PaddlePaddle

Records35All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical15CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

PaddlePaddle records in CISA KEV

No PaddlePaddle vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Paddlepaddle 31 records HIGH Anakin 1 record MEDIUM Paddle 1 record HIGH

Records

35 records

TI-2023-28702 CVE-2023-52311 · GHSA-rf7p-79xq-8xwm

Command injection in _wget_download

HIGH 82

PaddlePaddle before 2.6.0 has a command injection in _wget_download.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01172 Published 2024-01-03 Fixed in 2.6.0 CWE-78

TI-2023-28701 CVE-2023-52310 · GHSA-j5h9-9r39-43q5

Command injection in get_online_pass_interval

HIGH 82

PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01172 Published 2024-01-03 Fixed in 2.6.0 CWE-78

TI-2023-20020 CVE-2023-38671 · GHSA-hh7p-hvm3-rg88

Buffer overflow in PaddlePaddle

HIGH 82

Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00749 Published 2023-07-26 Fixed in 2.5.0 CWE-120

TI-2024-00755 CVE-2024-0818 · GHSA-2rp8-hff9-c5wr

Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6

HIGH 78

Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01058 Published 2024-03-07 No fix listed CWE-22

TI-2023-28705 CVE-2023-52314 · GHSA-3cr5-2446-8pg3

Command injection in convert_shape_compare

HIGH 76

PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01182 Published 2024-01-03 Fixed in 2.6.0 CWE-78

TI-2023-28695 CVE-2023-52304 · GHSA-4rrv-8gcp-24v8

Buffer overflow in PaddlePaddle

HIGH 76

Stack overflow in paddle.searchsorted in PaddlePaddle before 2.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00576 Published 2024-01-03 Fixed in 2.6.0 CWE-120

TI-2023-20022 CVE-2023-38673 · GHSA-9q9v-qgwx-84mr

Command injection in fs.py

HIGH 76

PaddlePaddle before 2.5.0 has a command injection in fs.py.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02319 Published 2023-07-26 Fixed in 2.5.0 CWE-78

TI-2023-20018 CVE-2023-38669 · GHSA-8wfh-qxxv-3q8c

Use after free in PaddlePaddle

HIGH 76

Use after free in paddle.diagonal in PaddlePaddle before 2.5.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00764 Published 2023-07-26 Fixed in 2.5.0 CWE-416

TI-2023-28698 CVE-2023-52307 · GHSA-g57v-2687-jx33

Buffer overflow in PaddlePaddle

HIGH 75

Stack overflow in paddle.linalg.lu_unpack in PaddlePaddle before 2.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00529 Published 2024-01-03 Fixed in 2.6.0 CWE-120

TI-2024-00752 CVE-2024-0815 · GHSA-qqv2-35q8-p2g2

Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0

HIGH 73

Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.01132 Published 2024-03-07 No fix listed CWE-78

TI-2024-01496 CVE-2024-1603 · GHSA-jwrc-3v3f-5cq5

paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.

HIGH 72

paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00564 Published 2024-03-23 No fix listed CWE-73

TI-2023-28694 CVE-2023-52303 · GHSA-2wcj-qr76-9768

Segfault in paddle.put_along_axis

HIGH 72

Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00484 Published 2024-01-03 Fixed in 2.6.0 CWE-476

TI-2023-20026 CVE-2023-38677 · GHSA-c6ph-m8cw-rfqh

FPE in paddle.linalg.eig

HIGH 72

FPE in paddle.linalg.eig in PaddlePaddle before 2.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00484 Published 2024-01-03 Fixed in 2.6.0 CWE-369

TI-2023-20021 CVE-2023-38672 · GHSA-cv2j-922j-hr56

FPE in paddle.linalg.matrix_power

HIGH 72

FPE in paddle.trace in PaddlePaddle before 2.5.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00739 Published 2023-07-26 Fixed in 2.5.0 CWE-369

TI-2022-23115 CVE-2022-46741 · GHSA-2hvc-hwg3-hpvw

Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.

HIGH 72

Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00705 Published 2022-12-07 Fixed in 2.4 CWE-125

TI-2024-00754 CVE-2024-0817 · GHSA-fh54-3vhg-mpc2

Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0

HIGH 69

Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.01166 Published 2024-03-07 No fix listed CWE-77

TI-2024-00480 CVE-2024-0521 · GHSA-chj7-w3f6-cvfj

Code Injection in paddlepaddle/paddle

HIGH 69

Code Injection in paddlepaddle/paddle

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0046 Published 2024-01-20 Fixed in 2.6.0 CWE-94

TI-2023-28699 CVE-2023-52308 · GHSA-v9pg-qw6x-w5r2

FPE in paddle.amin

HIGH 66

FPE in paddle.amin in PaddlePaddle before 2.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00484 Published 2024-01-03 Fixed in 2.6.0 CWE-369

TI-2023-28693 CVE-2023-52302 · GHSA-547m-23x7-cxg5

Segfault in paddle.nextafter

HIGH 66

Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00541 Published 2024-01-03 Fixed in 2.6.0 CWE-476

TI-2023-20024 CVE-2023-38675 · GHSA-jm68-fpmr-8j2g

FPE in paddle.linalg.matrix_rank

HIGH 66

FPE in paddle.linalg.matrix_rank in PaddlePaddle before 2.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00484 Published 2024-01-03 Fixed in 2.6.0 CWE-369

TI-2023-20023 CVE-2023-38674 · GHSA-xjpw-hx47-rccv

FPE in paddle.nanmedian

HIGH 66

FPE in paddle.nanmedian in PaddlePaddle before 2.6.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00484 Published 2024-01-03 Fixed in 2.6.0 CWE-369

TI-2022-23116 CVE-2022-46742 · GHSA-gcjf-29m9-888q

Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

MEDIUM 51

Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01186 Published 2022-12-07 Fixed in 2.4.0 CWE-94

TI-2024-00845 CVE-2024-0917 · GHSA-mrmm-qmrj-xgp6

remote code execution in paddlepaddle/paddle 2.6.0

MEDIUM 46

remote code execution in paddlepaddle/paddle 2.6.0

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01652 Published 2024-03-07 No fix listed CWE-94

TI-2022-22692 CVE-2022-45908 · GHSA-83g7-8fch-p37m

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code…

MEDIUM 46

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01426 Published 2022-11-26 Fixed in 2.4 CWE-94

TI-2023-28700 CVE-2023-52309 · GHSA-8fp7-jwv2-49x9

Buffer overflow in PaddlePaddle

MEDIUM 43

Heap buffer overflow in paddle.repeat_interleave in PaddlePaddle before 2.6.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00538 Published 2024-01-03 Fixed in 2.6.0 CWE-120

Open these records in search →

Critical	15
High	18
Medium	1
Low	1
No CVSS	0