TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-h395-qcrw-5vmq
Summary: Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin
Aliases: CVE-2020-28483
Severity: HIGH
CVSS score: 7.1
CWE: CWE-113, CWE-444
Published: 2021-06-23T17:53:21Z

This affects all versions of package github.com/gin-gonic/gin under 1.7.0. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
Vulnerability: GHSA-whr9-vfh2-7hm6
Summary: Memory corruption in `DrawBoundingBoxesV2`
Aliases: CVE-2021-29571
Severity: MODERATE
CVSS score: 4.5
CWE: CWE-787
Published: 2021-05-21T14:25:28Z

### Impact
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs:

```python
import tensorflow as tf

images = tf.fill([10, 96, 0, 1], 0.)
boxes = tf.fill([10, 53, 0], 0.)
colors = tf.fill([0, 1], 0.)

tf.raw_ops.DrawBoundingBoxesV2(images=images, boxes=boxes, colors=colors)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/31bd5026304677faa8a0b77602c6154171b9aec1/tensorflow/core/kernels/image/draw_bounding_box_op.cc#L116-L130) assumes that the last element of `boxes` input is 4, as required by [the op](https://www.tensorflow.org/api_docs/python/tf/raw_ops/DrawBoundingBoxesV2). Since this is not checked attackers passing values less than 4 can write outside of bounds of heap allocated objects and cause memory corruption:

```cc 
const auto tboxes = boxes.tensor<T, 3>();
for (int64 bb = 0; bb < num_boxes; ++bb) {
  ...
  const int64 min_box_row = static_cast<float>(tboxes(b, bb, 0)) * (height - 1);
  const int64 max_box_row = static_cast<float>(tboxes(b, bb, 2)) * (height - 1);
  const int64 min_box_col = static_cast<float>(tboxes(b, bb, 1)) * (width - 1);
  const int64 max_box_col = static_cast<float>(tboxes(b, bb, 3)) * (width - 1);
  ...
}
``` 

If the last dimension in `boxes` is less than 4, accesses similar to `tboxes(b, bb, 3)` will access data outside of bounds. Further during code execution there are also writes to these indices.

### Patches
We have patched the issue in GitHub commit [79865b542f9ffdc9caeb255631f7c56f1d4b6517](https://github.com/tensorflow/tensorflow/commit/79865b542f9ffdc9caeb255631f7c56f1d4b6517).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-97wf-p777-86jq
Summary: Division by zero in TFLite's implementation of Split
Aliases: CVE-2021-29599
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:28:01Z

### Impact
The implementation of the `Split` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/e2752089ef7ce9bcf3db0ec618ebd23ea119d0c7/tensorflow/lite/kernels/split.cc#L63-L65):

