Paddlepaddle: Security Vulnerabilities
Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.
CVSS Score
7.1
EPSS Score
0.005
Published
2022-12-07
In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.
CVSS Score
9.8
EPSS Score
0.001
Published
2022-11-26
The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVSS Score
9.3
EPSS Score
0.001
Published
2022-07-11
Page 4