linuxfoundation Vulnerabilities and Affected Products
Vulnerabilities associated with onnx.
Products
Clear product- yocto8 vulnerabilities
- edge_virtualization_engine3 vulnerabilities
- zowe_api_mediation_layer3 vulnerabilities
- argo-cd2 vulnerabilities
- onnx2 vulnerabilities
- cortex1 vulnerability
- fluid1 vulnerability
- opendaylight1 vulnerability
- runc1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-5187HIGH | Arbitrary File Overwrite in download_model_with_test_data in onnx/onnxA vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handlin… CWE-22Jun 6, 2024 | CVSS8.8v3.1 | EPSS1.18% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-27318HIGH | Onnx Directory Traversal vulnerabilityVersions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882. CWE-22Feb 23, 2024 | CVSS7.5v3.1 | EPSS1.19% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |