TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-2hjr-fg6c-v2h6
Summary: Unauthorized access to Class instance in Jinjava
Aliases: CVE-2020-12668
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2022-02-09T00:33:56Z

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
Vulnerability: GHSA-cxm3-v4mv-6mh8
Summary: Cross-site Scripting in vditor
Aliases: CVE-2021-4103
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-28T22:04:11Z

vditor does not filter user input
Vulnerability: GHSA-hhwc-8g49-j8jx
Summary: Incorrect Permission Assignment for Critical Resource in ruby_parser-legacy
Aliases: CVE-2019-18409
Severity: HIGH
CVSS score: 7.8
CWE: CWE-732
Published: 2019-10-25T19:41:34Z

The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb file.
Vulnerability: GHSA-g67g-hvc3-xmvf
Summary: Inconsistent input sanitisation leads to XSS vectors
Aliases: CVE-2021-41132
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-116, CWE-79
Published: 2021-10-14T21:19:23Z

### Background

A variety of templates do not perform proper sanitization through HTML escaping.
Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields.

### Impact

OMERO.web before 5.11.0 and OMERO.figure before 4.4.1.

### Patches
Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.
Vulnerability: GHSA-g9wg-wq4f-2x5w
Summary: Cross-Site Scripting in console-feed
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T19:00:10Z

Versions of `console-feed` prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses `console-feed` and a malicious JavaScript payload was passed to a `console.log('%_', payload)` call, the package would render HTML containing the malicious payload.


## Recommendation

Upgrade to version 2.8.10 or later.
Vulnerability: GHSA-m6q5-wv4x-fv6h
Summary: Cross-site Scripting in Drupal Core
Aliases: CVE-2020-13668
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-12T00:00:47Z

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Vulnerability: GHSA-vwr2-wj63-86gr
Summary: Path Traversal in simplehttpserver
Aliases: CVE-2018-16478
Severity: MODERATE
CVSS score: 0
CWE: CWE-12, CWE-22
Published: 2018-12-06T15:49:10Z

All versions of `simplehttpserver` are vulnerable to Path Traversal. 

This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.


## Recommendation

No fix is currently available. Do not use `simplehttpserver` in production or consider using an alternative module until a fix is made available.
Vulnerability: GHSA-vqp6-j452-j6wp
Summary: Open Redirect in CPython that affects users of OpenStack Nova
Aliases: CVE-2021-3654
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-03-04T00:00:22Z

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Vulnerability: GHSA-ffm7-7r8g-77xm
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache CXF
Aliases: CVE-2020-1954
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2022-02-10T22:38:50Z

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory’ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.
Vulnerability: GHSA-fg2v-w576-w4v3
Summary: Out of bounds read in json-smart
Aliases: CVE-2021-31684
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787, CWE-125
Published: 2022-02-10T22:46:22Z

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions prior to 1.3.3 and 2.4.5 which causes a denial of service (DOS) via a crafted web request.
Vulnerability: GHSA-qv7g-j98v-8pp7
Summary: XSS vulnerability on email template preview page
Aliases: CVE-2021-41236
Severity: MODERATE
CVSS score: 6.9
CWE: CWE-79
Published: 2022-01-06T18:34:35Z

### Summary

Email template preview is vulnerable to XSS payload added to email template content. The attacker should have permission to create or edit an email template. For successful payload, execution attacked user should preview a vulnerable email template.

### Workarounds

There are no workarounds that address this vulnerability.
Vulnerability: GHSA-86pv-95mj-7w5f
Summary: Stored XSS vulnerability on Bounce Management Callback
Aliases: CVE-2021-27910
Severity: HIGH
CVSS score: 8.2
CWE: CWE-79
Published: 2021-09-01T18:40:48Z

### Impact
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.

An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function.

The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:

* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-7mv4-4xpg-xq44
Summary: FormField with square brackets in field name skips validation
Aliases: CVE-2020-26138
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2022-03-26T00:14:34Z

FileField with array notation skips validation

The FileField class is commonly used for file upload in custom code on a Silverstripe website. This field is designed to be used with a single file upload.

PHP allows for submitting multiple values by adding square brackets to the field name. When this is done to a FileField, it will be coerced into allowing multiple files by using this notation. This is not a supported feature, though nothing is done to prevent this.

