TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4gh8-x3vv-phhg
Summary: Predictable SIF UUID Identifiers in github.com/sylabs/sif
Aliases: CVE-2021-29499
Severity: HIGH
CVSS score: 7.5
CWE: CWE-330, CWE-340
Published: 2021-05-18T18:30:38Z

### Impact

The `siftool new` command and [func siftool.New()](https://pkg.go.dev/github.com/sylabs/sif/pkg/siftool#New) produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency.

### Patches
A patch is available in versions 1.2.3 and newer of the module. Users are encouraged to upgrade.

### Workarounds
Users passing [CreateInfo struct](https://pkg.go.dev/github.com/sylabs/sif/pkg/sif#CreateInfo) should ensure the `ID` field is generated using a version of `github.com/satori/go.uuid` that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:

```
go get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557
```
Vulnerability: GHSA-72p5-2r6g-fm6v
Summary: Moderate severity vulnerability that affects total.js
Aliases: CVE-2019-10260
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-02T15:46:52Z

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
Vulnerability: GHSA-g7p5-5759-qv46
Summary: Data leak in Tensorflow
Aliases: CVE-2020-15205
Severity: CRITICAL
CVSS score: 9
CWE: CWE-119, CWE-122, CWE-787
Published: 2020-09-25T18:28:38Z

### Impact
The `data_splits` argument of [`tf.raw_ops.StringNGrams`](https://www.tensorflow.org/api_docs/python/tf/raw_ops/StringNGrams) lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory
```python
>>> tf.raw_ops.StringNGrams(data=["aa", "bb", "cc", "dd", "ee", "ff"], data_splits=[0,8], separator=" ", ngram_widths=[3], left_pad="", right_pad="", pad_width=0, preserve_short_sequences=False)
StringNGrams(ngrams=<tf.Tensor: shape=(6,), dtype=string, numpy=
array([b'aa bb cc', b'bb cc dd', b'cc dd ee', b'dd ee ff',
       b'ee ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00',
       b'ff \xf4j\xa7q\x7f\x00\x00q\x00\x00\x00\x00\x00\x00\x00\xd8\x9b~\xa8q\x7f\x00 \x9b~\xa8q\x7f\x00\x00p\xf5j\xa7q\x7f\x00\x00H\xf8j\xa7q\x7f\x00\x00\xf0\xf3\xf7\x85q\x7f\x00\x00`}\xa6\x00\x00\x00\x00\x00`~\xa6\x00\x00\x00\x00\x00\xb0~\xeb\x9bq\x7f\x00'],...
```

All the binary strings after `ee ff` are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR.

### Patches
We have patched the issue in 0462de5b544ed4731aa2fb23946ac22c01856b80 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-p4cr-64x4-f92f
Summary: Use of Uninitialized Resource in acc_reader.
Aliases: CVE-2020-36514
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:17:23Z

An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.
Vulnerability: GHSA-vxp4-25qp-86qh
Summary: Moderate severity vulnerability that affects ember
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
Vulnerability: GHSA-vcwc-6mr9-8m7c
Summary: Cross-site Scripting in phpmyadmin
Aliases: CVE-2022-23808
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-28T22:36:28Z

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
Vulnerability: GHSA-6c65-xcf5-299x
Summary: Uninitialized memory use in generator
Aliases: CVE-2019-16144
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2021-08-25T20:58:25Z

An issue was discovered in the generator crate before 0.6.18 for Rust. Uninitialized memory is used by Scope, done, and yield_ during API calls.
Vulnerability: GHSA-34f9-hjfq-rr8j
Summary: Overflow and uncaught divide by zero in Tensorflow
Aliases: CVE-2022-21729
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-190
Published: 2022-02-10T00:18:53Z

### Impact 
The [implementation of `UnravelIndex`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/unravel_index_op.cc#L36-L135) is vulnerable to a division by zero caused by an integer overflow bug:

```python
import tensorflow as tf

tf.raw_ops.UnravelIndex(indices=-0x100000,dims=[0x100000,0x100000])
```

### Patches
We have patched the issue in GitHub commit [58b34c6c8250983948b5a781b426f6aa01fd47af](https://github.com/tensorflow/tensorflow/commit/58b34c6c8250983948b5a781b426f6aa01fd47af).
    
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
    
### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-q4h9-46xg-m3x9
Summary: UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable
Severity: CRITICAL
CVSS score: 0
Published: 2021-09-15T20:22:13Z

### Impact

Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.

### Patches

A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

### References

A post-mortem will be published in a few days in the [OpenZeppelin Forum](https://forum.openzeppelin.com/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-vp93-gcx5-4w52
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:21:19Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using `<script>` tags in the method descriptions.


## Recommendation

Upgrade to version 2.2.1 or later.
Vulnerability: GHSA-wqfc-cr59-h64p
Summary: Missing Encryption of Sensitive Data in yarn
Aliases: CVE-2019-5448
Severity: HIGH
CVSS score: 8.1
CWE: CWE-319, CWE-311
Published: 2019-07-31T04:22:15Z

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
Vulnerability: GHSA-w578-j992-554x
Summary: Ansible fails to properly mark lookup-plugin results as unsafe
Aliases: CVE-2017-7481
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2018-09-06T03:28:50Z

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Vulnerability: GHSA-h99w-9q5r-gjq9
Summary: HTTP Request Smuggling in puma
Aliases: CVE-2022-24790
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-444
Published: 2022-03-30T21:48:50Z

When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.

The following vulnerabilities are addressed by this advisory:
- Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings should be rejected and the final encoding must be `chunked`.
- Lenient parsing of malformed `Content-Length` headers and chunk sizes, when only digits and hex digits should be allowed.
- Lenient parsing of duplicate `Content-Length` headers, when they should be rejected.
- Lenient parsing of the ending of chunked segments, when they should end with `\r\n`.

The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. 

These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves.

- Nginx (latest)
- Apache (latest)
- Haproxy 2.5+
- Caddy (latest)
- Traefik (latest)
Vulnerability: GHSA-x2jc-pwfj-h9p3
Summary: SQL Injection in sequelize
Aliases: CVE-2016-10554
Severity: MODERATE
CVSS score: 0
CWE: CWE-89
Published: 2019-02-18T23:54:28Z

Affected versions of `sequelize` use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability.


## Recommendation

Update to version 1.7.0-alpha3 or later.
Vulnerability: GHSA-8928-2fgm-6x9x
Summary: HTTP Request Smuggling in actix-http
Aliases: CVE-2021-38512
Severity: HIGH
CVSS score: 7.5
CWE: CWE-444
Published: 2021-08-25T20:58:21Z

Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling (HRS) attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also vulnerable.

Popular front-end proxies and load balancers already mitigate HRS attacks so it is recommended that they are also kept up to date; check your specific set up. You should upgrade even if the front-end proxy receives exclusively HTTP/2 traffic and connects to the back-end using HTTP/1; several downgrade attacks are known that can also expose HRS vulnerabilities.
Vulnerability: GHSA-r6ff-2q3c-v3pv
Summary: Compiler optimisation leads to SEGFAULT
Severity: MODERATE
CVSS score: 6
CWE: CWE-908
Published: 2021-08-25T21:00:01Z

Affected versions of the `pnet` crate were optimized out by compiler, which caused dereference of uninitialized file descriptor which caused segfault.
Vulnerability: GHSA-g9fw-9x87-rmrj
Summary: Privilege Context Switching Error in Elasticsearch
Aliases: CVE-2020-7020
Severity: LOW
CVSS score: 3.1
CWE: CWE-270, CWE-269
Published: 2021-03-18T19:27:13Z

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
Vulnerability: GHSA-2x32-jm95-2cpx
Summary: Authentication Bypass in dex
Aliases: CVE-2020-27847
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-228, CWE-290
Published: 2021-12-20T17:52:12Z

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
Vulnerability: GHSA-9wvh-ff5f-xjpj
Summary: Missing Authorization in Harbor
Aliases: CVE-2019-16097
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-862
Published: 2022-02-15T01:57:18Z

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API. This is fixed in 1.9.0-rc1.
Vulnerability: GHSA-3jmw-c69h-426c
Summary: Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Aliases: CVE-2021-39133
Severity: HIGH
CVSS score: 7.2
CWE: CWE-352
Published: 2021-09-01T18:26:48Z

### Impact

A user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.

