Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33654PUBLISHED: 2022-06-27When performing the initialization operation of the Split operator, if a dimension in the input shape is 0, it will cause a division by 0 exception.
CVE-2022-2088PUBLISHED: 2022-06-27An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
CVE-2022-2106PUBLISHED: 2022-06-27Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
CVE-2022-2140PUBLISHED: 2022-06-27Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
CVE-2013-2216PUBLISHED: 2022-06-27** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
User Rank: Strategist
5/4/2021 | 4:13:24 PM
Even if we replaced most web authentication with client side PKI, most users would still likely be using a master password for their private keystore. And personally, I think they should/could have done over a decade ago, if they had tweaked TLS (or simply added a PKI http auth type to go along side "basic" and "digest") that made it easier to integrate PKI auth with the way normal user/password works.
So there's my $0.07 ($0.02, adjusted for inflation).