In this scenario, validation such as limiting allowed extensions is not applied, and the FileField->saveInto() behaviour is not triggered. If custom controller logic is used to process the file uploads, it might implicitly rely on validation to be provided by the Form system, which is not the case.
Vulnerability: GHSA-w29m-fjp4-qhmq
Summary: Unsafe Identifiers in Opencast
Aliases: CVE-2020-5230
Severity: MODERATE
CVSS score: 7.7
CWE: CWE-99
Published: 2020-01-30T21:21:50Z

### Impact

Opencast allows almost arbitrary identifiers for media packages and
elements to be used. This can be problematic for operation and security
since such identifiers are sometimes used for file system operations
which may lead to an attacker being able to escape working directories and
write files to other locations.

In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior,
the latter trying to mitigate some of the file system problems, can
cause errors due to identifier mismatch since an identifier may
unintentionally change.

### Patches

This issue is fixed in Opencast 7.6 and 8.1.

### Workarounds

There is no workaround for this.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-jpj4-5xwp-cv23
Summary: Remote code execution in DolphinScheduler
Aliases: CVE-2020-11974
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-02-09T22:44:54Z

In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
Vulnerability: GHSA-2v6x-frw8-7r7f
Summary: Exposure of Sensitive Information to an Unauthorized Actor in kube-state-metrics
Aliases: CVE-2019-17110
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2021-05-18T15:38:54Z

A security issue was discovered in kube-state-metrics 1.7.x before 1.7.2. An experimental feature was added to v1.7.0 and v1.7.1 that enabled annotations to be exposed as metrics. By default, kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.
Vulnerability: GHSA-3w5h-x4rh-hc28
Summary: Exposure of sensitive information in Apache Ozone
Aliases: CVE-2021-39231
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-668
Published: 2021-11-23T18:18:25Z

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.
Vulnerability: GHSA-q8q8-93cv-v6h8
Summary: Lookup function information discolosure in helm
Aliases: CVE-2020-11013
Severity: HIGH
CVSS score: 8.5
CWE: CWE-200
Published: 2021-05-27T18:44:56Z

The Helm core maintainers have identified an information disclosure vulnerability in Helm 3.0.0-3.1.2. 

### Impact

`lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates.

The documented behavior of `helm template` states that it does not attach to a remote cluster. However, as the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior.

Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability.

A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user's `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`.

### Patches

This issue has been fixed in Helm 3.2.0

### Workarounds

Due to another bug (also fixed in Helm 3.2.0), the command `helm lint` will fail with an error if the `lookup` function is used in a chart. Therefore, run `helm lint` on an untrusted chart before running `helm template`.

Alternately, setting the `KUBECONFIG` environment variable to point to an empty Kubernetes configuration file will prevent unintended network connections.

Finally, a chart may be manually analyzed for the presence of a `lookup` function in any file in the `templates/` directory.  

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Helm repository](https://github.com/helm/helm/issues)
* For security-specific issues, email us at [cncf-helm-security@lists.cncf.io](mailto:cncf-helm-security@lists.cncf.io)
Vulnerability: GHSA-xr38-w74q-r8jv
Summary: Permissions not properly checked in Invenio-Drafts-Resources
Aliases: CVE-2021-43781
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-862
Published: 2021-12-06T23:57:59Z

### Impact

Invenio-Drafts-Resources does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public.

### Details

The service's ``publish()`` method contains the following permission check:

```python
def publish(..):
    self.require_permission(identity, "publish")
```
However, the record should have been passed into the permission check so that the need generators have access to e.g. the record owner.

```python
def publish(..):
    self.require_permission(identity, "publish", record=record)
```
The bug is activated in Invenio-RDM-Records which has a need generator called ``RecordOwners()``, which when no record is passed in defaults to allow any authenticated user:

```python
class RecordOwners(Generator):
    def needs(self, record=None, **kwargs):
        if record is None:
            return [authenticated_user]
    # ...
```

### Patches

The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6+, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

You can verify the version installed of Invenio-Drafts-Resources via PIP:

```console
cd ~/src/my-site
pipenv run pip freeze | grep invenio-drafts-resources
```

### References

- [Security policy](https://invenio.readthedocs.io/en/latest/community/security-policy.html)

### For more information

If you have any questions or comments about this advisory:
* Chat with us on Discord: https://discord.gg/8qatqBC
Vulnerability: GHSA-4j82-5ccr-4r8v
Summary: `CHECK`-failures in `TensorByteSize` in Tensorflow
Aliases: CVE-2022-23582
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-10T00:34:01Z

### Impact
A malicious user can cause a denial of service by altering a `SavedModel` such that [`TensorByteSize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/attr_value_util.cc#L46-L50) would trigger `CHECK` failures.

```cc
int64_t TensorByteSize(const TensorProto& t) {
  // num_elements returns -1 if shape is not fully defined.
  int64_t num_elems = TensorShape(t.tensor_shape()).num_elements();
  return num_elems < 0 ? -1 : num_elems * DataTypeSize(t.dtype());
}
```
`TensorShape` constructor throws a `CHECK`-fail if shape is partial or has a number of elements that would overflow the size of an `int`. The `PartialTensorShape` constructor instead does not cause a `CHECK`-abort if the shape is partial, which is exactly what this function needs to be able to return `-1`.

### Patches
We have patched the issue in GitHub commit [c2426bba00a01de6913738df8fa78e0215fcce02](https://github.com/tensorflow/tensorflow/commit/c2426bba00a01de6913738df8fa78e0215fcce02).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-8mrf-64fw-2x75
Summary: Command injection in fs-path
Aliases: CVE-2020-8298
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-03-25T21:06:41Z

fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
Vulnerability: GHSA-v9mf-jgq3-c28h
Summary: Data Amplification in Play Framework
Aliases: CVE-2020-28923
Severity: LOW
CVSS score: 2.7
CWE: CWE-20
Published: 2022-02-09T22:54:21Z

An issue was discovered in Play Framework 2.8.0 through 2.8.4. Carefully crafted JSON payloads sent as a form field lead to Data Amplification. This affects users migrating from a Play version prior to 2.8.0 that used the Play Java API to serialize classes with protected or private fields to JSON.
Vulnerability: GHSA-fpgg-r39h-3x5x
Summary: Malicious Package in cxt
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:06:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-2958-5r4r-wvv6
Summary: Directory Traversal in caolilinode
Aliases: CVE-2017-16159
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:27:05Z

Affected versions of `caolilinode` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-wp47-9r3h-xfgq
Summary: Server-Side Request Forgery in Apache Traffic Control
Aliases: CVE-2022-23206
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2022-02-07T00:00:23Z

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
Vulnerability: GHSA-h353-hc43-95vc
Summary: Script injection without script or programming rights through Gadget titles
Aliases: CVE-2021-32621
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94
Published: 2021-05-18T18:36:16Z

### Impact
A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard.

### Patches
The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1.

### Workarounds
There's no easy workaround for this issue, it is recommended to upgrade XWiki.

### References
https://jira.xwiki.org/browse/XWIKI-17794

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-mhx2-r3jx-g94c
Summary: Moderate severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2015-0264
Severity: MODERATE
CVSS score: 0
Published: 2018-10-16T23:09:15Z

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Vulnerability: GHSA-w285-wf9q-5w69
Summary: In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode
Aliases: CVE-2016-1000352
Severity: HIGH
CVSS score: 7.4
CWE: CWE-326
Published: 2018-10-17T16:27:38Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Vulnerability: GHSA-xfhh-g9f5-x4m4
Summary: Resource exhaustion in socket.io-parser
Aliases: CVE-2020-36049
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-30T16:51:31Z

The `socket.io-parser` npm package before versions 3.3.2 and 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Vulnerability: GHSA-36m4-6v6m-4vpr
Summary: Cross-site Scripting in remarkable
Aliases: CVE-2019-12043
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-05-29T18:04:55Z

In remarkable 1.7.1, lib/parser_inline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL.
Vulnerability: GHSA-6pmv-7pr9-cgrj
Summary: Predictable password in Keycloak
Aliases: CVE-2020-1731
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-330, CWE-341
Published: 2020-04-15T21:09:27Z

