TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-xj6r-2jpm-qvxp
Summary: Code injection issue for java-spring-cloud-stream-template
Aliases: CVE-2021-37694
Severity: HIGH
CVSS score: 8.7
CWE: CWE-94
Published: 2021-08-25T14:45:52Z

The following was initially reported by @jonaslagoni:

Given the following command:
`ag ./dummy.json @asyncapi/java-spring-cloud-stream-template --force-write --output ./output`

With the following AsyncAPI document:
```json
{
  "asyncapi": "2.0.0",
  "info": {
    "title": "Streetlight",
    "version": "1.0.0"
  },
  "defaultContentType": "json",
  "channels": {
    "security/audit/channel": {
      "description": "Channel for the turn on command which should turn on the streetlight",
      "parameters": {
        "streetlight_id": {
          "description": "The ID of the streetlight",
          "schema": {
            "type": "string"
          }
        }
      },
      "publish": {
        "operationId": "test() { System.out.println(\"injected\"); return test(0); }\n public Consumer<CustomClass> someothername",
        "message": {
          "name": "TurnonCommand",
          "payload": {
            "$ref": "#/components/schemas/CustomClass"
          }
        }
      }
    }
  },
  "components": {
    "schemas" : {
      "CustomClass": {
        "type": "object",
        "properties": {
          "prop": { 
              "type": "string"
          }
        }
      }
    }
  }
}
```

Which changes the following output: 

```java
...
  @Bean
  public Consumer<CustomClass> test() {
    // Add business logic here.
    return null;
  }
...
```
To
```java
...
  @Bean
  public Consumer<CustomClass> test() { System.out.println("injected"); return someothername(); }
  public Consumer<CustomClass> someothername() {
    // Add business logic here.
    return null;
  }
...
```
Vulnerability: GHSA-3c48-6pcv-88rm
Summary: Macro in MathJax running untrusted Javascript within a web browser
Aliases: CVE-2018-1999024
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2018-07-27T17:05:27Z

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.
Vulnerability: GHSA-r9p9-mrjm-926w
Summary: Use of a Broken or Risky Cryptographic Algorithm
Aliases: CVE-2020-28498
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-327
Published: 2021-03-08T16:06:50Z

The npm package `elliptic` before version 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Vulnerability: GHSA-4xr4-4c65-hj7f
Summary: Apache Tika does not properly initialize the XML parser or choose handlers
Aliases: CVE-2016-4434
Severity: HIGH
CVSS score: 7.8
CWE: CWE-611
Published: 2018-10-17T15:44:22Z

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
Vulnerability: GHSA-c8cw-2c5j-xff3
Summary: Incorrect Authorization in Apache Ozone
Aliases: CVE-2021-39234
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-863
Published: 2021-11-23T17:56:30Z

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Vulnerability: GHSA-29v7-3v4c-gf38
Summary: Data races in parc
Aliases: CVE-2020-36454
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:57:24Z

An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak<T> has an unconditional implementation of Send without trait bounds on T.
Vulnerability: GHSA-72hv-rp4q-q7f3
Summary: Hijacked Environment Variables in babelcli
Aliases: CVE-2017-16060
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:57:14Z

The `babelcli` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-8867-vpm3-g98g
Summary: Incorrect Default Permissions in keyring
Aliases: CVE-2012-5578
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-276
Published: 2020-03-10T20:56:41Z

Python keyring has insecure permissions on new databases allowing world-readable files to be created
Vulnerability: GHSA-4w46-w44m-3jq3
Summary: Parse Server stores password in plain text
Aliases: CVE-2020-26288
Severity: LOW
CVSS score: 7.7
CWE: CWE-312
Published: 2020-12-28T16:33:17Z

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext.
This is fixed in version 4.5.0 by stripping password after authentication to prevent cleartext password storage.
Vulnerability: GHSA-hx77-5p88-f92r
Summary: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4131
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-01-05T20:33:55Z

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-6cgh-hjpw-q3gq
Summary: Utils.readChallengeTx does not verify the server account signature
Aliases: CVE-2021-32738
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-287
Published: 2021-07-02T19:20:33Z

The `Utils.readChallengeTx` function used in [SEP-10 Stellar Web Authentication](https://github.com/stellar/stellar-protocol/blob/master/ecosystem/sep-0010.md) states in its function documentation that it reads and validates the challenge transaction including verifying that the `serverAccountID` has signed the transaction. The function does not verify that the server has signed the transaction and has been fixed so that it does in v8.2.3.

Applications that also used `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction.

Applications calling `Utils.readChallengeTx` should update to v8.2.3 to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.
Vulnerability: GHSA-vcjj-9vg7-vf68
Summary: Null pointer dereference in TFLite
Aliases: CVE-2021-37688
Severity: HIGH
CVSS score: 7.8
CWE: CWE-476
Published: 2021-08-25T14:39:54Z

### Impact
An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:

```python
import tensorflow as tf

model = tf.keras.models.Sequential()
model.add(tf.keras.Input(shape=(1, 2, 3)))
model.add(tf.keras.layers.Dense(0, activation='relu'))

converter = tf.lite.TFLiteConverter.from_keras_model(model)
tflite_model = converter.convert()

interpreter = tf.lite.Interpreter(model_content=tflite_model)
interpreter.allocate_tensors()

interpreter.invoke()
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/internal/optimized/optimized_ops.h#L268-L285) unconditionally dereferences a pointer.

```cc
  if (y4 > 1) {
    // ...
  } else {
    for (int i0 = 0; i0 < y0; ++i0) {
      const T* input2_data_ptr = nullptr;
      for (int i1 = 0; i1 < y1; ++i1) {
        input2_data_ptr = input2_data_reset;
        for (int i2 = 0; i2 < y2; ++i2) {
          scalar_broadcast_f(y3, params, *input1_data_ptr, input2_data_ptr,
                             output_data_ptr);
        }
      }
    }
  }
```

### Patches
We have patched the issue in GitHub commit [15691e456c7dc9bd6be203b09765b063bf4a380c](https://github.com/tensorflow/tensorflow/commit/15691e456c7dc9bd6be203b09765b063bf4a380c).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-g3rq-g295-4j3m
Summary: Regular Expression Denial of Service (ReDoS) in Jinja2
Aliases: CVE-2020-28493
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-03-19T21:28:05Z

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
Vulnerability: GHSA-j49g-mp79-5vm5
Summary: Exfiltrates data on installation in coffe-script
Aliases: CVE-2017-16203
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-06T20:06:29Z

The `coffe-script` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.



## Recommendation

If you have found `coffe-script` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-q88g-qx42-xfrh
Summary: Path traversal in bolt/core
Aliases: CVE-2021-27367
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2021-02-18T20:51:56Z

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.
Vulnerability: GHSA-ff84-84q5-fq4f
Summary: Incorrect Authorization in Apache Ozone
Aliases: CVE-2021-39232
Severity: HIGH
CVSS score: 8.8
CWE: CWE-863
Published: 2021-11-23T17:56:54Z

In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.
Vulnerability: GHSA-792j-9wj3-j634
Summary: Command injection in github-todos
Aliases: CVE-2021-44684
Severity: MODERATE
CVSS score: 0
Published: 2021-12-10T20:30:52Z

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenated without any validation, and is directly used by the exec function.
Vulnerability: GHSA-rvwf-54qp-4r6v
Summary: XML Entity Expansion in SnakeYAML
Aliases: CVE-2017-18640
Severity: HIGH
CVSS score: 7.5
CWE: CWE-776
Published: 2021-06-04T21:37:45Z

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Vulnerability: GHSA-jgrx-mgxx-jf9v
Summary: Regular Expression Denial of Service in tmpl
Aliases: CVE-2021-3777
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-09-20T20:27:52Z

nodejs-tmpl is simple string formatting. tmpl is vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion.
Vulnerability: GHSA-qg3g-2mgh-33j8
Summary: Sensitive Data Exposure in msrcrypto
Aliases: CVE-2018-8319
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-682
Published: 2018-09-10T15:19:49Z

Versions of `msrcrypto` prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability.


## Recommendation

Upgrade to version 1.4.1 or later.
Vulnerability: GHSA-c8qc-62qv-5p2x
Summary: Out-of-bounds Write in ChakraCore
Aliases: CVE-2020-0828
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:58:22Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-fw5f-7c6c-3vmv
Summary: Cross-site Scripting in PrimeFaces
Aliases: CVE-2020-10544
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-07T16:16:30Z

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation.
Vulnerability: GHSA-52mh-p2m2-w625
Summary: Cross-site Scripting in HAPI FHIR
Aliases: CVE-2019-12741
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-06-07T20:56:59Z

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
Vulnerability: GHSA-2mrj-435v-c2cr
Summary: possible DoS caused by malformed signature decoding in Pure-Python ECDSA
Aliases: CVE-2019-14853
Severity: MODERATE
CVSS score: 0
Published: 2019-12-02T18:15:31Z

**Withdrawn:** Duplicate of GHSA-pwfw-mgfj-7g3g.
Vulnerability: GHSA-jm34-xm8m-w958
Summary: Open Redirect in oauth2_proxy
Aliases: CVE-2017-1000070
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-12-20T18:04:40Z

The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819
Vulnerability: GHSA-5949-rw7g-wx7w
Summary: Deserialization of untrusted data in jackson-databind
Aliases: CVE-2021-20190
Severity: HIGH
CVSS score: 0
CWE: CWE-502
Published: 2021-01-20T21:20:15Z

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-74mg-6xqx-2vrq
Summary: Deserialization exploitation in Apache Dubbo
Aliases: CVE-2020-11995
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-02-09T22:27:01Z

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HashMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
Vulnerability: GHSA-xqj7-j8j5-f2xr
Summary: Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator
Aliases: CVE-2018-1000180
Severity: HIGH
CVSS score: 7.5
CWE: CWE-327
Published: 2018-10-16T17:44:39Z

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
Vulnerability: GHSA-vm67-mh96-95mq
Summary: Malicious Package in bubfer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:40:48Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-j8wc-gxx9-82hx
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Santuario
Aliases: CVE-2021-40690
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-09-20T23:18:41Z

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Vulnerability: GHSA-qfpc-5pjr-mh26
Summary: Missing validation in shape inference for `Dequantize`
Aliases: CVE-2021-37677
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2021-08-25T14:41:23Z

### Impact
The shape inference code for `tf.raw_ops.Dequantize` has a vulnerability that could trigger a denial of service via a segfault if an attacker provides invalid arguments:

```python
import tensorflow as tf

tf.compat.v1.disable_v2_behavior()
tf.raw_ops.Dequantize(
  input_tensor = tf.constant(-10.0, dtype=tf.float32),
  input_tensor = tf.cast(input_tensor, dtype=tf.quint8),
  min_range = tf.constant([], shape=[0], dtype=tf.float32),
  max_range = tf.constant([], shape=[0], dtype=tf.float32),
  mode  = 'MIN_COMBINED',
  narrow_range=False,
  axis=-10,
  dtype=tf.dtypes.float32)
```

The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/ops/array_ops.cc#L2999-L3014) uses `axis` to select between two different values for `minmax_rank` which is then used to retrieve tensor dimensions. However, code assumes that `axis` can be either `-1` or a value greater than `-1`, with no validation for the other values.

### Patches
We have patched the issue in GitHub commit [da857cfa0fde8f79ad0afdbc94e88b5d4bbec764](https://github.com/tensorflow/tensorflow/commit/da857cfa0fde8f79ad0afdbc94e88b5d4bbec764).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-m836-gxwq-j2pm
Summary: Improper Access Control in github.com/treeverse/lakefs
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-284
Published: 2021-10-28T16:27:03Z

### Impact

1. [medium] A user with write permissions to a portion of a repository may use the S3 gateway to copy any object in the repository if they know its name.
1. [medium] A user with permission to write any one of tags, branches, or commits on a repository may write all of them.
1. [low] A user with permission to read any one of tags, branches, or commits on a repository may read all of them.
1. [low] A user allowed to list objects in a repository _or_ read repository meta-data may retrieve graveler information about the location on underlying storage of all objects stored in any commit that they can view.  If the user additionally has the capability to read underlying storage, they will be able to retrieve metadata associated with all objects in that commit.

### For more information

If you have any questions or comments about this advisory please:
* Email us at security@treeverse.io.
* Open an issue on https://github.com/treeverse/lakeFS/issues/new.
Vulnerability: GHSA-rhwf-hqpr-q8g2
Summary: Code Injection in script-manager
Aliases: CVE-2020-8129
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94
Published: 2021-04-13T15:24:38Z

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
Vulnerability: GHSA-5mc7-m686-p6jg
Summary: Deserialization of Untrusted Data in Apache Dubbo
Aliases: CVE-2021-30179
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-03-18T17:57:32Z

Apache Dubbo prior to 2.6.9 and 2.7.10 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
Vulnerability: GHSA-2rr5-8q37-2w7h
Summary: Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Aliases: CVE-2021-41098
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2021-09-27T20:12:47Z

### Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.0)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/MAV:N/MAC:L) for JRuby users. (This security advisory does not apply to CRuby users.)


### Impact

In Nokogiri v1.12.4 and earlier, **on JRuby only**, the SAX parser resolves external entities by default.

Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:

- Nokogiri::XML::SAX::Parser
- Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
- Nokogiri::XML::SAX::PushParser
- Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser


### Mitigation

JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.

CRuby users are not affected.
Vulnerability: GHSA-844w-j86r-4x2j
Summary: Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow
Aliases: CVE-2019-16778
Severity: LOW
CVSS score: 2.6
CWE: CWE-681, CWE-122
Published: 2019-12-16T20:17:10Z

### Impact

A heap buffer overflow in `UnsortedSegmentSum` can be produced when the `Index` template argument is `int32`. In this case `data_size` and `num_segments` fields are truncated from `int64` to `int32` and can produce negative numbers, resulting in accessing out of bounds heap memory.

This is unlikely to be exploitable and was detected and fixed internally. We are making the security advisory only to notify users that it is better to update to TensorFlow 1.15 or 2.0 or later as these versions already have this fixed.

### Patches

Patched by db4f9717c41bccc3ce10099ab61996b246099892 and released in all official releases after 1.15 and 2.0.

### For more information
Please consult [`SECURITY.md`](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-3xpw-vhmv-cw7h
Summary: Command injection in czproject/git-php
Aliases: CVE-2022-25866
Severity: HIGH
CVSS score: 8.1
CWE: CWE-74
Published: 2022-04-26T00:00:35Z

The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-8m2f-74r2-x3f2
Summary: Code injection in accesslog
Aliases: CVE-2022-25760
Severity: HIGH
CVSS score: 7.1
CWE: CWE-94
Published: 2022-03-18T00:01:10Z

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.
Vulnerability: GHSA-w8qv-6jwh-64r5
Summary: Regular Expression Denial of Service in browserslist
Aliases: CVE-2021-23364
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-05-24T19:52:40Z

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Vulnerability: GHSA-77qv-gh6f-pgh4
Summary: Command Injection in Limdu
Aliases: CVE-2020-4066
Severity: LOW
CVSS score: 3.8
CWE: CWE-78
Published: 2020-06-22T15:24:06Z

### Impact
The `trainBatch` function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

### Patches
Patched in version 0.95.

### Workarounds
Do not use trainBatch with classifiers that rely on shell execution, such as SVM Perf, SVM Linear or Adaboost

### References
No
Vulnerability: GHSA-8h84-8j4f-p97q
Summary: Injection in bodymen
Aliases: CVE-2019-10792
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-74
Published: 2021-04-13T15:24:21Z

bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Vulnerability: GHSA-4298-89hc-6rfv
Summary: Open Redirect in Flask-User
Aliases: CVE-2021-23401
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-601
Published: 2021-08-09T20:44:32Z

This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Vulnerability: GHSA-mxjr-xmcg-fg7w
Summary: Arbitrary Code Injection in mobile-icon-resizer
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-94
Published: 2019-06-27T17:25:21Z

mobile-icon-resizer resizes large images for use as icons for iOS and Android.

mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3.

mobile-icon-resizer takes an options object as an argument to define the resulting icons as such:
```
var options = {
  config: './config.js'
}
resize(options, function(err){});
```
config.js would need to be a file on the filesystem and look something like:
```
var config = {
  iOS: {
    "images": [
     /* iOS image definitions are not vulnerable */
    ]
  },
  android: {
    "images" : [
      {
        "baseRatio" : "console.log('Executing script as baseRatio property')",
        "folder" : "drawable-ldpi"
      },
      {
        "ratio" : "console.log('Executing script as ratio property')",
        "folder" : "drawable-mdpi"
      },
    /* other android image defintiions ... */
    ]
  }
};

exports = module.exports = config;
```
The parameters `ratio` and `baseRatio` are passed directly to `eval()`, thus allowing dynamic javascript payloads to be executed.


## Recommendation

Update to version 0.4.3 or later.
Vulnerability: GHSA-7528-7jg5-6g62
Summary: Cross-site Scripting Vulnerability in CodeIgniter4
Aliases: CVE-2022-21715
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-27T15:09:00Z

### Impact
Cross-Site Scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4.
Attackers can do XSS attacks if you are using `API\ResponseTrait`.

### Patches
Upgrade to v4.1.8 or later.

### Workarounds
Do one of the following:
1. Do not use `API\ResponseTrait` nor `ResourceController`
2. Disable Auto Route and [Use Defined Routes Only](https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only)

### References
- [Cross Site Scripting (XSS) Software Attack | OWASP Foundation](https://owasp.org/www-community/attacks/xss/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-rq8g-5pc5-wrhr
Summary: Insufficient Entropy in cryptiles
Aliases: CVE-2018-1000620
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-331
Published: 2018-09-11T18:22:50Z

Versions of `cryptiles` prior to 4.1.2 are vulnerable to Insufficient Entropy. The `randomDigits()` method does not provide sufficient entropy and its generates digits that are not evenly distributed.


## Recommendation

Upgrade to version 4.1.2. The package is deprecated and has been moved to `@hapi/cryptiles` and it is strongly recommended to use the maintained package.
Vulnerability: GHSA-9c8h-vvrj-w2p8
Summary: Heap OOB in `RaggedGather`
Aliases: CVE-2021-37641
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-08-25T14:43:59Z

### Impact
If the arguments to `tf.raw_ops.RaggedGather` don't determine a valid ragged tensor code can trigger a read from outside of bounds of heap allocated buffers.
                                                                                                                                                                                                                                                                                          
```python
import tensorflow as tf

tf.raw_ops.RaggedGather(
  params_nested_splits = [0,0,0],
  params_dense_values = [1,1],
  indices = [0,0,9,0,0],
  OUTPUT_RAGGED_RANK=0)
```

In debug mode, the same code triggers a `CHECK` failure.

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/ragged_gather_op.cc#L70) directly reads the first dimension of a tensor shape before checking that said tensor has rank of at least 1 (i.e., it is not a scalar). Furthermore, the implementation does not check that the list given by `params_nested_splits` is not an empty list of tensors.

### Patches
We have patched the issue in GitHub commit [a2b743f6017d7b97af1fe49087ae15f0ac634373](https://github.com/tensorflow/tensorflow/commit/a2b743f6017d7b97af1fe49087ae15f0ac634373).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-qrgf-jqqm-x7xv
Summary: High severity vulnerability that affects dragonfly
Aliases: CVE-2013-5671
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:37Z

lib/dragonfly/imagemagickutils.rb in the fog-dragonfly gem 0.8.2 for Ruby allows remote attackers to execute arbitrary commands via unspecified vectors.
Vulnerability: GHSA-882p-jqgm-f45g
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2017-18258
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-770
Published: 2018-04-13T16:17:46Z

The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.
Vulnerability: GHSA-cgvm-rvfv-c92r
Summary: Malicious Package in ecuvre
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:05:51Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-g95j-p8f6-pwh4
Summary: Downloads Resources over HTTP in headless-browser-lite
Aliases: CVE-2016-10625
Severity: HIGH
CVSS score: 8.1
CWE: CWE-311
Published: 2019-02-18T23:56:58Z

Affected versions of `headless-browser-lite` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `headless-browser-lite`.


## Recommendation

Update to version 2015.4.18-a or later.
Vulnerability: GHSA-jvf4-g24p-2qgw
Summary: Arbitrary Code Execution in shiba
Aliases: CVE-2020-7738
Severity: HIGH
CVSS score: 8.3
CWE: CWE-94
Published: 2021-05-10T18:37:34Z

"All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad()."
Vulnerability: GHSA-mh24-7wvg-v88g
Summary: Low severity vulnerability that affects pypiserver
Aliases: CVE-2019-6802
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-74, CWE-79
Published: 2019-01-30T20:56:26Z

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
Vulnerability: GHSA-9vfj-5g7h-4p24
Summary: Server side template injection in Apache Camel
Aliases: CVE-2020-11994
Severity: HIGH
CVSS score: 7.5
CWE: CWE-74
Published: 2020-07-29T18:08:48Z

Server-Side Template Injection and arbitrary file disclosure on Camel templating components
Vulnerability: GHSA-mwj7-r5vc-hmc9
Summary: Directory Traversal in hcbserver
Aliases: CVE-2017-16171
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:35:38Z

Affected versions of `hcbserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-2hw7-mxvj-m455
Summary: Path traversal in Node-RED-Dashboard
Aliases: CVE-2021-3223
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2021-01-29T18:13:52Z

In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.
Vulnerability: GHSA-ww39-953v-wcq6
Summary: Regular expression denial of service in glob-parent
Aliases: CVE-2020-28469
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-07T21:56:34Z

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Vulnerability: GHSA-v6vg-pxvv-g5cq
Summary: Improper Privilege Management in Snipe-IT
Aliases: CVE-2022-0579
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-269
Published: 2022-02-15T00:02:45Z

Snipe-IT prior to 5.3.9 is vulnerable to improper privilege management. A user who does not have access to the supplier module may view supplier content.
Vulnerability: GHSA-x2jj-x3q2-7hph
Summary: Directory Traversal in 11xiaoli
Aliases: CVE-2017-16160
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:28:09Z

Affected versions of `11xiaoli` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fpw3-x4xq-6vxq
Summary: Malicious Package in wepack-cli
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:32:13Z

All versions of `wepack-cli` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-8c9h-4q7g-fp7h
Summary: Out-of-bounds Read in iText
Aliases: CVE-2022-24198
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-125
Published: 2022-02-02T00:01:45Z

iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Vulnerability: GHSA-r88h-6987-g79f
Summary: Data races on syncpool
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:28Z

Affected versions of this crate unconditionally implements `Send` for `Bucket2`. This allows sending non-Send types to other threads.

This can lead to data races when non Send types like `Cell<T>` or `Rc<T>` are contained inside `Bucket2` and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).

The flaw was corrected in commit 15b2828 by adding a `T: Send` bound to the `Send` impl of `Bucket2<T>`.
Vulnerability: GHSA-qw8w-2xcp-xg59
Summary: Low severity vulnerability that affects passenger
Aliases: CVE-2014-1832
Severity: LOW
CVSS score: 0
Published: 2018-10-10T17:29:27Z

Phusion Passenger 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1831.
Vulnerability: GHSA-fvhr-7j8m-3cvc
Summary: Data races in appendix
Aliases: CVE-2020-36469
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2021-08-25T20:57:02Z

The `appendix` crate implements a key-value mapping data structure called
`Index<K, V>` that is stored on disk. The crate allows for any type to inhabit
the generic `K` and `V` type parameters and implements Send and Sync for them
unconditionally.

Using a type that is not marked as `Send` or `Sync` with `Index` can allow it
to be used across multiple threads leading to data races. Additionally using
reference types for the keys or values will lead to the segmentation faults
in the crate's code.
Vulnerability: GHSA-4v9w-pvwr-38h3
Summary: OS Command Injection in strong-nginx-controller
Aliases: CVE-2020-7621
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:36:54Z

strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.
Vulnerability: GHSA-f7hx-fqxw-rvvj
Summary: Insufficient output escaping of attachment names in PHPMailer
Aliases: CVE-2020-13625
Severity: HIGH
CVSS score: 7.5
CWE: CWE-116
Published: 2020-05-27T16:37:02Z

### Impact
CWE-116: Incorrect output escaping.

An attachment added like this (note the double quote within the attachment name, which is entirely valid):

    $mail->addAttachment('/tmp/attachment.tmp', 'filename.html";.jpg');

Will result in a message containing these headers:

    Content-Type: application/octet-stream; name="filename.html";.jpg"
    Content-Disposition: attachment; filename="filename.html";.jpg"

The attachment will be named `filename.html`, and the trailing `";.jpg"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this.

Note that the MIME type itself is obtained automatically from the *source filename* (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the *name* given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods.

### Patches
Patched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this:

    Content-Type: application/octet-stream; name="filename.html\";.jpg"
    Content-Disposition: attachment; filename="filename.html\";.jpg"

### Workarounds
Reject or filter names and filenames containing double quote (`"`) characters before passing them to attachment functions such as `addAttachment()`.

### References
[CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625).
[PHPMailer 6.1.6 release](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PHPMailer repo](https://github.com/PHPMailer/PHPMailer/issues)
Vulnerability: GHSA-p5xh-vx83-mxcj
Summary: HTTP Request Smuggling in Twisted
Aliases: CVE-2020-10109
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-444
Published: 2020-03-31T15:40:12Z

In Twisted Web through 20.3.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
Vulnerability: GHSA-jg6j-jrxv-2hh9
Summary: Cross-site Scripting in Apache Pluto
Aliases: CVE-2021-36738
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-08T00:46:17Z

The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact
Vulnerability: GHSA-jjcx-999m-35hc
Summary: Improper Input Validation in Firefly III
Aliases: CVE-2019-14671
Severity: LOW
CVSS score: 3.3
CWE: CWE-20
Published: 2021-09-08T17:27:07Z

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
Vulnerability: GHSA-cw4j-cf6c-mmfv
Summary: Use of Uninitialized Resource in binjs_io.
Aliases: CVE-2021-45683
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:14:24Z

An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
Vulnerability: GHSA-j44m-qm6p-hp7m
Summary: Arbitrary File Overwrite in tar
Aliases: CVE-2018-20834
Severity: HIGH
CVSS score: 7.5
CWE: CWE-59
Published: 2019-05-01T18:37:31Z

Versions of `tar` prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.


## Recommendation

For tar 4.x, upgrade to version 4.4.2 or later.
For tar 2.x, upgrade to version 2.2.2 or later.
Vulnerability: GHSA-2w3f-9w3q-qw77
Summary: Prototype Pollution in config-handler
Aliases: CVE-2021-23448
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-913
Published: 2021-10-12T18:30:37Z

All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
Vulnerability: GHSA-g9wh-3vrx-r7hg
Summary: OctoRPKI crashes when processing GZIP bomb returned via malicious repository
Aliases: CVE-2021-3912
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-400
Published: 2021-11-10T20:39:23Z

OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash). 

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-xfqh-7356-vqjj
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Aliases: CVE-2019-14820
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200
Published: 2020-04-15T21:08:21Z

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Vulnerability: GHSA-hqq7-2q2v-82xq
Summary: Cross-site Scripting in sanitize-url
Aliases: CVE-2021-23648
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-17T00:00:24Z

The package `@braintree/sanitize-url` before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the `sanitizeUrl` function.
Vulnerability: GHSA-7x48-7466-3g33
Summary: Command injection in guake
Aliases: CVE-2021-23556
Severity: MODERATE
CVSS score: 6.4
Published: 2022-03-18T00:01:11Z

Guake is a drop-down terminal for GNOME. The package guake before 3.8.5 is vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. **Note:** Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run terminal commands.
Vulnerability: GHSA-f99r-jjgr-f373
Summary: SQL injection in ImpressCMS
Aliases: CVE-2022-26986
Severity: HIGH
CVSS score: 7.2
CWE: CWE-89
Published: 2022-04-06T00:01:30Z

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.