Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
if no form values have been sent. Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data. Alternatively a custom Finisher can be added as first finisher. This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/neos/form/security/advisories/GHSA-m5vx-8chx-qvmm - https://github.com/neos/form-ghsa-m5vx-8chx-qvmm/pull/1 - https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567 - https://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246 - https://githu
a0478ccba97dba1bb81649567 - https://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246 - https://github.com/neos/form/releases/tag/5.1.3
CVE ID: CVE-2021-32698 State: PUBLISHED Published: 2021-06-21T21:15:11 Last Updated: 2024-08-03T23:25:31.148Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: elabftw Products: elabftw Problem Types: CWE-918 Description: eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/elabftw/elabftw/security/advisories/GHSA-mh6g-62p8-26m4 - https://github.com/elabftw/elabftw/co
es: - https://github.com/elabftw/elabftw/security/advisories/GHSA-mh6g-62p8-26m4 - https://github.com/elabftw/elabftw/commit/3d2db4d3ad90b0915f29f05aeba41eaaf6a7c726
CVE ID: CVE-2021-32699 State: PUBLISHED Published: 2021-06-22T19:20:10 Last Updated: 2024-08-03T23:25:31.139Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: pterodactyl Products: wings Problem Types: CWE-400 Description: Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding. Users should up
mpacts to other clients on the same hardware, eventually causing the physical server to stop responding. Users should upgrade to `1.4.4` to mitigate the issue. There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pterodactyl/wings/security/advisories/GHSA-jj6m-r8jc-2gp7 - https://github.com/pterodactyl/wings/commit/e0078eee0a71d61573a94c75e6efcad069d78de3
CVE ID: CVE-2021-32700 State: PUBLISHED Published: 2021-06-22T19:30:12 Last Updated: 2024-08-03T23:25:31.122Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ballerina-platform Products: ballerina-lang Problem Types: CWE-306 Description: Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code i
erability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ballerina-platform/ballerina-lang/security/advisories/GHSA-f5qg-fqrw-v5ww - https://github.com/ballerina-platform/ballerina-lang/commit/4609ffee1744ecd16aac09303b1783bf0a525816
CVE ID: CVE-2021-32701 State: PUBLISHED Published: 2021-06-22T19:45:12 Last Updated: 2024-08-03T23:25:31.146Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ory Products: oathkeeper Problem Types: CWE-863 Description: ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired.
problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid. A patch will be released with `v0.38.12-beta.1`. Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist. The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779
thenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes. The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ory/oathkeeper/security/advisories/GHSA-qvp4-rpmr-xwrr - https://github.com/ory/oathkeep
eferences: - https://github.com/ory/oathkeeper/security/advisories/GHSA-qvp4-rpmr-xwrr - https://github.com/ory/oathkeeper/pull/424 - https://github.com/ory/oathkeeper/commit/1f9f625c1a49e134ae2299ee95b8cf158feec932
CVE ID: CVE-2021-32702 State: PUBLISHED Published: 2021-06-25T16:25:11 Last Updated: 2024-08-03T23:25:31.131Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: auth0 Products: nextjs-auth0 Problem Types: CWE-79 Description: The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including `1.4.1` are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless**
ssage. You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response. Upgrade to version `1.4.1` to resolve. The fix adds basic HTML escaping to the error message and it should not impact your users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/auth0/nextjs-auth0/security/advisories/GHSA-954c-jjx6-cxv7 - https://github.com/auth0/nextjs-auth0/commit/6996e2528ceed98627caa28abafbc09e90163ccf - https://www.npmjs.com/package/%40auth0/nextjs-auth0
CVE ID: CVE-2021-32703 State: PUBLISHED Published: 2021-07-12T15:25:12 Last Updated: 2024-08-03T23:25:31.105Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-799 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.co
.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9p - https://github.com/nextcloud/server/pull/26945 - https://hackerone.com/reports/1173684 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/ - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32704 State: PUBLISHED Published: 2021-06-24T16:10:10 Last Updated: 2024-08-03T23:25:31.117Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: dhis2 Products: dhis2-core Problem Types: CWE-89 Description: DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint in DHIS2 versions 2.34.4, 2.35.2, 2.35.3, 2.35.4, and 2.36.0. Earlier versions, such as 2.34.3 and 2.35.1 and all versions 2.33 and older are unaffected. The system is vulnerable to attack
r versions, such as 2.34.3 and 2.35.1 and all versions 2.33 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. However, we strongly recommend that all DHIS2 implementations using versions 2.34, 2.35 and 2.36 install these patches as soon as possible. There is no straightforward known workaround for DHIS2 instances us
and 2.36 install these patches as soon as possible. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the /api/trackedEntityInstance endpoint as a temporary workaround while waiting to upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dhis2/dhis2-core/security/advisories/GHSA-fj38-585h-hxgj
CVE ID: CVE-2021-32705 State: PUBLISHED Published: 2021-07-12T15:30:14 Last Updated: 2024-08-03T23:25:31.065Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-799 Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - h
20.0.11, and 21.0.3. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fjv7-283f-5m54 - https://github.com/nextcloud/server/pull/27610 - https://hackerone.com/reports/1192159 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J63NBVPR2AQCAWRNDOZSGRY5II4WS2CZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BVZS26RDME2DYTKET5AECRIZDFUGR2AZ/ - https://security.gentoo.org/glsa/202208-17
CVE ID: CVE-2021-32706 State: PUBLISHED Published: 2021-08-04T17:50:09 Last Updated: 2024-08-03T23:25:31.137Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: pi-hole Products: AdminLTE Problem Types: CWE-94 Description: Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. The issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch
e issue lies in the fact that one of the periods is not escaped, allowing any character to be used in its place. A patch for this vulnerability was released in version 5.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-5cm9-6p3m-v259 - https://github.com/pi-hole/AdminLTE/releases/tag/v5.5.1
CVE ID: CVE-2021-32707 State: PUBLISHED Published: 2021-07-12T19:05:13 Last Updated: 2024-08-03T23:25:31.094Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-20, CWE-200 Description: Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No w
ugh the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No workarounds are known to exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xxp4-44xc-8crh - https://github.com/nextcloud/mail/pull/5189 - https://hackerone.com/reports/1215251
CVE ID: CVE-2021-32708 State: PUBLISHED Published: 2021-06-24T16:30:12 Last Updated: 2024-08-03T23:25:31.167Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thephpleague Products: flysystem Problem Types: CWE-367 Description: Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The conditions are: A user is allowed to supply the path or filename of an uploaded file, the supplied path or filename is not checked against unicode chars, the supplied pathname checked aga
an uploaded file, the supplied path or filename is not checked against unicode chars, the supplied pathname checked against an extension deny-list, not an allow-list, the supplied path or filename contains a unicode whitespace char in the extension, the uploaded file is stored in a directory that allows PHP code to be executed. Given these conditions are met a user can upload and execute arbitrary code on the system under attack. The unicode whitespace removal has been replaced with a rejection (exception). For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thephpleague/flysystem/security/advi
Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thephpleague/flysystem/security/advisories/GHSA-9f46-5r25-5wfm - https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74 - https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32 - https://packagist.org/packages/league/flysystem - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNZSWK4GOMJOOHKLZEOE5AQSLC4DNCRZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWPTENBYKI2IG47GI4DHAACLNRLTWUR5/
CVE ID: CVE-2021-32709 State: PUBLISHED Published: 2021-06-24T18:50:11 Last Updated: 2024-08-03T23:25:31.076Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: shopware Products: platform Problem Types: CWE-306 Description: Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to
rresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopware/platform/security/advisories/GHSA-g7w8-pp9w-7p32
CVE ID: CVE-2021-32710 State: PUBLISHED Published: 2021-06-24T19:45:17 Last Updated: 2024-08-03T23:25:31.138Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: shopware Products: platform Problem Types: CWE-384 Description: Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the la
ding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopware/platform/security/advisories/GHSA-h9q8-5gv2-v6mg - https://github.com/shopware/platform/commit/010c0154bea57c1fca73277c7431d029db7a972e
CVE ID: CVE-2021-32711 State: PUBLISHED Published: 2021-06-24T20:05:13 Last Updated: 2024-08-03T23:25:31.127Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: shopware Products: platform Problem Types: CWE-200 Description: Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download
e current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information. https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351 ### Workarounds For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of function
versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659 ### For more information https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopware/platform/security/advisories/GHSA-f2vv-h5x4-57gr - https://github.com/shopware/platform/commit/157fb84a8b3b4ace4be165a033d559826704829b - https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
CVE ID: CVE-2021-32712 State: PUBLISHED Published: 2021-06-24T20:50:11 Last Updated: 2024-08-03T23:25:31.057Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: shopware Products: shopware Problem Types: CWE-200 Description: Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview. Additional Analyst Notes: - CVE Program Container: References: - https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021 - https
ram Container: References: - https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021 - https://github.com/shopware/shopware/security/advisories/GHSA-9vxv-wpv4-f52p - https://github.com/shopware/shopware/commit/dcb24eb5ec757c991b5a4e2ddced379e5820744d
CVE ID: CVE-2021-32713 State: PUBLISHED Published: 2021-06-24T20:25:12 Last Updated: 2024-08-03T23:25:31.139Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: shopware Products: shopware Problem Types: CWE-79 Description: Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopware/shopware/security/advisories/GHSA-f6p7-8xfw-fjqq -
: - CVE Program Container: References: - https://github.com/shopware/shopware/security/advisories/GHSA-f6p7-8xfw-fjqq - https://github.com/shopware/shopware/commit/a0850ffbc6f581a8eb8425cc2bf77a0715e21e12 - https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
CVE ID: CVE-2021-32714 State: PUBLISHED Published: 2021-07-07T19:35:10 Last Updated: 2024-08-03T23:25:31.083Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: hyperium Products: hyper Problem Types: CWE-190 Description: hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks." The vulnerability is patched in version 0.14.10. Two possible workarounds
t in "request smuggling" or "desync attacks." The vulnerability is patched in version 0.14.10. Two possible workarounds exist. One may reject requests manually that contain a `Transfer-Encoding` header or ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9