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.
Vulnerability: GHSA-wgw3-gf4p-62xc
Summary: Command Injection in wizard-syncronizer
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:16:59Z

All versions of `wizard-syncronizer` are vulnerable to Command Injection. The package does not validate input on the `cloneAndSync` function  and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the `gitURL` value or through a MITM attack since the package does not enforce HTTPS. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-qw9c-8p76-3q2x
Summary: Directory Traversal in serve46
Aliases: CVE-2017-16148
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:49:11Z

Affected versions of `serve46` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8g7p-74h8-hg48
Summary: Denial of Service in https-proxy-agent
Aliases: CVE-2018-3739
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-400, CWE-125
Published: 2018-07-27T17:04:52Z

Versions of `https-proxy-agent` before 2.2.0 are vulnerable to denial of service. This is due to unsanitized options (proxy.auth) being passed to `Buffer()`.


## Recommendation

Update to version 2.2.0 or later.
Vulnerability: GHSA-h8mc-42c3-r72p
Summary: Downloads resources over HTTP in hubl-server
Aliases: CVE-2017-16035
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-07-24T15:40:47Z

Affected versions of `hubl-server` insecurely download dependencies over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the responses and replace the dependencies with malicious ones, resulting in code execution on the system running `hubl-server`.


## Recommendation

No patch is currently available for this vulnerability, and it has not seen any updates since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo
Vulnerability: GHSA-qg24-8xj4-gj2h
Summary: Unaligned memory allocation in chunky
Aliases: CVE-2020-36433
Severity: HIGH
CVSS score: 7.5
CWE: CWE-758
Published: 2021-08-25T20:58:13Z

An issue was discovered in the chunky crate through 2020-08-25 for Rust. The Chunk API does not honor an alignment requirement.
Vulnerability: GHSA-m5wp-p3gj-7q5g
Summary: Missing Authorization in Jenkins dbCharts Plugin
Aliases: CVE-2022-25206
Severity: HIGH
CVSS score: 8.8
CWE: CWE-862
Published: 2022-02-16T00:01:16Z

A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
Vulnerability: GHSA-qxg5-2qff-p49r
Summary: Passing in a non-string 'html' argument can lead to unsanitized output
Aliases: CVE-2021-32696
Severity: MODERATE
CVSS score: 3.7
CWE: CWE-241, CWE-79, CWE-843
Published: 2021-06-18T19:31:35Z

A type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.

### Impact

XSS

### Patches

`3.2.0`

### Workarounds

Ensure that the `html` parameter is a string before calling the function.
Vulnerability: GHSA-c8xp-8mf3-62h9
Summary: OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Aliases: CVE-2021-3761
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787, CWE-295
Published: 2021-09-07T23:02:18Z

Any CA issuer in the RPKI can trick OctoRPKI prior to https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. 

### Impact

An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.

### Patches
https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422

https://github.com/cloudflare/cfrpki/releases/tag/v1.3.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@cloudflare.com](security@cloudflare.com)
Vulnerability: GHSA-86f3-hf24-76q4
Summary: Use of Hard-coded Cryptographic Key in Netmaker
Aliases: CVE-2022-23650
Severity: HIGH
CVSS score: 7.2
CWE: CWE-798, CWE-321
Published: 2022-02-22T19:40:23Z

### Impact
There is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server (netmaker) component, and not clients.

### Patches
This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. If you are running these versions, the fix is to perform the following:

1. docker-compose down
2. docker pull gravitl/netmaker:( version )
3. docker-compose up -d

#### Additional Information
If you are running **any other version**, you will need to upgrade to one of these three versions. If you have a special circumstance that requires running a different version, let us know and we may be able to build a custom patch.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@gravitl.com](mailto:info@gravitl.com)
Vulnerability: GHSA-cf3c-fffp-34qh
Summary: High severity vulnerability that affects conference-scheduler-cli
Aliases: CVE-2018-14572
Severity: HIGH
CVSS score: 7.8
CWE: CWE-502, CWE-78
Published: 2018-10-29T19:05:38Z

In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.
Vulnerability: GHSA-8864-rhmw-5m6f
Summary: Cross-Site Scripting in status-board
Aliases: CVE-2019-15479
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-09-23T18:32:42Z

All versions of `status-board` are vulnerable to Cross-Site Scripting. The `renderDashboard()` function concatenates the `safeDashboard` variable to the printed error message with insufficient sanitization. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-mx3x-rmrh-9wf6
Summary: SQL injection in net.mingsoft:ms-mcms
Aliases: CVE-2022-26585
Severity: HIGH
CVSS score: 0
Published: 2022-04-06T00:01:35Z

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
Vulnerability: GHSA-99cg-575x-774p
Summary: Improper Input Validation in AKPublic.Verify with attacker-controlled TPM Quote
Aliases: CVE-2022-0317
Severity: MODERATE
CVSS score: 4
CWE: CWE-20
Published: 2022-02-01T00:43:17Z

### Impact

An improper input validation vulnerability in go-attestation before 0.4.0 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing `AKPublic.Verify` to succeed despite the inconsistency. Subsequent use of the same set of PCR values in `Eventlog.Verify` lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in `Eventlog.Verify` to spoof events in the TCG log, hence defeating remotely-attested measured-boot.

### Patches
This issue is resolved in version 0.4.0. If your usage of this library verifies PCRs using multiple quotes, make sure to use the new method `AKPublic.VerifyAll()` instead of `AKPublic.Verify`.
Vulnerability: GHSA-gwj5-3vfq-q992
Summary: Import loops in account imports, nats-server DoS
Severity: LOW
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-21T16:22:16Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2020-28466.txt>)

## Problem Description

An export/import cycle between accounts could crash the nats-server, after consuming CPU and memory.

This issue was fixed publicly in <https://github.com/nats-io/nats-server/pull/1731> in November 2020.

The need to call this out as a security issue was highlighted by `snyk.io` and we are grateful for their assistance in doing so.

Organizations which run a NATS service providing access to accounts run by untrusted third parties are affected.
See below for an important caveat if running such a service.


## Affected versions

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable.
 * fixed with nats-io/nats-server PR 1731, commit 2e3c226729


## Impact

The nats-server could be killed, after consuming resources.


## Workaround

The import cycle requires at least two accounts to work; if you have open account sign-up, then restricting new account sign-up might hinder an attacker.


## Solution

Upgrade the nats-server.


## Caveat on NATS with untrusted users

Running a NATS service which is exposed to untrusted users presents a heightened risk.

Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers.

Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention.

Those who are running such services are encouraged to build regularly from git.
Vulnerability: GHSA-jfq2-rj7f-9gvf
Summary: Null pointer dereference in TensorFlow leads to exploitation
Aliases: CVE-2018-7576
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-476
Published: 2019-04-24T16:11:27Z

Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.
Vulnerability: GHSA-38hx-3542-8fh3
Summary: Malicious code in `electorn`
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2020-10-01T17:09:56Z

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information:
- IP and IP-based geolocation
- home directory name
- local username 

The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.
Vulnerability: GHSA-g4c2-ghfg-g5rh
Summary: Cross-site Scripting and Open Redirect in Products.ATContentTypes
Aliases: CVE-2022-23599
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-79
Published: 2022-01-28T23:10:37Z

### Impact
Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.
The technique is known as cache poisoning.
Any later visitor can get redirected when clicking on a link on this page.
Usually only anonymous users are affected, but this depends on your cache settings.

### Patches
A new version 3.0.6 of Products.ATContentTypes has been released with a fix.
This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7.

Note that the Products.CMFPlone package has the same problem in the 4.3 series.
`plone.app.contenttypes` has the same problem in all versions, see [advisory](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x).
For all unpatched versions of the three packages, you can use the following workaround.

### Workaround
Make sure the image_view_fullscreen page is not stored in the cache.
In Plone:

* Login as Manager and go to Site Setup.
* Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable.
* Click on the tab 'Caching operations'.
* Under 'Legacy template mappings' locate the ruleset 'Content item view'.
* From the last column ('Templates')  remove 'image_view_fullscreen'.
* Click on Save.

