Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33654PUBLISHED: 2022-06-27When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception.
CVE-2022-2088PUBLISHED: 2022-06-27An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
CVE-2022-2106PUBLISHED: 2022-06-27Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
CVE-2022-2140PUBLISHED: 2022-06-27Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
CVE-2013-2216PUBLISHED: 2022-06-27** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
User Rank: Apprentice
1/9/2017 | 11:01:53 AM
Great post!
I too am all for having an industry accepted timetable that is adopted not only by the security community, but the business community as well. Having guidelines that are agreed to by both parties not only ensures that vulnerability fixes are given some priority in the corporate world, but also ensures that security researchers know how much time they have to work with when dealing with corporate entities.
Cheers,
Tom