TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4wcx-c9c4-89p2
Summary: Malicious Package in react-datepicker-plus
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:23:30Z

Versions 2.4.3 and 2.4.2 of `react-datepicker-plus` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-9cx9-x2gp-9qvh
Summary: CRLF vulnerability in Fiber
Aliases: CVE-2020-15111
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-93, CWE-74
Published: 2021-06-29T21:24:28Z

### Impact
The filename that is given in [c.Attachment()](https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc.

### Steps to reproduce
```go
package main

import "github.com/gofiber/fiber"

const badFileName = "another secret document.pdf\"\r\nLocation: google.com\r\nAuthorization: \"example_of_session_fixation"

func splitTheResponse(c *fiber.Ctx) {
	c.Attachment(badFileName)
}

func main() {
	app := fiber.New()
	app.Get("/attack", splitTheResponse)
	app.Listen("127.0.0.1:8080")
}
```
```
HTTP/1.1 200 OK
Date: Fri, 10 Jul 2020 19:47:04 GMT
Content-Type: application/octet-stream
Content-Length: 0
Content-Disposition: attachment; filename="another secret document.pdf"
Location: google.com
Authorization: "example_of_session_fixation"
```

### Patches
This issue has been patched in `v1.12.6` with commit [579](https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f) escaping the filename by default.

### Workarounds
You could of course serialize the input yourself before passing it to `ctx.Attachment()`, this is actually a good practice by default. But in case you forget, we got you covered 👍 

### References
A CRLF injection attack is one of several types of injection attacks. It can be used to escalate to more malicious attacks such as Cross-site Scripting (XSS), page injection, web cache poisoning, cache-based defacement, and more. A CRLF injection vulnerability exists if an attacker can inject the CRLF characters into a web application, for example using a user input form or an HTTP request, [see acunetix](https://www.acunetix.com/websitesecurity/crlf-injection/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [gofiber/fiber](https://github.com/gofiber/fiber)
* Join us on [Discord](https://gofiber.io/discord)
Vulnerability: GHSA-vjcj-5g2r-vxqc
Summary: Moderate severity vulnerability that affects editor.md
Aliases: CVE-2018-16330
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-06T03:22:00Z

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
Vulnerability: GHSA-h582-2pch-3xv3
Summary: High severity vulnerability that affects django
Aliases: CVE-2015-5143
Severity: HIGH
CVSS score: 0
Published: 2019-07-05T21:10:39Z

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
Vulnerability: GHSA-9pcf-h8q9-63f6
Summary: Sandbox Breakout / Arbitrary Code Execution in safe-eval
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T17:12:41Z

All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code.  

For example, the payload 
```
((() => { 
const targetKey = Object.keys(this)[0]; 
Object.defineProperty(this, targetKey, { 
get: function() { 
return arguments.callee.caller.constructor( 
"return global.process.mainModule.require('child_process').execSync('pwd').toString()" 
)(); 
} 
}); 
})();```
may be used to print the `pwd` to the console.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7phj-gmgx-2r66
Summary: Moderate severity vulnerability that affects activerecord
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:58:09Z

Withdrawn, accidental duplicate publish.

activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
Vulnerability: GHSA-xq58-69h2-765m
Summary: Cross Site Request Forgery in mailman
Aliases: CVE-2021-44227
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-12-16T15:27:06Z

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
Vulnerability: GHSA-qr7j-h6gg-jmgc
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2018-11307
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-07-16T17:42:21Z

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
Vulnerability: GHSA-8hqw-qp6r-vqcm
Summary: Malicious Package in bitcoin-sweep
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:40:00Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hvxq-j2r4-4jm8
Summary: Regular Expression Denial of Service in sql-injection
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T20:31:04Z

All versions of `sql-injection` are vulnerable to Regular Expression Denial of Service. The package processes a request's body with regular expressions that may take exponentially longer to execute for large inputs.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-879r-7f3w-8jj3
Summary: Moderate severity vulnerability that affects Plone and Zope2
Aliases: CVE-2012-5489
Severity: MODERATE
CVSS score: 0
Published: 2018-07-23T19:52:06Z

The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
Vulnerability: GHSA-rhq2-2574-78mc
Summary: Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal
Aliases: CVE-2018-17297
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-10-17T19:54:53Z

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Vulnerability: GHSA-95jp-77w6-qj52
Summary: Cross-site Scripting in python-cjson
Aliases: CVE-2009-4924
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-12-06T18:17:45Z

Python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.
Vulnerability: GHSA-j3rh-8vwq-wh84
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in JHipster Kotlin
Aliases: CVE-2019-16303
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-338
Published: 2020-06-26T16:48:13Z

JHipster Kotlin is using an insecure source of randomness to generate all of it's random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.

From the documentation:

> Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure.
> \- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html

Here are the examples of JHipster Kotlin'ss use of an insecure PRNG:

https://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32

## Proof Of Concepts Already Exist

There has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.

https://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd

POC Repository: https://github.com/alex91ar/randomstringutils


## Potential Impact Technical

All that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.

## Potential Impact Scale

Not as large as for the original jhipster project as the kotlin blueprint is not that widely used.

### Patches

Update your generated applications to > 1.2.0

### Workarounds

Change the content of `RandomUtil.kt` like this:

```kotlin
import java.security.SecureRandom
import org.apache.commons.lang3.RandomStringUtils

private const val DEF_COUNT = 20

object RandomUtil {
    private val secureRandom: SecureRandom = SecureRandom()

    init {
        secureRandom.nextBytes(byteArrayOf(64.toByte()))
    }

    private fun generateRandomAlphanumericString(): String {
        return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, secureRandom)
    }

    /**
    * Generate a password.
    *
    * @return the generated password.
    */
    fun generatePassword(): String = generateRandomAlphanumericString()
}
```

Important is to exchange **every** call of `RandomStringUtils.randomAlphaNumeric`.



### For more information

If you have any questions or comments about this advisory:
* Open an issue in [JHipster Kotlin](https://github.com/jhipster/jhipster-kotlin)
Vulnerability: GHSA-wvjw-p9f5-vq28
Summary: Segfault in `tf.raw_ops.SparseCountSparseOutput`
Aliases: CVE-2021-29619
Severity: LOW
CVSS score: 2.5
CWE: CWE-755
Published: 2021-05-21T14:29:02Z

### Impact
Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSparseOutput` results in segfault.

### Patches
We have patched the issue in GitHub commit [82e6203221865de4008445b13c69b6826d2b28d9](https://github.com/tensorflow/tensorflow/commit/82e6203221865de4008445b13c69b6826d2b28d9).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-pjpj-f6r8-56rm
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0609
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2019-04-09T19:43:59Z

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
Vulnerability: GHSA-ggmv-6q9p-9gm6
Summary: Cross-site Scripting in django-unicorn
Aliases: CVE-2021-42134
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-12T17:51:04Z

The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
Vulnerability: GHSA-j88m-953w-8r2c
Summary: Moderate severity vulnerability that affects rendertron
Aliases: CVE-2017-18352
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-07T19:14:21Z

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
Vulnerability: GHSA-cg3h-rc9q-g8v9
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0509
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-09T00:00:30Z

pimcore version 10.3.0 and prior is vulnerable to cross-site scripting.
Vulnerability: GHSA-2575-pghm-6qqx
Summary: Incorrect Permission Assignment for Critical Resource	and Use of Cache Containing Sensitive Information in Kubernetes
Aliases: CVE-2019-11244
Severity: MODERATE
CVSS score: 2.8
CWE: CWE-524, CWE-732
Published: 2022-02-15T01:57:18Z

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Vulnerability: GHSA-gmch-cm2p-9qw9
Summary: Cross-site Scripting in lightning-server
Aliases: CVE-2020-7747
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2021-05-10T18:39:15Z

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Vulnerability: GHSA-h436-432x-8fvx
Summary: High severity vulnerability that affects org.apache.commons:commons-compress
Aliases: CVE-2018-1324
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2019-03-14T15:41:12Z

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Vulnerability: GHSA-h466-j336-74wx
Summary: Prototype Pollution in mpath
Aliases: CVE-2018-16490
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-02-07T18:17:26Z

Versions of `mpath` before 0.5.1 are vulnerable to prototype pollution. Provided certain input `mpath` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

Update to version `0.5.1` or later.
Vulnerability: GHSA-x489-jjwm-52g7
Summary: Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Aliases: CVE-2015-7225
Severity: MODERATE
CVSS score: 5.3
Published: 2018-08-28T22:34:15Z

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Vulnerability: GHSA-c7gp-2pch-qh2v
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2017-12604
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-10-12T22:01:55Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread.
Vulnerability: GHSA-544j-77x9-h938
Summary: Moderate severity vulnerability that affects actionpack
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:53:30Z

Withdrawn, accidental duplicate publish.

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
Vulnerability: GHSA-6r7x-hc8m-985r
Summary: Cross-site Scripting in Joplin
Aliases: CVE-2020-9038
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-10-13T17:29:25Z

Joplin through 1.0.184 allows Arbitrary File Read via Cross-site Scripting (XSS).
Vulnerability: GHSA-2367-c296-3mp2
Summary: Link following in tar
Aliases: CVE-2018-20990
Severity: HIGH
CVSS score: 7.5
CWE: CWE-59
Published: 2021-08-25T20:43:54Z

An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.
Vulnerability: GHSA-6566-9526-52v6
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Concord
Aliases: CVE-2020-10591
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-02-10T20:48:47Z

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.
Vulnerability: GHSA-p2cq-cprg-frvm
Summary: Out of bounds write in tensorflow-lite
Aliases: CVE-2020-15214
Severity: HIGH
CVSS score: 8.1
CWE: CWE-787
Published: 2020-09-25T18:28:56Z

### Impact
In TensorFlow Lite models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimensionality of output tensor:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/segment_sum.cc#L39-L44

This results in allocating insufficient memory for the output tensor and in a write outside the bounds of the output array:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/reference_ops.h#L2625-L2631

This usually results in a segmentation fault, but depending on runtime conditions it can provide for a write gadget to be used in future memory corruption-based exploits.

### Patches
We have patched the issue in 204945b and will release patch releases for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that the segment ids are sorted, although this only handles the case when the segment ids are stored statically in the model.

A similar validation could be done if the segment ids are generated at runtime between inference steps.

If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-92qm-hc53-jjrj
Summary: Downloads Resources over HTTP in ibapi
Aliases: CVE-2016-10593
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:34:17Z

Affected versions of `ibapi` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `ibapi`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-j2r6-2m5c-vgh5
Summary: Counter overflow in chacha20
Aliases: CVE-2019-25005
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2021-08-25T20:45:20Z

An issue was discovered in the chacha20 crate before 0.2.3 for Rust. A ChaCha20 counter overflow makes it easier for attackers to determine plaintext.
Vulnerability: GHSA-9f66-54xg-pc2c
Summary: Open redirect vulnerability
Aliases: CVE-2020-26275
Severity: LOW
CVSS score: 6.1
CWE: CWE-601
Published: 2020-12-21T18:01:41Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.

All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

Patched in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix:

```
jupyter server --ServerApp.base_url=/jupyter/
```

### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: Yaniv Nizry from CxSCA group at Checkmarx
Vulnerability: GHSA-877x-32pm-p28x
Summary: Link Following in Kata Runtime
Aliases: CVE-2020-2026
Severity: HIGH
CVSS score: 8.8
CWE: CWE-59
Published: 2022-02-15T01:57:18Z

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
Vulnerability: GHSA-56wv-2wr9-3h9r
Summary: Improper Verification of Cryptographic Signature in fastecdsa
Aliases: CVE-2020-12607
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2021-10-12T16:30:37Z

An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
Vulnerability: GHSA-78j5-gcmf-vqc8
Summary: Cross-Site Scripting (XSS) in Verdaccio
Aliases: CVE-2019-14772
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-05-29T18:02:59Z

### Impact
What kind of vulnerability is it? Who is impacted?

Cross-Site Scripting XSS, malicious packages with content Javascript that might be executed in the User Interface stealing user credentials. 

### Patches
Has the problem been patched? What versions should users upgrade to?

Users that still using `v3` must upgrade to **>3.12.0** or those have no problem to migrate to a major version **>=4.0.0** also fix the issue.

### Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?

No, the users must update.

### References
Are there any links users can visit to find out more?

https://www.npmjs.com/advisories/832
https://www.npmjs.com/advisories/833

The issue was reported by the NPMJS Security Team

### For more information
If you have any questions or comments about this advisory:
* Read the Security Policy to find the ways to be in contact with us.
Vulnerability: GHSA-2289-pqfq-6wx7
Summary: Unrestricted upload of file with dangerous type in Apache Solr
Aliases: CVE-2019-12409
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2020-01-28T22:26:54Z

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
Vulnerability: GHSA-rrvm-gqq8-q2wx
Summary: Malicious Package in require-port
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:05:26Z

Version 1.0.0 of `require-port` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-9gqh-q4cx-f2h9
Summary: Downloads Resources over HTTP in ipip
Aliases: CVE-2016-10594
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:50:41Z

Affected versions of `ipip` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability, and the README states that the package is deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5fh3-25xr-g85h
Summary: snipe-it is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4018
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-12-03T20:40:50Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-wfp9-vr4j-f49j
Summary: NoSQL Injection in sequelize
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2019-06-04T20:04:27Z

Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.


## Recommendation

Upgrade to version 4.12.0 or later
Vulnerability: GHSA-mwcx-532g-8pq3
Summary: Access and integrity issue within Eclipse Jetty
Aliases: CVE-2018-12538
Severity: HIGH
CVSS score: 8.8
CWE: CWE-384, CWE-6
Published: 2018-10-16T17:44:11Z

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Vulnerability: GHSA-qh38-wrgf-cj2c
Summary: Directory Traversal in iter-server
Aliases: CVE-2017-16183
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:48:05Z

Affected versions of `iter-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6r97-cj55-9hrq
Summary: SQL Injection in Django
Aliases: CVE-2019-14234
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-08-16T14:00:34Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
Vulnerability: GHSA-vcqg-cmv3-wj57
Summary: Directory Traversal in rtcmulticonnection-client
Aliases: CVE-2017-16125
Severity: HIGH
CVSS score: 0
CWE: CWE-12, CWE-22
Published: 2018-07-23T22:48:49Z

Affected versions of `rtcmulticonnection-client` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-phmw-pv3f-vvx7
Summary: Moderate severity vulnerability that affects paperclip
Severity: MODERATE
CVSS score: 0
Published: 2018-08-13T20:47:44Z

Withdrawn, accidental duplicate publish.

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
Vulnerability: GHSA-wcxc-jf6c-8rx9
Summary:  Uncaught Exception in libpulse-binding
Severity: MODERATE
CVSS score: 0
CWE: CWE-248
Published: 2021-08-25T20:57:21Z

Affected versions of this crate failed to catch panics crossing FFI boundaries via callbacks, which
is a form of UB. This flaw was corrected by [this commit][1] which was included in version 2.6.0.
Vulnerability: GHSA-h4j5-c7cj-74xg
Summary: Arbitrary Code Injection
Aliases: CVE-2020-28502
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-04T18:02:34Z

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
Vulnerability: GHSA-8fv7-vm2p-5495
Summary: Directory Traversal in welcomyzt
Aliases: CVE-2017-16123
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:23:53Z

`welcomyzt` is a simple file server.

`welcomyzt` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-5mm9-55c9-p5r7
Summary: Malicious Package in mogoose
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:53:31Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-2qx8-589j-gcpx
Summary: Moderate severity vulnerability that affects Plone and plone.app.users
Aliases: CVE-2011-1950
Severity: MODERATE
CVSS score: 0
Published: 2018-07-23T20:26:45Z

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.
Vulnerability: GHSA-pf6m-fxpq-fg8v
Summary: Nokogiri lacked integer overflow checks
Aliases: CVE-2017-5029
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2018-07-31T18:21:29Z

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in Nokogiri prior to 1.7.2, lacked a check for integer overflow during a size calculation, which allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Vulnerability: GHSA-gh2w-j7cx-2664
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2012-6496
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:37Z

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
Vulnerability: GHSA-f37q-q7p2-ccfc
Summary: Resource exhaustion in Mattermost
Aliases: CVE-2022-1337
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2022-04-14T00:00:17Z

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.
Vulnerability: GHSA-8jj7-5vxc-pg2q
Summary: Integer overflow in TensorFlow
Aliases: CVE-2022-23587
Severity: HIGH
CVSS score: 8.8
CWE: CWE-190
Published: 2022-02-09T23:27:49Z

### Impact
Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during [cost estimation for crop and resize](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L2621-L2689). Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior.

### Patches
We have patched the issue in GitHub commit [0aaaae6eca5a7175a193696383f582f53adab23f](https://github.com/tensorflow/tensorflow/commit/0aaaae6eca5a7175a193696383f582f53adab23f).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-r87w-47m8-22w3
Summary: Template Injection in jsrender
Aliases: CVE-2016-3942
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-94
Published: 2020-09-01T15:24:24Z

Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.

## Proof of Concept


```
<POC-REQUEST>
{{for ~x!=1?(constructor.constructor("return arguments.callee.caller")()):~y(10)}}
{{:#data}}
{{/for}}
</POC-REQUEST>
```

```
<POC-RESPONSE>
function anonymous(data,view,j,u) { // template var v,t=j._tag,ret="" +t("for",view,this,[ {view:view,tmpl:1, params:{args:['~x!=1?(constructor.constructor(\"return arguments.callee.caller\")()):~y(10)']}, args:[view.hlp("x")!=1?(data.constructor.constructor("return arguments.callee.caller")()):view.hlp("y")(10)], props:{}}]); return ret; } 
<POC-RESPONSE>
```


## Recommendation

Update to version 0.9.74 or later.
Vulnerability: GHSA-j4rw-x3vg-c8r7
Summary: Prototype Pollution in node-oojs
Aliases: CVE-2020-7721
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:12:37Z

All versions of package node-oojs up to and including version 1.4.0 are vulnerable to Prototype Pollution via the setPath function.
Vulnerability: GHSA-c43v-hrmg-56r4
Summary: Moderate severity vulnerability that affects cocaine
Aliases: CVE-2013-4457
Severity: MODERATE
CVSS score: 0
CWE: CWE-78
Published: 2017-10-24T18:33:37Z

The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation.
Vulnerability: GHSA-m8cr-q935-8j67
Summary: Path Traversal in buttle
Aliases: CVE-2018-3766
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-09-18T13:47:57Z

All versions of `buttle` are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-6346-5r4h-ff5x
Summary: Microweber vulnerable to cross-site scripting (XSS)
Aliases: CVE-2022-1555
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2022-05-05T00:00:26Z

Microweber is a drag and drop website builder and a powerful next generation CMS. Microweber versions 1.2.15 and prior are vulnerable to cross-site scripting. This could lead to injection of arbitrary JaveScript code, defacement of a page, or stealing cookies. A patch is available on the `master` branch of Microweber's GitHub repository.
Vulnerability: GHSA-wc9w-wvq2-ffm9
Summary: Server Side Request Forgery in Grafana
Aliases: CVE-2020-13379
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-918
Published: 2022-02-15T01:57:18Z

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.
Vulnerability: GHSA-vp4x-94ff-2cmv
Summary: Cross-site scripting in forkcms
Aliases: CVE-2020-23263
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T22:29:03Z

Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
Vulnerability: GHSA-xjxc-vfw2-cg96
Summary: Use after free in openssl
Aliases: CVE-2018-20997
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:43:45Z

An issue was discovered in the openssl crate before 0.10.9 for Rust. A use-after-free occurs in CMS Signing.
Vulnerability: GHSA-758m-6g3q-g3hh
Summary: Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character
Aliases: CVE-2017-7676
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2018-10-17T17:22:38Z

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.
Vulnerability: GHSA-5mv9-q7fq-9394
Summary: Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Aliases: CVE-2021-32635
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-20
Published: 2021-06-01T21:21:01Z

### Impact

Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container.

Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint.

### Patches

All users should upgrade to Singularity 3.7.4 or later.

### Workarounds

Users who only interact with the default remote endpoint are not affected.

Installations with an execution control list configured to restrict execution to containers signed with specific secure keys are not affected.

### For more information

General questions about the impact of the advisory can be asked in the:

- [SingularityCE Slack Channel](https://singularityce.slack.com)
- [SingularityCE Mailing List](https://groups.google.com/g/singularity-ce)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-wm93-f238-7v37
Summary: Integer overflow in Tensorflow
Aliases: CVE-2022-23576
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-190
Published: 2022-02-10T00:32:44Z

### Impact
The [implementation of `OpLevelCostEstimator::CalculateOutputSize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1598-L1617) is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements:
```cc
for (const auto& dim : output_shape.dim()) {
  output_size *= dim.size();
} 
```
  
Here, we can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication.

### Patches
We have patched the issue in GitHub commit [b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae](https://github.com/tensorflow/tensorflow/commit/b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-pqcf-v8v5-jmcg
Summary: Zip slip in Microweber
Aliases: CVE-2020-28337
Severity: HIGH
CVSS score: 7.2
CWE: CWE-22
Published: 2022-02-10T22:23:18Z

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Vulnerability: GHSA-gj4p-3wh3-2rmf
Summary: High severity vulnerability that affects yard
Aliases: CVE-2017-17042
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2017-12-21T00:47:25Z

lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block relative paths with an initial ../ sequence, which allows attackers to conduct directory traversal attacks and read arbitrary files.
Vulnerability: GHSA-c7c7-xm8g-xm36
Summary: Moderate severity vulnerability that affects net.mingsoft:ms-mcms
Aliases: CVE-2018-18830
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2018-11-01T14:48:29Z

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.
Vulnerability: GHSA-84cm-v6jp-gjmr
Summary: OS command injection in git-diff-apply
Aliases: CVE-2019-10776
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-02-14T23:09:24Z

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
Vulnerability: GHSA-v5v3-8jqf-vg27
Summary: Downloads Resources over HTTP in aerospike
Aliases: CVE-2016-10558
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:22Z

Affected versions of `aerospike` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `aerospike`.


## Recommendation

Update to version 2.4.2 or later
Vulnerability: GHSA-hg7w-2pf7-mxm2
Summary: Malicious Package in wbe3
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:02:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.