### Patches
Available in Rundeck 3.4.3 and 3.3.14


### Workarounds

Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)
Vulnerability: GHSA-g6vq-wc8w-4g69
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4015
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-12-06T17:19:18Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-9x6q-5423-w5v9
Summary: Ansible fails to cache SSH host keys
Aliases: CVE-2013-2233
Severity: HIGH
CVSS score: 7.4
Published: 2018-10-10T17:23:39Z

Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.
Vulnerability: GHSA-hrj5-qp7x-rpg6
Summary: SQL Injection in marginalia
Aliases: CVE-2019-1010191
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-07-26T16:10:15Z

marginalia < 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is: Hacker inputs a SQL to a vulnerable vector(header, http parameter, etc). The fixed version is: 1.6.
Vulnerability: GHSA-6g33-f262-xjp4
Summary: Cryptographically Weak PRNG in randomatic
Aliases: CVE-2017-16028
Severity: LOW
CVSS score: 0
CWE: CWE-330
Published: 2018-10-09T00:57:21Z

Affected versions of `randomatic` generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended.




## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-r5jw-62xg-j433
Summary: Cross-Site Scripting in Kaminari
Aliases: CVE-2020-11082
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2020-05-28T21:10:11Z

### Impact
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.

### Releases
The 1.2.1 gem including the patch has already been released.
All past released versions are affected by this vulnerability.

### Workarounds
Application developers who can't update the gem can workaround by overriding the `PARAM_KEY_EXCEPT_LIST` constant.

```ruby
module Kaminari::Helpers
  PARAM_KEY_EXCEPT_LIST = [:authenticity_token, :commit, :utf8, :_method, :script_name, :original_script_name].freeze
end
```

### Credits
Thanks to Daniel Mircea for finding the issue and sending a patch via GitHub. Also thanks to Aditya Prakash for reporting the vulnerability.
Vulnerability: GHSA-xcjx-m2pj-8g79
Summary: Manipulated inline images can cause Infinite Loop in PyPDF2
Aliases: CVE-2022-24859
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-835
Published: 2022-04-22T20:54:41Z

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code:

```python
from PyPDF2 import PdfFileReader, PdfFileWriter
from PyPDF2.pdf import ContentStream

reader = PdfFileReader("malicious.pdf", strict=False)
for page in reader.pages:
    ContentStream(page.getContents(), reader)
```

### Patches

[`PyPDF2==1.27.5`](https://pypi.org/project/PyPDF2) and later are patched.

Credits to [Sebastian Krause](https://github.com/sekrause) for finding ([issue](https://github.com/py-pdf/PyPDF2/issues/329)) and fixing ([PR](https://github.com/py-pdf/PyPDF2/pull/740)) it.
Vulnerability: GHSA-hw4v-5x4h-c3xm
Summary: Transaction validity oversight in pallet-ethereum
Aliases: CVE-2021-39193
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-09-01T18:22:48Z

### Impact

A bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints.

### Patches

Patches are applied in PR #465.

### Workarounds

None.

### References

Patch PR: https://github.com/paritytech/frontier/pull/465

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)
Vulnerability: GHSA-mqgv-67vx-g4m5
Summary: Prototype Pollution in js-data
Aliases: CVE-2020-28442
Severity: HIGH
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-02-09T22:45:52Z

All versions of package js-data prior to 3.0.10 are vulnerable to Prototype Pollution via the deepFillIn function.
Vulnerability: GHSA-x2w5-5m2g-7h5m
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14720
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502, CWE-611
Published: 2019-01-04T19:09:46Z

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Vulnerability: GHSA-g42g-737j-qx6j
Summary: Access Restriction Bypass in kube-apiserver
Aliases: CVE-2021-25735
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863, CWE-284
Published: 2021-12-16T19:55:25Z

A vulnerability in Kubernetes `kube-apiserver` could allow node updates to bypass a _Validating Admission Webhook_ and allow unauthorized node updates. The information that is provided to the admission controller could contain old configurations that overwrite values used for validation. Since the overwriting takes place before the validation, this could lead the admission controller to accept requests that should be blocked. The vulnerability can be exploited when an update action on node resources is performed and an admission controller is in place and configured to validate the action.

Users are only affected by this vulnerability if they are running a _Validating Admission Webhook_ for Nodes that denies admission based partially on the old state of the Node object. It only impacts validating admission plugins that rely on old values in certain fields and does not impact calls from kubelets that go through the built-in NodeRestriction admission plugin.
Vulnerability: GHSA-22q9-hqm5-mhmc
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:22:24Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests. The request is meant to respond with Content-Type `application/json` which does not trigger the vulnerability but if the web server changes the header to `text/html` it may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.2.1 or later.
Vulnerability: GHSA-99wh-973f-779p
Summary: XML External Entity Reference in Hazelcast
Aliases: CVE-2022-0265
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2022-03-04T00:00:15Z

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
Vulnerability: GHSA-r6pg-pjwc-j585
Summary: Null pointer dereference in `SparseFillEmptyRows`
Aliases: CVE-2021-29565
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:25:11Z

### Impact
An attacker can trigger a null pointer dereference in the implementation of `tf.raw_ops.SparseFillEmptyRows`:

```python
import tensorflow as tf

indices = tf.constant([], shape=[0, 0], dtype=tf.int64)
values = tf.constant([], shape=[0], dtype=tf.int64)
dense_shape = tf.constant([], shape=[0], dtype=tf.int64)
default_value = 0
    
tf.raw_ops.SparseFillEmptyRows(
    indices=indices, values=values, dense_shape=dense_shape,
    default_value=default_value)
```

This is because of missing [validation](https://github.com/tensorflow/tensorflow/blob/fdc82089d206e281c628a93771336bf87863d5e8/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L230-L231) that was covered under a `TODO`. If the `dense_shape` tensor is empty, then `dense_shape_t.vec<>()` would cause a null pointer dereference in the implementation of the op:

```cc
template <typename T, typename Tindex>
struct SparseFillEmptyRows<CPUDevice, T, Tindex> {
  Status operator()(OpKernelContext* context, const Tensor& default_value_t,
                    const Tensor& indices_t, const Tensor& values_t,
                    const Tensor& dense_shape_t,
                    typename AsyncOpKernel::DoneCallback done) {
    ...
    const auto dense_shape = dense_shape_t.vec<Tindex>();
    ... 
  }
}
``` 

### Patches
We have patched the issue in GitHub commit [faa76f39014ed3b5e2c158593b1335522e573c7f](https://github.com/tensorflow/tensorflow/commit/faa76f39014ed3b5e2c158593b1335522e573c7f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-pwpr-vp2v-99xw
Summary: Out-of-bounds write
Aliases: CVE-2019-1138
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:56:11Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1217, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
Vulnerability: GHSA-3xg5-6c3j-vp8x
Summary: Improper Restriction of XML External Entity Reference in Quokka
Aliases: CVE-2020-18703
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2021-08-30T16:23:34Z

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.
Vulnerability: GHSA-fx6f-fpfv-5hmc
Summary: Malicious Package in uploader-plugin
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:10:12Z

Version 1.0.2 of `uploader-plugin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-px9f-597f-wmcf
Summary: Uncontrolled Resource Consumption in Apache OpenMeetings server
Aliases: CVE-2021-27576
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-16T17:43:36Z

If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0
Vulnerability: GHSA-m794-qv59-gj7c
Summary: Malicious Package in signqle
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:03:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7pxj-m4jf-r6h2
Summary: Missing validation during checkpoint loading
Aliases: CVE-2021-41203
Severity: HIGH
CVSS score: 7.8
CWE: CWE-345
Published: 2021-11-10T19:12:46Z

### Impact
An attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow.

This is because the checkpoints loading infrastructure is missing validation for invalid file formats.

### Patches
We have patched the issue in GitHub commits [b619c6f865715ca3b15ef1842b5b95edbaa710ad](https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad), [e8dc63704c88007ee4713076605c90188d66f3d2](https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2), [368af875869a204b4ac552b9ddda59f6a46a56ec](https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec), and [abcced051cb1bd8fb05046ac3b6023a7ebcc4578](https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578).

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-q2x5-6q7q-r872
Summary: Use After Free in tremor-script
Aliases: CVE-2021-45701
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2022-01-06T22:10:17Z

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
Vulnerability: GHSA-747p-jfqv-f43r
Summary: Downloads Resources over HTTP in mystem3
Aliases: CVE-2016-10626
Severity: HIGH
CVSS score: 8.1
CWE: CWE-311
Published: 2019-02-18T23:47:26Z

Affected versions of `mystem3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem3`.


## Recommendation

Update to version 1.0.8 or later.
Vulnerability: GHSA-m34x-wgrh-g897
Summary: Directory traversal vulnerability in Next.js
Aliases: CVE-2018-6184
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-01-24T19:38:52Z

Next.js 4 before 4.2.3 has Directory Traversal under the `/_next` request namespace.
Vulnerability: GHSA-f5c9-x9j6-87qp
Summary: Prototype pollution in dotty
Aliases: CVE-2021-25912
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2021-02-05T20:43:08Z

Prototype pollution vulnerability in 'dotty' before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-mfv7-gq43-w965
Summary: Incomplete List of Disallowed Inputs in Kubernetes
Aliases: CVE-2021-25737
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-184, CWE-601
Published: 2021-09-07T23:09:24Z

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
Vulnerability: GHSA-m63j-wh5w-c252
Summary: Critical severity vulnerability that affects actionview
Aliases: CVE-2019-5419
Severity: CRITICAL
CVSS score: 7.5
CWE: CWE-400
Published: 2019-03-13T17:25:55Z

# Denial of Service Vulnerability in Action View

Impact 
------ 
Specially crafted accept headers can cause the Action View template location 
code to consume 100% CPU, causing the server unable to process requests.  This 
impacts all Rails applications that render views. 

All users running an affected release should either upgrade or use one of the 
workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are 
available at the normal locations. 

Workarounds 
----------- 
This vulnerability can be mitigated by wrapping `render` calls with 
`respond_to` blocks.  For example, the following example is vulnerable: 

``` 
class UserController < ApplicationController 
  def index 
    render "index" 
  end 
end 
``` 

But the following code is not vulnerable: 

``` 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Implicit rendering is impacted, so this code is vulnerable: 

``` 
class UserController < ApplicationController 
  def index 
  end 
end 
``` 

But can be changed this this: 

``` 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Alternatively to specifying the format, the following monkey patch can be 
applied in an initializer: 

``` 
$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end) 
``` 

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported 
at present. Users of earlier unsupported releases are advised to upgrade as 
soon as possible as we cannot guarantee the continued availability of security 
fixes for unsupported releases. 

Also note that the patches for this vulnerability are the same as CVE-2019-5418. 

Credits 
------- 
Thanks to John Hawthorn <john@hawthorn.email> of GitHub
Vulnerability: GHSA-9p3v-wf2w-v29c
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2009-4214
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
Vulnerability: GHSA-62fx-3v4f-mwxm
Summary: Bypass of sitemp access restrictions
Aliases: CVE-2019-8133
Severity: MODERATE
CVSS score: 6.5
Published: 2019-11-12T22:59:40Z

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to generate sitemaps can bypass configuration that restricts directory access. The bypass allows overwrite of a subset of configuration files which can lead to denial of service.
Vulnerability: GHSA-49wp-qq6x-g2rf
Summary: Cross-site Request Forgery in fastify-csrf
Aliases: CVE-2020-28482
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2021-01-20T21:30:34Z

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection.
1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: `cookieOpts: { path: '/', sameSite: true }`
2. The CSRF token was available in the GET query parameter
Vulnerability: GHSA-p75f-g7gx-2r7p
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
Aliases: CVE-2021-21336
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2021-03-08T20:38:35Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

There is no workaround. Users are encouraged to upgrade.

### References
_Are there any links users can visit to find out more?_

- [GHSA-p75f-g7gx-2r7p](https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7p)
- [Products.PluggableAuthService on PyPI](https://github.com/zopefoundation/Products.PluggableAuthService)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Products.PluggableAuthService issue tracker](https://github.com/zopefoundation/Products.PluggableAuthService/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-ww97-9w65-2crx
Summary: Improper Input Validation in Apache Solr
Aliases: CVE-2019-17558
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-74, CWE-94, CWE-20
Published: 2020-02-12T18:45:28Z

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
Vulnerability: GHSA-rgx6-rjj4-c388
Summary: Cross-site Scripting in ckeditor4
Aliases: CVE-2021-33829
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-21T17:16:42Z

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Vulnerability: GHSA-xp63-6vf5-xf3v
Summary: Command injection in codecov (npm package)
Aliases: CVE-2020-15123
Severity: MODERATE
CVSS score: 9.3
CWE: CWE-78
Published: 2020-07-20T17:20:20Z

### Impact

The `upload` method has a command injection vulnerability. Clients of the `codecov-node` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

A similar CVE was issued: [CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh), but the fix was incomplete. It only blocked `&`, and command injection is still possible using backticks instead to bypass the sanitizer.

We have written a [CodeQL](https://codeql.com) query, which automatically detects this vulnerability. You can see the results of the query on the `codecov-node` project [here](https://lgtm.com/query/7714424068617023832/).


### Patches
This has been patched in version 3.7.1

### Workarounds

None, however, the attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection. 

### References
*  [CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh)

### For more information
If you have any questions or comments about this advisory:
* Contact us via our [Security Email](mailto:security@codecov.io)
Vulnerability: GHSA-x7wr-283h-5h2v
Summary: Out-of-bounds Read in Onionshare
Aliases: CVE-2022-21688
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2022-01-21T23:20:29Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-014
- Vulnerability type: Out-of-bounds Read
- Threat level: Elevated

## Description:

The desktop application was found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing.

## Technical description:

Prerequisites:

- Onion address is known
- Public service or authentication is valid
- Desktop application is used
- History is displayed

The rendering of images found in OTF-001 (page 25) could be elevated to a Denial of Service, which requires only very few bytes to be sent as a path parameter to any of the Onionshare functions. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. The issue is in the process of disclosure to the QT security mailing list. More details will be provided after a fixed QT build has been deployed.

## Impact:

An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated.

## Recommendation:

- Monitor for upstream fix
- Fix OTF-001 (page 25) as a workaround
Vulnerability: GHSA-qhv9-728r-6jqg
Summary: ReDoS via long string of semicolons in tough-cookie
Aliases: CVE-2016-1000232
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2018-10-10T18:57:02Z

Affected versions of `tough-cookie` may be vulnerable to regular expression denial of service when long strings of semicolons exist in the `Set-Cookie` header.


## Recommendation

Update to version 2.3.0 or later.
Vulnerability: GHSA-6q4w-3wp4-q5wf
Summary: Denial of Service in get-ip-range
Aliases: CVE-2021-27191
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-13T15:15:57Z

The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion. Update get-ip-range dependency to 4.0.0 or above.
Vulnerability: GHSA-q3vw-4jx3-rrr2
Summary: Validation bypass vulnerability 
Severity: LOW
CVSS score: 0
Published: 2020-09-23T17:20:09Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-xj62-87pg-vcv3
Summary: Regular Expression Denial of Service in jshamcrest
Aliases: CVE-2016-10521
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2019-02-18T23:38:51Z

The `jshamcrest` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in to the emailAddress validator.


## Proof of concept

```
var js = require('jshamcrest')
var emailAddress = new js.JsHamcrest.Matchers.emailAddress();


var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=1;i<=10000000;i=i+1) {
    console.log("COUNT: " + i);
    var str = '66666666666666666666666666666@ffffffffffffffffffffffffffffffff.' + genstr(i, 'a') + '{'
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    emailAddress.matches(str)

    var end = process.hrtime(start);
    console.log(end);
}
```

### Results
It takes about 116 characters to get a 1.6 second event loop block.
```
[ 1, 633084590 ]
COUNT: 51
LENGTH: 116
```

# Timeline
- October 25, 2015 - Vulnerability Identified
- October 25, 2015 - Maintainers notified (no response)


## Recommendation

The `jshamcrest` package currently has no patched versions available.

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=validator).
Vulnerability: GHSA-hqm2-gwqf-r5g5
Summary: SQL injection in TYPO3 extension
Aliases: CVE-2021-38302
Severity: CRITICAL
CVSS score: 3.9
CWE: CWE-89
Published: 2021-09-02T17:17:06Z

It has been discovered that the extension is susceptible to SQL Injection when processing bounced emails.
Vulnerability: GHSA-p44j-xrqg-4xrr
Summary: URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService
Aliases: CVE-2021-21337
Severity: LOW
CVSS score: 0
CWE: CWE-601
Published: 2021-03-08T21:06:23Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to the login form and login functionality could redirect the browser to a different website.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1`  and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1"`

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

There is no workaround. Users are encouraged to upgrade.

### References
_Are there any links users can visit to find out more?_

- [GHSA-p44j-xrqg-4xrr](https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr)
- [Products.PluggableAuthService on PyPI](https://pypi.org/project/Products.PluggableAuthService/)
- [OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Products.PluggableAuthService issue tracker](https://github.com/zopefoundation/Products.PluggableAuthService/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-wcg3-cvx6-7396
Summary: Segmentation fault in time
Aliases: CVE-2020-26235
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-476
Published: 2021-08-25T20:56:46Z

### Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

- `time::UtcOffset::local_offset_at`
- `time::UtcOffset::try_local_offset_at`
- `time::UtcOffset::current_local_offset`
- `time::UtcOffset::try_current_local_offset`
- `time::OffsetDateTime::now_local`
- `time::OffsetDateTime::try_now_local`

The affected functions in time 0.1 (all versions) are:

- `at`
- `at_utc`
- `now`

Non-Unix targets (including Windows and wasm) are unaffected.

### Patches

Pending a proper fix, the internal method that determines the local offset has been modified to always return `None` on the affected operating systems. This has the effect of returning an `Err` on the `try_*` methods and `UTC` on the non-`try_*` methods.

Users and library authors with time in their dependency tree should perform `cargo update`, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3. series.

### Workarounds

No workarounds are known.

### References

time-rs/time#293
Vulnerability: GHSA-77cr-6gr8-7rr9
Summary: Use After Free in HashiCorp Nomad
Aliases: CVE-2020-27195
Severity: CRITICAL
CVSS score: 7.1
CWE: CWE-416
Published: 2022-02-15T01:57:18Z

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
Vulnerability: GHSA-75pc-qvwc-jf3g
Summary: Improper Input Validation in HashiCorp Vault
Aliases: CVE-2020-12757
Severity: HIGH
CVSS score: 4
CWE: CWE-20
Published: 2021-05-18T18:20:48Z

HashiCorp Vault and Vault Enterprise 1.4.x before 1.4.2 has Incorrect Access Control.
Vulnerability: GHSA-j9wr-49vq-rm5g
Summary: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Severity: HIGH
CVSS score: 8.6
CWE: CWE-402
Published: 2021-04-19T14:46:49Z

Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

- https://vaadin.com/security/cve-2021-31407
Vulnerability: GHSA-7qg7-6g3g-8vxg
Summary: Malicious Package in bwffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:46:25Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-q99r-j969-6jwr
Summary: Out-of-bounds write
Aliases: CVE-2019-1237
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:56:04Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1298, CVE-2019-1300.