```cc
TF_LITE_ENSURE_MSG(context, input_size % num_splits == 0, "Not an even split");
const int slice_size = input_size / num_splits;
```

An attacker can craft a model such that `num_splits` would be 0.

### Patches
We have patched the issue in GitHub commit [b22786e7e9b7bdb6a56936ff29cc7e9968d7bc1d](https://github.com/tensorflow/tensorflow/commit/b22786e7e9b7bdb6a56936ff29cc7e9968d7bc1d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-vwfg-qj3r-6v3r
Summary: Moderate severity vulnerability that affects actionpack
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:57:47Z

Withdrawn, accidental duplicate publish.

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Vulnerability: GHSA-3f95-r44v-8mrg
Summary: Command injection in simple-git
Aliases: CVE-2022-24433
Severity: HIGH
CVSS score: 8.1
CWE: CWE-74, CWE-77
Published: 2022-03-12T00:00:33Z

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.
Vulnerability: GHSA-387v-84cv-9qmc
Summary: Moderate severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2017-3163
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-10-18T16:40:43Z

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to craft a special request involving path traversal, leaving any file readable to the Solr server process exposed. Solr servers protected and restricted by firewall rules and/or authentication would not be at risk since only trusted clients and users would gain direct HTTP access.
Vulnerability: GHSA-9fp7-4fjm-q3mf
Summary: Prototype Pollution in keyget
Aliases: CVE-2021-23760
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-1321
Published: 2022-02-01T00:51:01Z

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)
Vulnerability: GHSA-qmw8-3v4g-gwj4
Summary: Prefix escape
Aliases: CVE-2021-21321
Severity: CRITICAL
CVSS score: 10
CWE: CWE-20
Published: 2021-03-03T01:52:05Z

### Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is.

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

### Patches

A patch have been submitted by Corey Farrell git@cfware.com, the reporter.
All releases after v4.0.2 include the fix.

### Workarounds

There are no workaround available.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-reply-from](https://github.com/fastify/fastify-reply-from)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-h9mj-fghc-664w
Summary: Denial of Service in mqtt
Aliases: CVE-2017-10910
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-674
Published: 2017-12-28T22:51:58Z

Affected versions of `mqtt` do not properly handle PUBLISH packets returning from the server, leading to a Denial of Service condition.

The vulnerability is completely mitigated if the only connected servers are trusted, guaranteed not to be under the control of a malicious actor.

## Proof of Concept

The following is a demonstration of how to generate the malicious packet sequence, but does not include information on handling the initial network connections and MQTT overhead.
```
var mqttp = require('mqtt-packet');
var packets = [];
for(var i=0; i<=1000;i++){
    packets.push(
        mqttp.generate({
            cmd:'publish',
            topic:Buffer.from('hello'),
            payload:Buffer.from('world'),
            retain: false,
            dup: false, 
            messageId: ++i, 
            qos: 1
        })
    )
}

```


## Recommendation

Update to version 2.15.0 or later.
Vulnerability: GHSA-v592-xf75-856p
Summary: Erroneous Proof of Work calculation in geth
Aliases: CVE-2020-26240
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-682
Published: 2021-06-29T21:12:56Z

### Impact
An ethash mining DAG generation flaw in Geth could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected.

### Patches
This issue is also fixed as of 1.9.24. Thanks to @slavikus for bringing the issue to our attention and writing the fix. 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-4cx6-fj7j-pjx9
Summary: Code injection in Stripe CLI on windows
Aliases: CVE-2022-24753
Severity: HIGH
CVSS score: 7.7
CWE: CWE-78
Published: 2022-03-10T18:17:50Z

### Impact
A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected.

An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.

There has been no evidence of exploitation of this vulnerability.

### Recommendation
Upgrade to Stripe CLI v1.7.13.

### Acknowledgments
Thanks to [trungpabc](https://hackerone.com/trungpabc) for reporting the issue.

### For more information
Email us at [security@stripe.com](mailto:security@stripe.com).
Vulnerability: GHSA-356r-77q8-f64f
Summary: Cross-Site Request Forgery in firefly-iii
Aliases: CVE-2021-3819
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-09-29T17:12:37Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). This has been mitigated in version 5.6.1
Vulnerability: GHSA-38fc-9xqv-7f7q
Summary: Moderate severity vulnerability that affects SQLAlchemy
Aliases: CVE-2019-7548
Severity: HIGH
CVSS score: 7.8
CWE: CWE-89
Published: 2019-04-16T15:50:39Z

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
Vulnerability: GHSA-5w9c-rv96-fr7g
Summary: Removal of functional code in faker.js
Severity: HIGH
CVSS score: 0
Published: 2022-03-22T19:28:24Z

Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js [CVE-2021-23567](https://github.com/advisories/GHSA-gh88-3pxp-6fm8). 

The functional code for this package was forked and can be found [here](https://github.com/faker-js/faker).
Vulnerability: GHSA-c7f6-4vx5-4263
Summary: Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP
Aliases: CVE-2020-15839
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-434
Published: 2022-02-10T20:46:21Z

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Vulnerability: GHSA-v7wg-cpwc-24m4
Summary:  Unchecked Class Instantiation when providing Plugin Classes
Aliases: CVE-2022-21724
Severity: HIGH
CVSS score: 7
CWE: CWE-665, CWE-668, CWE-74
Published: 2022-02-02T00:04:20Z

pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties. However, the driver did not verify if the class implements the expected interface before instantiating the class. The first impacted version is REL9.4.1208 (it introduced `socketFactory` connection property).
Vulnerability: GHSA-qrwc-jxf5-g8x6
Summary: Out of bounds read in ordnung
Aliases: CVE-2020-35890
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2021-08-25T20:48:40Z

An issue was discovered in the ordnung crate through 2020-09-03 for Rust. compact::Vec violates memory safety via out-of-bounds access for large capacity.
Vulnerability: GHSA-738m-f33v-qc2r
Summary: SMTP Injection in PHPMailer
Aliases: CVE-2015-8476
Severity: LOW
CVSS score: 0
CWE: CWE-20
Published: 2020-03-05T22:09:19Z

### Impact
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.

### Patches
Fixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).

### Workarounds
Manually strip line breaks from email addresses before passing them to PHPMailer.

### References
https://nvd.nist.gov/vuln/detail/CVE-2015-8476

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-fqrr-rrwg-69pv
Summary: Low severity vulnerability that affects paratrooper-pingdom
Aliases: CVE-2014-1233
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

The paratrooper-pingdom gem 1.0.0 for Ruby allows local users to obtain the App-Key, username, and password values by listing the curl process.
Vulnerability: GHSA-mmj4-777p-fpq9
Summary: Validation bypass in frourio-express
Aliases: CVE-2022-23624
Severity: HIGH
CVSS score: 8.1
CWE: CWE-20
Published: 2022-02-07T22:38:37Z

## 日本語

### 影響
v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。

### パッチ
frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。

### ワークアラウンド
controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。

### さらなる情報

このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。
* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。

## English

### Impact
Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)

### Patches
Please update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.

### Workarounds
Validate objects from request with class-transformer in controllers by yourself, or prevent using validators.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [frourio](https://github.com/frouriojs/frourio)
Vulnerability: GHSA-q97v-764g-r2rp
Summary: High severity vulnerability that affects gollum and gollum-lib
Aliases: CVE-2014-9489
Severity: HIGH
CVSS score: 8.8
CWE: CWE-284
Published: 2017-11-16T01:47:37Z

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.
Vulnerability: GHSA-mf6x-7mm4-x2g7
Summary: Out-of-bounds Read in stringstream
Aliases: CVE-2018-21270
Severity: MODERATE
CVSS score: 0
CWE: CWE-125
Published: 2019-06-20T18:22:32Z

All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.
Vulnerability: GHSA-4vmm-mhcq-4x9j
Summary: Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
Severity: CRITICAL
CVSS score: 10
Published: 2019-06-14T16:15:14Z

Versions of `constantinople` prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.


## Recommendation

Update to version 3.1.1 or later.
Vulnerability: GHSA-q65m-pv3f-wr5r
Summary: XSS in Bleach when noscript and raw tag whitelisted
Aliases: CVE-2020-6802
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-02-24T17:33:44Z

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with `noscript` and a raw tag (see below) in the allowed/whitelisted tags option.

### Patches

v3.1.1

### Workarounds

* modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags:

```
title
textarea
script
style
noembed
noframes
iframe
xmp
```

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1615315
* https://cure53.de/fp170.pdf
* https://nvd.nist.gov/vuln/detail/CVE-2020-6802
* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)
Vulnerability: GHSA-crh4-294p-vcfq
Summary: Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-19T14:53:20Z

Unsafe validation RegEx in `EmailField` component in `com.vaadin:vaadin-text-field-flow` versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2021-31405
Vulnerability: GHSA-v66p-w7qx-wv98
Summary: Authentication Bypass in express-laravel-passport
Severity: CRITICAL
CVSS score: 0
CWE: CWE-287
Published: 2020-09-04T17:29:34Z

All versions of `express-laravel-passport` are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users.


## Recommendation

Upgrade to version 2.0.5 or later.
Vulnerability: GHSA-g25h-jr74-qp5j
Summary: Incomplete validation in `QuantizeV2`
Aliases: CVE-2021-37663
Severity: HIGH
CVSS score: 7.8
CWE: CWE-20
Published: 2021-08-25T14:42:23Z

### Impact                                                                                                                                                                                                                                                                                
Due to incomplete validation in `tf.raw_ops.QuantizeV2`, an attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:

```python
import tensorflow as tf

tf.raw_ops.QuantizeV2(
  input=[1,2,3],
  min_range=[1,2],
  max_range=[],
  T=tf.qint32,
  mode='SCALED',
  round_mode='HALF_AWAY_FROM_ZERO',
  narrow_range=False,
  axis=1,
  ensure_minimum_range=3)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/quantize_op.cc#L59) has some validation but does not check that `min_range` and `max_range` both have the same non-zero number of elements. If `axis` is provided (i.e., not `-1`), then validation should check that it is a value in range for the rank of `input` tensor and then the lengths of `min_range` and `max_range` inputs match the `axis` dimension of the `input` tensor.
  
### Patches
We have patched the issue in GitHub commit [6da6620efad397c85493b8f8667b821403516708](https://github.com/tensorflow/tensorflow/commit/6da6620efad397c85493b8f8667b821403516708).
  
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-m2q3-53fq-7h66
Summary: Moderate severity vulnerability that affects gollum
Aliases: CVE-2015-7314
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2018-08-28T22:33:51Z

The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Vulnerability: GHSA-qc55-vm3j-74gp
Summary: JSNAPy allows unprivileged local users to alter files under the directory
Aliases: CVE-2018-0023
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-276
Published: 2018-07-12T20:30:36Z

JSNAPy is an open source python version of Junos Snapshot Administrator developed by Juniper available through github. The default configuration and sample files of JSNAPy automation tool versions prior to 1.3.0 are created world writable. This insecure file and directory permission allows unprivileged local users to alter the files under this directory including inserting operations not intended by the package maintainer, system administrator, or other users. This issue only affects users who downloaded and installed JSNAPy from github.
Vulnerability: GHSA-gpfj-4j6g-c4w9
Summary: Clipboard-based DOM-XSS
Aliases: CVE-2021-37700
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2021-08-12T20:42:17Z

### Impact

A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected.

The following @github/paste-markdown code snippet is triggered when the user pastes something and the browser's clipboard data contains an entry whose content-type is **text/HTML**.

```typescript
function generateText(transfer: DataTransfer): string | undefined {
  if (Array.from(transfer.types).indexOf('text/html') === -1) return

  let html = transfer.getData('text/html')
  if (!/<table/i.test(html)) return

  html = html.replace(/<meta.*?>/, '')

  const el = document.createElement('div')
  el.innerHTML = html
  const tables = el.querySelectorAll('table')

  for (const table of tables) {
    if (table.closest('[data-paste-markdown-skip]')) {
      table.replaceWith(new Text(table.textContent || ''))
    }
    const formattedTable = tableMarkdown(table)
    table.replaceWith(new Text(formattedTable))
  }

  return el.innerHTML
}
```

### Patches
A security patch was released in [version 0.3.4](https://github.com/github/paste-markdown/releases/tag/v0.3.4).

### Workarounds
A Content Security Policy that prevents `unsafe-inline` helps reduce the likelihood of this vulnerability being exploited in modern browsers.

<!--
### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
*
-->
Vulnerability: GHSA-hfvc-g252-rp4g
Summary: Denial of Service in i18n
Aliases: CVE-2020-7791
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-20, CWE-400
Published: 2020-12-14T19:50:22Z

This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.
Vulnerability: GHSA-38h8-x697-gh8q
Summary: Tmp files readable by other users in sync-exec
Aliases: CVE-2017-16024
Severity: MODERATE
CVSS score: 0
CWE: CWE-377
Published: 2018-11-09T17:45:30Z

Affected versions of `sync-exec` use files located in `/tmp/` to buffer command results before returning values. As `/tmp/` is almost always set with world readable permissions, this may allow low privilege users on the system to read the results of commands run via `sync-exec` under a higher privilege user.


## Recommendation

There is currently no direct patch for `sync-exec`, as the `child_process.execSync` function provided in Node.js v0.12.0 and later provides the same functionality natively. 

The best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of `sync-exec` to `child_process.execSync()`.
Vulnerability: GHSA-6qc7-jgq7-34rf
Summary: Malicious Package in exprss
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:18:18Z

All versions of `exprss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-x64g-wjmw-w328
Summary: Moderate severity vulnerability that affects ironic-discoverd
Aliases: CVE-2015-5306
Severity: MODERATE
CVSS score: 0
Published: 2019-07-05T21:10:52Z

OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
Vulnerability: GHSA-qh3m-qw6v-qvhg
Summary: Moderate severity vulnerability that affects io.vertx:vertx-core
Aliases: CVE-2018-12544
Severity: MODERATE
CVSS score: 0
CWE: CWE-611
Published: 2018-10-17T16:20:32Z

In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks. This mechanism is exclusively when the developer uses the Eclipse Vert.x OpenAPI XML type validator to validate a provided schema.
Vulnerability: GHSA-p68v-frgx-4rjp
Summary: Denial of Service via Cache Flooding
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2020-10-19T21:34:14Z

### Impact
 Denial of Service via Cache Flooding

### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
Vulnerability: GHSA-pxcf-v868-m492
Summary: Injection and Cross-site Scripting in osm-static-maps
Aliases: CVE-2020-7749
Severity: HIGH
CVSS score: 7.6
CWE: CWE-74, CWE-79
Published: 2021-05-10T18:43:45Z

This affects all versions of package osm-static-maps under 3.9.0. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
Vulnerability: GHSA-9prh-257w-9277
Summary: Cross-Site Scripting in handlebars
Aliases: CVE-2015-8861
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-23T17:20:12Z

Versions of `handlebars` prior to 4.0.0 are affected by a cross-site scripting vulnerability when attributes in handlebar templates are not quoted.


## Proof of Concept
Template:
```<a href={{foo}}/>```

Input:
```{ 'foo' : 'test.com onload=alert(1)'}```

Rendered result:
```<a href=test.com onload=alert(1)/>```


## Recommendation

Update to version 4.0.0 or later.
Alternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.
Vulnerability: GHSA-jgpq-g82g-6c39
Summary: confinit vulnerable to prototype pollution
Aliases: CVE-2020-7638
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-915
Published: 2020-04-07T15:52:05Z

confinit through 0.3.0 is vulnerable to Prototype Pollution.The 'setDeepProperty' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Vulnerability: GHSA-rfmf-rx8w-935w
Summary: High severity vulnerability that affects sounder
Aliases: CVE-2013-5647
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.
Vulnerability: GHSA-fj58-h2fr-3pp2
Summary: SQL Injection and Cross-site Scripting in class-validator
Aliases: CVE-2019-18413
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-89, CWE-79
Published: 2021-10-12T16:35:45Z

In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Vulnerability: GHSA-96jq-75wh-2658
Summary: Moderate severity vulnerability that affects apache axis
Aliases: CVE-2018-8032
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-16T20:51:15Z

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
Vulnerability: GHSA-4jg2-84c2-pj95
Summary: Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2021-09-21T18:41:59Z

### Impact
Anyone who is using the default presets and/or does not handle the functionality themself.

### Patches
It has not been patched yet.

### Workarounds
Fully custom presets that change the entire rendering process which can then escape the user input.

### For more information
Even though that I changed all the presets here, the vulnerability is still present throughout. I am using a JSON Schema here for simplicity.
```ts
const jsonSchemaDoc = {
  $id: 'CustomClass',
  type: 'object',
  properties: {
      'property: any; \n constructor(){console.log("injected")} \n private _temp': { type: 'string' },
  }
};
generator = new TypeScriptGenerator(
  { 
    presets: [
      {
        class: {
            property({ propertyName, content }) {
              return `private ${propertyName}: any;`;
            },
            ctor() {
              return '';
            },
            getter() {
              return '';
            },
            setter() {
              return '';
            }
        }
      }
    ]
  }
);
const inputModel = await generator.process(jsonSchemaDoc);
```
This would render
```ts
export class CustomClass {
  private property: any; 
   constructor(){console.log("injected")} 
   private _temp: any;
  private additionalProperties: any;
}
```
Vulnerability: GHSA-8w74-g84v-c5w8
Summary: Directory Traversal in chatbyvista
Aliases: CVE-2017-16177
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:52:26Z

Affected versions of `chatbyvista` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jjhw-5mxp-2g2q
Summary: Cross-site Scripting in OpenNMS Horizon
Aliases: CVE-2021-25933
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-05-25T18:47:01Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.
Vulnerability: GHSA-gvcj-pfq2-wxj7
Summary: High severity vulnerability that affects electron
Aliases: CVE-2016-1202
Severity: HIGH
CVSS score: 7.8
CWE: CWE-426
Published: 2017-10-24T18:33:35Z

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.
Vulnerability: GHSA-mh3m-8c74-74xh
Summary: Denial of Service in graphql-go
Aliases: CVE-2022-21708
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2022-01-27T15:28:06Z

### Impact
This is a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. To make things worse the only mitigation in affected versions creates opportunities for other attacks. This issue is only available if you are using `graphql.MaxDepth` option in your schema (which is highly recommended in most cases).

### Patches
The issue has been patched in version `v1.3.0`. We have been trying to maintain backwards compatibility and avoid breaking changes so upgrading should not be problematic. 

### Workarounds
The best workaround is to patch to a version greater than or equal to `v1.3.0`. 
Otherwise, the only workaround in versions prior to `v1.3.0` is to disable the `graphql.MaxDepth` option from your schema. Unfortunately, this could potentially create opportunities for other attacks.

### References
There are no references or links. This issue was reported privately and was fixed before creating this Security Advisory.

### For more information
If you have any questions or comments feel free to reach out to @pavelnikolov or @tony on the Gopher Slack.
Vulnerability: GHSA-w3pp-wp5v-fjvp
Summary: Malicious Package in mogodb
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:51:18Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-6w5m-jgc5-8cgc
Summary: orchardcore is vulnerable to Cross-site Scripting
Aliases: CVE-2022-0159
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-21T23:57:49Z

orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-7m27-3587-83xf
Summary: Privilege Defined With Unsafe Actions in Keycloak
Aliases: CVE-2019-10170
Severity: HIGH
CVSS score: 7.2
CWE: CWE-267
Published: 2021-10-21T17:46:27Z

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
Vulnerability: GHSA-xw7c-jx9m-xh5g
Summary: Reflected cross-site scripting issue in Datasette
Severity: HIGH
CVSS score: 7.2
CWE: CWE-79
Published: 2021-06-07T21:47:41Z

### Impact

The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability.

This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data.

### Patches

Datasette 0.57 and 0.56.1 both include patches for this issue.

### Workarounds

If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.

### References

- [OWASP guide to reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks)
- [Datasette issue #1360](https://github.com/simonw/datasette/issues/1360)

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [simonw/datasette](https://github.com/simonw/datasette/discussions)
* Email us at `swillison+datasette @ gmail.com`
Vulnerability: GHSA-86r3-4gq8-xw8q
Summary: Remote Code Execution in Laravel
Aliases: CVE-2021-43503
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-04-09T00:00:25Z

A Remote Code Execution (RCE) vulnerability exists in h laravel 5.8.38 via an unserialize pop chain in (1) __destruct in \Routing\PendingResourceRegistration.php, (2) __cal in Queue\Capsule\Manager.php, and (3) __invoke in mockery\library\Mockery\ClosureWrapper.php.
Vulnerability: GHSA-qvjc-g5vr-mfgr
Summary: Regular Expression Denial of Service in papaparse
Severity: HIGH
CVSS score: 7.5
CWE: CWE-185
Published: 2020-09-04T18:03:04Z

Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.


## Recommendation

Upgrade to version 5.2.0 or later.
Vulnerability: GHSA-6q5w-m3c5-rv95
Summary: Data races in rusqlite
Aliases: CVE-2020-35866
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-362
Published: 2021-08-25T20:47:59Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via VTab / VTabCursor.
Vulnerability: GHSA-cf36-985g-v73c
Summary: Moderate severity vulnerability that affects omniauth-facebook
Aliases: CVE-2013-4562
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2017-10-24T18:33:37Z

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via the state parameter.
Vulnerability: GHSA-4286-h47h-m5v6
Summary: Improper Authentication in showdoc 
Aliases: CVE-2021-41745
Severity: HIGH
CVSS score: 0
CWE: CWE-287, CWE-434
Published: 2021-10-25T19:43:24Z

ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.
Vulnerability: GHSA-6fmv-q269-55cw
Summary: Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0
Aliases: CVE-2020-15277
Severity: HIGH
CVSS score: 7.2
CWE: CWE-434, CWE-74
Published: 2020-10-30T17:05:59Z

baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE).

Impact: XSS via Arbitrary script execution.
Attack vector is: Administrator must be logged in.
Components are: Edit template.
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by Aquilao Null
Vulnerability: GHSA-557g-r22w-9wvx
Summary: Incorrect Permission Assignment for Critical Resource in Singularity
Aliases: CVE-2019-11328
Severity: HIGH
CVSS score: 8.8
CWE: CWE-269
Published: 2021-12-20T18:25:33Z

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.
Vulnerability: GHSA-7f92-rr6w-cq64
Summary: Storage corruption due to variables overwritten by re-entrancy locks
Severity: HIGH
CVSS score: 0
Published: 2021-08-05T16:57:42Z

### Background
When attempting to use the v0.2.14 release, @pandadefi discovered an issue using the `@nonreentrant` decorator.

### Impact
Reentrancy protection storage slots get allocated to the same slots as storage variables, leading to the corruption of storage variables when using the `@nonreentrant` decorator.

### Patches
This issue was fixed in v0.2.15 in #2391, #2379

### Workarounds
Don't use the `@nonreentrant` decorator in these versions.
Vulnerability: GHSA-vrxp-mg9f-hwf3
Summary: Improperly Implemented path matching for in-toto-golang
Aliases: CVE-2021-41087
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-22, CWE-345
Published: 2021-09-22T20:37:09Z

### Impact
Authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo).

### Patches
The problem has been fixed in version 0.3.0.

### Workarounds
Exploiting this vulnerability is dependent on the specific policy applied.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [in-toto-golang](http://github.com/in-toto/in-toto-golang)
* Email us at [in-toto-public](mailto:in-toto-public@googlegroups.com)
* If this is a sensitive security-relevant disclosure, please send a PGP encrypted email to santiagotorres@purdue.edu or jcappos@nyu.edu
Vulnerability: GHSA-6757-jp84-gxfx
Summary: Improper Input Validation in PyYAML
Aliases: CVE-2020-1747
Severity: HIGH
CVSS score: 9.8
CWE: CWE-20
Published: 2021-04-20T16:14:24Z

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Vulnerability: GHSA-fpf2-pr3j-4cm3
Summary: Malicious Package in ecruve
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:06:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-55j9-849x-26h4
Summary: Remote Code Execution in Red Discord Bot
Aliases: CVE-2020-15140
Severity: HIGH
CVSS score: 8.2
CWE: CWE-74
Published: 2020-08-21T16:30:52Z

### Impact
A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information.

### Patches
This critical exploit has been fixed on version 3.3.11.

### Workarounds
Unloading the Trivia module with ``unload trivia`` can render this exploit not accessible. We still highly recommend updating to 3.3.11 to completely patch this issue.

### References
https://github.com/Cog-Creators/Red-DiscordBot/pull/4175

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)
* Over on our [Discord server](https://discord.gg/red)
Vulnerability: GHSA-qf6q-qfwp-vp44
Summary: Origin Validation Error in Magento 2
Aliases: CVE-2020-8818
Severity: HIGH
CVSS score: 8.1
CWE: CWE-346
Published: 2021-10-12T16:30:58Z

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Vulnerability: GHSA-ch6p-4jcm-h8vh
Summary: Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc and Microsoft.AspNetCore.Mvc.Core
Aliases: CVE-2017-0248
Severity: MODERATE
CVSS score: 0
CWE: CWE-295
Published: 2018-10-16T19:58:52Z

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."
Vulnerability: GHSA-x2rg-fmcv-crq5
Summary: Moderate severity vulnerability that affects DotNetNuke.Core
Aliases: CVE-2017-9822
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2018-10-16T19:34:22Z

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."