00AM（現地時間）、GoogleよりAndroid 13 Developer Preivew1が発表されました。最新のAndroid 13（Android T, Android 13 t-DP […]
The post Android 13 Developer Preview 1リリース：変更点と新機能 first appeared on TechBooster.
[cakephp/cakephp] Cross-Site Request Forgery in CakePHP
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-15400
https://bakery.cakephp.org/2020/04/18/cakephp_406_released.html
https://baker…
ASUS、Intel Core m搭載で5万円以下の14.0型「Chromebook C425TA」
ASUS JAPANは2月10日、ディスプレイを180度開閉できるクラムシェルタイプのChromeb…
CSS？SVG？Canvas？動く背景アニメーションのサンプルや参考ページ
こういう背景ってどうやって作るんだろう？ 以下のホームページに使われていた背景の…
[tensorflow] Segfault in `simplifyBroadcast` in Tensorflow
Impact
The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.
size_t maxRank = 0;
for (auto shape : llvm::enumerate(shapes)) {
auto foun…
[tensorflow-cpu] Out of bounds read in Tensorflow
Impact
TensorFlow’s type inference can cause a heap OOB read as the bounds checking is done in a DCHECK (which is a no-op during production):
if (node_t.type_id() != TFT_UNSET) {
int ix = input_idx[i];
DCHECK(ix < node_t.args_size())
<&…
[tensorflow-gpu] Crash due to erroneous `StatusOr` in TensorFlow
Impact
A GraphDef from a TensorFlow SavedModel can be maliciously altered to cause a TensorFlow process to crash due to encountering a StatusOr value that is an error and forcibly extracting the value from it:
if (op_reg_data->type_ctor != nullptr…
[org.apache.tomcat:tomcat] Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associ…
[ansible] Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (–check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat …