TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-jqh7-w5pr-cr56
Summary: Cross-site scripting in koa-shopify-auth
Aliases: CVE-2020-8176
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-17T21:01:22Z

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.
Vulnerability: GHSA-m7p2-ghfh-pjvx
Summary: Vulnerability in crunch function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36380
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2021-11-01T19:18:51Z

aaptjs is a node wraper for aapt. An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-c3m3-c39q-pv23
Summary: Out of bounds write in slice-deque
Aliases: CVE-2019-15543
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2021-08-25T20:44:10Z

An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.
Vulnerability: GHSA-3jc5-5hc5-33gj
Summary: Data races in conquer-once
Aliases: CVE-2020-36208
Severity: HIGH
CVSS score: 7.8
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:50:49Z

An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type, leading to memory corruption.
Vulnerability: GHSA-5mrr-rgp6-x4gr
Summary: Command Injection in marsdb
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-03T19:39:05Z

All versions of `marsdb` are vulnerable to Command Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-f9mq-jph6-9mhm
Summary: Arbitrary file read via window-open IPC in Electron
Aliases: CVE-2020-4075
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-552
Published: 2020-07-07T00:01:13Z

### Impact
The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.

### Workarounds
Ensure you are calling `event.preventDefault()` on all [`new-window`](https://electronjs.org/docs/api/web-contents#event-new-window) events where the `url` or `options` is not something you expect.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-2fqv-h3r5-m4vf
Summary: Cross Site Scripting (XSS) in plotly.js
Aliases: CVE-2017-1000006
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:35Z

Affected versions of `plotly.js` are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using this package.


## Recommendation

Update to 1.16.0 or later.
Vulnerability: GHSA-jpg7-6c9f-7q54
Summary: Directory Traversal in datachannel-client
Aliases: CVE-2017-16121
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T23:15:21Z

Affected versions of `datachannel-client` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation


No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-pcwm-8jc3-qxvj
Summary: Moderate severity vulnerability that affects Plone
Aliases: CVE-2011-4462
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2018-07-23T19:50:52Z

Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Vulnerability: GHSA-5j3g-jfq3-7jwx
Summary: Arbitrary JavaScript Execution in bassmaster
Aliases: CVE-2014-7205
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.


## Recommendation

Update to bassmaster version 1.5.2 or greater.
Vulnerability: GHSA-gjm5-83cw-p3p2
Summary: Prototype Pollution in extend2
Aliases: CVE-2021-23568
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2022-01-12T22:59:13Z

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
Vulnerability: GHSA-mg3m-f475-28hv
Summary: Path Traversal in @backstage/plugin-scaffolder-backend
Aliases: CVE-2021-43783
Severity: HIGH
CVSS score: 8.5
CWE: CWE-22
Published: 2021-12-01T18:28:51Z

### Impact
A malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance.

This vulnerability can in some situation also be exploited through user input when executing a template, meaning you do not need write access to the templates. This method will not allow the attacker to control the contents of the injected file however, unless the template is also crafted in a specific way that gives control of the file contents.

### Patches
This vulnerability is fixed in version `0.15.14` of the `@backstage/plugin-scaffolder-backend`.

### Workarounds
This attack is mitigated by restricting access and requiring reviews when registering or modifying scaffolder templates.

### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-r6g8-jmj9-g945
Summary: Improper Restriction of Rendered UI Layers or Frames in yourls
Aliases: CVE-2021-3734
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352, CWE-1021
Published: 2021-08-30T16:22:16Z

yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Vulnerability: GHSA-f9hv-mg5h-xcw9
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-19360
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-01-04T19:06:57Z

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Vulnerability: GHSA-wr55-mf5c-hhwm
Summary: Data races in late-static
Aliases: CVE-2020-36209
Severity: HIGH
CVSS score: 7
CWE: CWE-662
Published: 2021-08-25T20:50:44Z

An issue was discovered in the late-static crate before 0.4.0 for Rust. Because Sync is implemented for LateStatic with T: Send, a data race can occur.
Vulnerability: GHSA-8jmh-c6vr-pmvm
Summary: SQL Injection in pimcore
Aliases: CVE-2020-7759
Severity: HIGH
CVSS score: 7.2
CWE: CWE-89
Published: 2021-05-06T18:53:55Z

"The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]"
Vulnerability: GHSA-qqv6-5w6p-3pgr
Summary: Moderate severity vulnerability that affects org.hswebframework.web:hsweb-commons
Aliases: CVE-2018-20594
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-04T17:43:30Z

An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
Vulnerability: GHSA-hfq9-rfpv-j8r8
Summary: Command Injection in pidusage
Aliases: CVE-2017-16034
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-01T16:49:19Z

Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.
 
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable. 

## Proof of Concept
```
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
```


## Recommendation

Update to version 1.1.5 or later.
Vulnerability: GHSA-7j52-6fjp-58gr
Summary: Inconsistent storage layout for ERC2771ContextUpgradeable
Severity: LOW
CVSS score: 0
Published: 2022-03-14T23:22:27Z

### Impact

The storage layout of the ERC2771ContextUpgradeable is not constant between versions. 
- versions `4.0.0`, `4.1.0` and `4.2.0`, the contract has a length of 51 slots. 
- since `4.3.0`, the contract has a length of 50 slots
- future versions will continue using 50 slots. 

This difference in layout could result in breaking upgrades if someone upgrades from an affected version to a non-affected version. It is thus recommended to be extremely careful when upgrading from a contract that uses ERC2771ContextUpgradeable `<4.3.0` to a newer version that uses `>=4.3.0`.

We've assessed the instances of this contract found on chain (with publicly verified source code) and notified the corresponding teams of the risk that an upgrade could cause.

### Workarounds

Potentially breaking upgrades would be caught by the OpenZeppelin Upgrades Plugins for Hardhat and Truffle. It is recommended to use this tooling for all your upgrades.

If you need to upgrade to a newer version of the Upgradeable Contracts library, we recommend copying the previous implementation ERC2771ContextUpgradeable (available in the `release-4.2` branch) and packaging it with your code.

### Reference

https://github.com/OpenZeppelin/openzeppelin-transpiler/pull/86

### For more information

If you have any questions, comments, or need assistance regarding this advisory, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).

To submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).
Vulnerability: GHSA-4f99-p9c2-3j8x
Summary: Undefined behavior via `nullptr` reference binding in sparse matrix multiplication
Aliases: CVE-2021-41219
Severity: HIGH
CVSS score: 7.8
CWE: CWE-824, CWE-125
Published: 2021-11-10T18:51:51Z

### Impact
The [code for sparse matrix multiplication](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/sparse_matmul_op.cc#L954-L1086) is vulnerable to undefined behavior via binding a reference to `nullptr`:

```python
import tensorflow as tf
  
tf.raw_ops.SparseMatMul(
  a=[[1.0,1.0,1.0]],
  b=[[],[],[]],
  transpose_a=False,
  transpose_b=False,
  a_is_sparse=False, 
  b_is_sparse=True)
```

This occurs whenever the dimensions of `a` or `b` are 0 or less. In the case on one of these is 0, an empty output tensor should be allocated (to conserve the invariant that output tensors are always allocated when the operation is successful) but nothing should be written to it (that is, we should return early from the kernel implementation). Otherwise, attempts to write to this empty tensor would result in heap OOB access.

### Patches
We have patched the issue in GitHub commit [e6cf28c72ba2eb949ca950d834dd6d66bb01cfae](https://github.com/tensorflow/tensorflow/commit/e6cf28c72ba2eb949ca950d834dd6d66bb01cfae).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-vxwf-pprx-wc25
Summary: Directory Traversal in citypredict.whauwiller
Aliases: CVE-2017-16104
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T00:10:03Z

Affected versions of `citypredict.whauwiller` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-p696-gf58-9w97
Summary: Missing Authentication for Critical Function
Aliases: CVE-2021-32709
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-306
Published: 2021-06-29T17:23:10Z

Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-rhgq-vv9x-j4p5
Summary: lawn-login exposes database password to unauthorized users
Aliases: CVE-2014-5000
Severity: HIGH
CVSS score: 7.8
CWE: CWE-200
Published: 2018-01-22T23:45:33Z

The login function in lib/lawn.rb in the lawn-login gem 0.0.7 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.
Vulnerability: GHSA-qvhr-55hg-3qwv
Summary: Non-persistent XSS in the Storefront in Shopware
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-09-23T17:20:39Z

### Impact
Non-persistent XSS in the Storefront

### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. 

For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
Vulnerability: GHSA-5pcx-vqjp-p34w
Summary: Cross-site Scripting in shuup
Aliases: CVE-2021-25963
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-04T20:11:03Z

In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.
Vulnerability: GHSA-7fr2-94h7-ccg2
Summary: An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
Aliases: CVE-2020-35209
Severity: HIGH
CVSS score: 7.5
Published: 2021-12-17T20:41:33Z

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
Vulnerability: GHSA-339j-hqgx-qrrx
Summary: Prototype Pollution
Aliases: CVE-2021-23395
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2021-06-21T17:13:06Z

This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.
Vulnerability: GHSA-7hvm-29rf-2gf2
Summary: Downloads Resources over HTTP in node-air-sdk
Aliases: CVE-2016-10647
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:08:58Z

Affected versions of `node-air-sdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `node-air-sdk`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-2hqf-qqmq-pgpp
Summary: Malicious Package in commander-js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T15:48:16Z

All versions of `commander-js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents as a post-install script.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.
Vulnerability: GHSA-g266-3crh-h7gj
Summary: Moderate severity vulnerability that affects ldoce
Aliases: CVE-2013-1911
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
Vulnerability: GHSA-gm68-g349-gxgg
Summary: Denial of service in bingrep
Aliases: CVE-2021-39480
Severity: MODERATE
CVSS score: 0
CWE: CWE-770
Published: 2022-01-28T22:35:16Z

Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).
Vulnerability: GHSA-cvxm-f295-x957
Summary: Prototype Pollution in merge-recursive
Aliases: CVE-2018-3751
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2018-09-18T13:46:06Z

All versions of `merge-recursive` are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via `__proto__` causing the addition or modification of an existing property.

Proof of concept:

```
var merge = require('merge-recursive').recursive;
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);
merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
```


## Recommendation

There is currently no fix available.
Vulnerability: GHSA-v5hp-35hw-cw5x
Summary: XSS in client rendered block templates in rendr
Aliases: CVE-2016-1000230
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:33:10Z

Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`.

Server side rendering is not affected and is properly escaped.


## Recommendation

Update to version 1.1.4 or later.
Vulnerability: GHSA-6v7p-j23v-4xmw
Summary: Downloads Resources over HTTP in robot-js
Aliases: CVE-2016-10608
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:48:03Z

Affected versions of `robot-js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `robot-js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rxr4-x558-x7hw
Summary: Double free in smallvec
Aliases: CVE-2018-20991
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:42:54Z

An issue was discovered in the smallvec crate before 0.6.3 for Rust. The Iterator implementation mishandles destructors, leading to a double free.
Vulnerability: GHSA-28fw-88hq-6jmm
Summary: Persistent XSS in shopping worlds
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-11-13T18:26:03Z

### Impact
Persistent XSS in shopping worlds

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Vulnerability: GHSA-3rpf-5rqv-689q
Summary: PHP Code Injection by malicious function name in smarty
Aliases: CVE-2021-26120
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-02-26T19:53:24Z

Template authors could inject php code by choosing a malicous {function} name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher.
Vulnerability: GHSA-39wr-f4ff-xm6p
Summary: Incorrect implementation in streebog
Aliases: CVE-2019-25007
Severity: HIGH
CVSS score: 7.5
CWE: CWE-617
Published: 2021-08-25T20:46:41Z

An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can cause a panic.
Vulnerability: GHSA-wpjr-j57x-wxfw
Summary: Data leakage via cache key collision in Django
Aliases: CVE-2020-13254
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2020-06-05T16:20:44Z

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage.
Vulnerability: GHSA-j823-4qch-3rgm
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14060
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2020-06-18T14:44:46Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
Vulnerability: GHSA-cj92-c4fj-w9c5
Summary: Moderate severity vulnerability that affects mail
Aliases: CVE-2012-2139
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:38Z

Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.
Vulnerability: GHSA-f9xh-2qgp-cq57
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36188
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:42Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
Vulnerability: GHSA-hmr4-m2h5-33qx
Summary: SQL injection in Django
Aliases: CVE-2020-7471
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2020-02-11T21:03:20Z

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
Vulnerability: GHSA-vp37-2f9p-3vr3
Summary: Cross-site Scripting in OWASP AntiSamy
Aliases: CVE-2022-29577
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-23T00:03:04Z

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
Vulnerability: GHSA-q5wr-fvpq-p67g
Summary: Integer Overflow in png-img
Aliases: CVE-2020-28248
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787, CWE-190
Published: 2021-12-10T17:23:30Z

An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
Vulnerability: GHSA-w873-xcqq-x922
Summary: Command Injection in Simiki
Aliases: CVE-2020-19001
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-09-01T18:37:24Z

Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'.
Vulnerability: GHSA-w9jg-gvgr-354m
Summary: Resource Exhaustion in Spring Security
Aliases: CVE-2021-22119
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863, CWE-400
Published: 2021-07-02T18:33:34Z

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
Vulnerability: GHSA-6cc5-2vg4-cc7m
Summary: Injection in Twisted
Aliases: CVE-2019-12387
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-74
Published: 2019-06-10T18:05:06Z

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Vulnerability: GHSA-ppq7-88c7-q879
Summary: Cross-Site Request Forgery in PiranhaCMS
Aliases: CVE-2021-25976
Severity: HIGH
CVSS score: 8.1
CWE: CWE-352
Published: 2021-11-17T23:42:40Z

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Vulnerability: GHSA-wrqf-rrrw-w3mg
Summary: Code injection in Apache Druid
Aliases: CVE-2021-25646
Severity: HIGH
CVSS score: 8.8
CWE: CWE-732
Published: 2021-06-16T17:40:47Z

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
Vulnerability: GHSA-c676-mcw3-qg55
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3730
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2021-08-25T14:50:08Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-g23v-p5jq-jvh4
Summary: Infinite loop in Apache CFX
Aliases: CVE-2021-30468
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835, CWE-400
Published: 2022-01-06T18:37:14Z

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Vulnerability: GHSA-vhhw-xjvf-wprr
Summary: Command Injection in @graphql-tools/git-loader
Aliases: CVE-2021-23326
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-77
Published: 2021-01-29T18:13:14Z

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
Vulnerability: GHSA-6gp3-h3jj-prx4
Summary: Prototype pollution in class-transformer
Aliases: CVE-2020-7637
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-915
Published: 2020-04-07T15:47:40Z

class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The 'classToPlainFromExist' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Vulnerability: GHSA-vc2p-r46x-m3vx
Summary: Argument injection in lettre
Aliases: CVE-2020-28247
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-77
Published: 2021-08-25T20:56:48Z

### Impact

Affected versions of lettre allowed argument injection to the sendmail command. It was possible, using forged to addresses, to pass arbitrary arguments to the sendmail executable.

Depending on the implementation (original sendmail, postfix, exim, etc.) it could be possible in some cases to write email data into abritrary files (using sendmail's logging features).

*NOTE*: This vulnerability only affects the sendmail transport. Others, including smtp, are not affected.

### Fix

The flaw is corrected by modifying the executed command to stop parsing arguments before passing the destination addresses.

### References

* [RUSTSEC-2020-0069](https://rustsec.org/advisories/RUSTSEC-2020-0069.html)
* [CVE-2020-28247](https://nvd.nist.gov/vuln/detail/CVE-2020-28247)
Vulnerability: GHSA-3pp3-77j6-8ph6
Summary: Missing Authentication for Critical Function in Apache NiFi
Aliases: CVE-2020-9487
Severity: HIGH
CVSS score: 7.5
CWE: CWE-306
Published: 2022-01-06T20:41:04Z

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
Vulnerability: GHSA-q3p4-gw7r-wqjc
Summary: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views
Aliases: CVE-2019-12417
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2019-11-22T13:45:22Z

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
Vulnerability: GHSA-mp55-2274-4pj8
Summary: Malicious Package in buffer-xgr
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:54:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-75xc-qvxh-27f8
Summary: Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8
Aliases: CVE-2021-31403
Severity: MODERATE
CVSS score: 4
CWE: CWE-208, CWE-203
Published: 2021-04-19T14:51:06Z

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:vaadin-server` versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

- https://vaadin.com/security/cve-2021-31403
Vulnerability: GHSA-7f59-x49p-v8mq
Summary: Cross-Site Scripting in swagger-ui
Aliases: CVE-2016-1000226
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:28:45Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.

Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.

## Proof of Concept

```
http://<USER_HOSTNAME>/swagger-ui/index.html?url=http://<MALICIOUS_HOSTNAME>/malicious-swagger-file.json
````



## Recommendation

Update to version 2.2.1 or later.
Vulnerability: GHSA-j5c2-hm46-wp5c
Summary: Privilege escalation: all users can access Admin-level API keys
Aliases: CVE-2021-39192
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-269
Published: 2021-07-22T19:43:16Z

### Impact
An error in the implementation of the limits service in 4.0.0 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability.

Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.9.4. Immediate action should be taken to secure your site - see patches & workarounds below.

It is highly recommended to regenerate all API keys after patching or applying the workaround below.

### Patches
Fixed in 4.10.0, all 4.x sites should upgrade as soon as possible.

### Workarounds
- Disable all non-Administrator accounts to prevent API access.

### For more information
If you have any questions or comments about this advisory:
* email us at security@ghost.org

---
Credits: Aden Yap Chuen Zhen, BAE Systems Applied Intelligence (Malaysia)
Vulnerability: GHSA-ww79-8xwv-932x
Summary: Moderate severity vulnerability that affects rbovirt
Aliases: CVE-2014-0036
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Vulnerability: GHSA-vcqg-3p29-xw73
Summary: Integer overflow in Pillow
Aliases: CVE-2020-5310
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-190
Published: 2021-11-03T18:04:41Z

libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
Vulnerability: GHSA-7q9c-h23x-65fq
Summary: Moderate severity vulnerability that affects org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2016-4977
Severity: HIGH
CVSS score: 8.8
Published: 2018-10-18T18:06:22Z

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
Vulnerability: GHSA-vr9x-mm65-2438
Summary: Command Injection in jison
Aliases: CVE-2020-8178
Severity: HIGH
CVSS score: 0
CWE: CWE-78
Published: 2020-10-08T21:38:51Z

**Withdrawn:** This vulnerability is not present in the released npm package.  Rather the vulnerable code is
part of the repo, but not part of the package. See linked hackerone report for more details.

Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.
Vulnerability: GHSA-p5gm-fgfx-hr7h
Summary: Gadget chain attack in Nippy
Aliases: CVE-2020-24164
Severity: HIGH
CVSS score: 7.8
CWE: CWE-502
Published: 2022-02-10T20:55:10Z

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.
Vulnerability: GHSA-f897-875p-23x7
Summary: Hard coded credentials in FreeTAKServer
Aliases: CVE-2022-25510
Severity: HIGH
CVSS score: 8.8
CWE: CWE-798
Published: 2022-03-12T00:00:37Z

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
Vulnerability: GHSA-6w4v-qr4m-97gg
Summary: Multi-Factor Authentication issue in Laravel Fortify
Aliases: CVE-2022-25838
Severity: HIGH
CVSS score: 8.1
CWE: CWE-294
Published: 2022-02-25T00:01:01Z

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
Vulnerability: GHSA-89q5-mj78-pw5w
Summary: Cross-site Scripting in pekeupload
Aliases: CVE-2021-23673
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-02T17:52:26Z

This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.
Vulnerability: GHSA-h56m-vwxc-3qpw
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-7829
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
Vulnerability: GHSA-6x48-j4x4-cqw3
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-8009
Severity: HIGH
CVSS score: 8.8
CWE: CWE-22
Published: 2018-12-21T17:50:29Z

Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerability in places that accept a zip file.
Vulnerability: GHSA-69v6-xc2j-r2jf
Summary: Shallow copy bug in geth
Aliases: CVE-2020-26241
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-682
Published: 2021-06-29T21:13:01Z

### Impact
This is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. 

Geth’s pre-compiled `dataCopy` (at `0x00...04`) contract did a shallow copy on invocation. An attacker could deploy a contract that 

- writes `X` to an EVM memory region `R`,
- calls `0x00..04` with `R` as an argument,
- overwrites `R` to `Y`,
- and finally invokes the `RETURNDATACOPY` opcode.

When this contract is invoked, a consensus-compliant node would push `X` on the EVM stack, whereas Geth would push `Y`.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-m2jr-hmc3-qmpr
Summary: Authorization bypass in Spree
Aliases: CVE-2020-26223
Severity: HIGH
CVSS score: 7.7
CWE: CWE-863
Published: 2020-11-13T17:18:22Z

### Impact
The perpetrator could query the [API v2 Order Status](https://guides.spreecommerce.org/api/v2/storefront#tag/Order-Status) endpoint with an empty string passed as an Order token

### Patches
Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. Users of Spree < 3.7 are not affected.

### References
Pull request with a fix and in-depth explanation - https://github.com/spree/spree/pull/10573

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)
Vulnerability: GHSA-j53j-gmr9-h8g3
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-8017
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2018-10-17T15:50:31Z

In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
Vulnerability: GHSA-vg44-fw64-cpjx
Summary: Incorrect Account Used for Signing
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2020-03-24T15:08:59Z

### Impact

Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected.

The vulnerability impacts cases where the user signs a personal message or transaction without first adding the account. This includes cases where the user has already added the account in a previous session (i.e. they added the account, reset the application, then signed something). The serialization/deserialization process does restore a previously added account, but it doesn&#39;t restore the index instructing the keyring to use that account for signing. As a result, after serializing then deserializing the keyring state, the account at index `0` is always used for signing even if it isn&#39;t the current account.

### Patches

This has been patched ([#14](https://github.com/MetaMask/eth-ledger-bridge-keyring/pull/14)) in version &gt;=0.2.1 of [`eth-ledger-bridge-keyring`](https://www.npmjs.com/package/eth-ledger-bridge-keyring), and in version &gt;=0.2.2 of [`@metamask/eth-ledger-bridge-keyring`](https://www.npmjs.com/package/@metamask/eth-ledger-bridge-keyring). Users are encouraged to migrate to the new package name.

### Workarounds

To work around this problem without updating, you should remove then re-add the account before use. As long as the account was added during the lifetime of that process, signing with that account should work correctly.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [MetaMask/eth-ledger-bridge-keyring on GitHub](https://github.com/MetaMask/eth-ledger-bridge-keyring)
* Email the MetaMask team at [hello@metamask.io](mailto:hello@metamask.io)
Vulnerability: GHSA-gg9m-fj3v-r58c
Summary: REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering
Aliases: CVE-2017-9805
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2018-10-16T19:37:56Z

The REST Plugin in Apache Struts 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
Vulnerability: GHSA-227w-wv4j-67h4
Summary: Class Loading Vulnerability in Artemis
Severity: HIGH
CVSS score: 8.2
CWE: CWE-501, CWE-653
Published: 2022-02-09T22:30:30Z

### Impact
This affects all Artemis users who test Java assignments. **Ares is not required.**
Students code that gets automatically tested can run arbitrary code in the container,
or arbitrary code on the machine of an assessor in case of manual correction.

### Patches
The problem cannot be resolved easily in Ares itself. Use the Maven Enforcer Plugin as follows:

```xml
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>3.0.0</version>
    <executions>
        <execution>
            <id>enforce-no-student-code-in-trusted-packages</id>
            <phase>process-classes</phase>
            <goals>
                <goal>enforce</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <rules>
            <requireFilesDontExist>
                <files>
                    <!-- ADD HERE THE RULES ARES TELLS YOU ARE MISSING -->
                </files>
            </requireFilesDontExist>
        </rules>
    </configuration>
</plugin>
```

This fails the build if student classes reside in such packages that Ares trusts. Trusted packages added in Ares using `@AddTrustedPackage` should be added as well.

### For more information
If you have any questions or comments about this advisory:
* Open a discussion https://github.com/ls1intum/Ares/discussions
* Open an issue in https://github.com/ls1intum/Ares/issues
* Email us, see https://github.com/ls1intum/Ares/security/policy

### References
See the assignment of Julius that passes the tests in TUM Artemis course: "Test - Praktikum: Grundlagen der Programmierung (Testkurs für Tutoren) - Security Tests" (if that still exists in 2022).

Also see #15 for almost the same problem.
Vulnerability: GHSA-v7cp-5326-54fh
Summary: Path Traversal in bruteser
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T16:45:15Z

Versions of `bruteser` prior to 0.1.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 0.1.0 or later.
Vulnerability: GHSA-2vx6-fcw6-hpr6
Summary: Reference counting error in pyo3
Aliases: CVE-2020-35917
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-416
Published: 2021-08-25T20:49:52Z

An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From<Py<T>>.
Vulnerability: GHSA-xx3h-j3cx-8qfj
Summary: Insufficient Entropy in DotNetNuke
Aliases: CVE-2018-18326
Severity: HIGH
CVSS score: 7.5
CWE: CWE-331
Published: 2019-07-05T21:08:20Z

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.
Vulnerability: GHSA-prfq-f66g-43mp
Summary: Information disclosure through error object in auth0.js
Aliases: CVE-2020-5263
Severity: HIGH
CVSS score: 5.5
CWE: CWE-522
Published: 2020-04-10T18:19:10Z

## Overview
Between versions 8.0.0 and  9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. 

If the error object is exposed or logged without modification, the application risks password exposure.

## Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using Auth0.js version between 8.0.0 and 9.13.1(inclusive).
- You store or display error objects without filtering. 

## How to fix that?
Developers should upgrade auth0.js to version 9.13.2 or later where user inputted passwords are masked in errors. If upgrading is not possible, a temporary fix may include not storing the error object or displaying it publicly without modification.

## Will this update impact my users?

This fix patches the Auth0.js and may require changes in application code due to password no longer available in error object, but it will not impact your users, their current state, or any existing sessions.