### Reporter
This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!

### For more information
If you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org)
This is also the correct address to use when you want to report a possible vulnerability.
See [our security report policy](https://plone.org/security/report).
Vulnerability: GHSA-pw59-4qgf-jxr8
Summary: Cache Manipulation Attack in Apache Traffic Control
Aliases: CVE-2020-17522
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-732, CWE-525
Published: 2021-12-16T19:20:21Z

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
Vulnerability: GHSA-fq77-7p7r-83rj
Summary: Directory Traversal in Next.js
Aliases: CVE-2020-5284
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-23
Published: 2020-03-30T20:40:50Z

### Impact

- **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected
- **Not affected**: Deployments using the `serverless` target
- **Not affected**: Deployments using `next export`
- **Affected**: Users of Next.js below 9.3.2

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/zeit/next.js/releases/tag/v9.3.2

### References

https://github.com/zeit/next.js/releases/tag/v9.3.2
Vulnerability: GHSA-8v63-cqqc-6r2c
Summary: Prototype Pollution in object-path
Aliases: CVE-2021-3805
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321, CWE-915
Published: 2021-09-20T20:46:43Z

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-w7q9-p3jq-fmhm
Summary: Uncontrolled resource consumption in jpeg-js
Aliases: CVE-2020-8175
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2020-07-27T15:46:57Z

Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.
Vulnerability: GHSA-mxjj-953w-2c2v
Summary: Data corruption in tensorflow-lite
Aliases: CVE-2020-15208
Severity: HIGH
CVSS score: 7.4
CWE: CWE-787, CWE-125
Published: 2020-09-25T18:28:44Z

### Impact
When determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/types.h#L437-L442

Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors.

### Patches
We have patched the issue in 8ee24e7949a20 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-579x-cjvr-cqj9
Summary: Observable Response Discrepancy in Lost Password Service
Aliases: CVE-2021-39189
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-204, CWE-203
Published: 2021-09-20T19:53:55Z

### Impact
It is possible to enumerate usernames via the forgot password functionality

### Patches
Update to version `10.1.3` or apply this patch manually: https://github.com/pimcore/pimcore/pull/10223.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/10223.patch manually.
Vulnerability: GHSA-h3q4-vmw4-cpr5
Summary: Path Traversal in Gitea
Aliases: CVE-2021-29134
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2022-03-16T00:00:38Z

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
Vulnerability: GHSA-vqw6-72r7-fgw7
Summary: OOB read in `MatrixTriangularSolve`
Aliases: CVE-2021-29551
Severity: LOW
CVSS score: 2.5
CWE: CWE-125
Published: 2021-05-21T14:23:44Z

### Impact
The implementation of [`MatrixTriangularSolve`](https://github.com/tensorflow/tensorflow/blob/8cae746d8449c7dda5298327353d68613f16e798/tensorflow/core/kernels/linalg/matrix_triangular_solve_op_impl.h#L160-L240) fails to terminate kernel execution if one validation condition fails:

```cc
void ValidateInputTensors(OpKernelContext* ctx, const Tensor& in0,
                            const Tensor& in1) override {
  OP_REQUIRES(
      ctx, in0.dims() >= 2,
      errors::InvalidArgument("In[0] ndims must be >= 2: ", in0.dims()));

  OP_REQUIRES(
      ctx, in1.dims() >= 2,
      errors::InvalidArgument("In[0] ndims must be >= 2: ", in1.dims()));
}
  
void Compute(OpKernelContext* ctx) override {
  const Tensor& in0 = ctx->input(0);
  const Tensor& in1 = ctx->input(1);

  ValidateInputTensors(ctx, in0, in1);

  MatMulBCast bcast(in0.shape().dim_sizes(), in1.shape().dim_sizes());
  ...
}
```
  
Since `OP_REQUIRES` only sets `ctx->status()` to a non-OK value and calls `return`, this allows malicious attackers to trigger an out of bounds read:

```python
import tensorflow as tf
import numpy as np

matrix_array = np.array([])
matrix_tensor = tf.convert_to_tensor(np.reshape(matrix_array,(1,0)),dtype=tf.float32)
rhs_array = np.array([])
rhs_tensor = tf.convert_to_tensor(np.reshape(rhs_array,(0,1)),dtype=tf.float32)

tf.raw_ops.MatrixTriangularSolve(matrix=matrix_tensor,rhs=rhs_tensor,lower=False,adjoint=False)
```

As the two input tensors are empty, the `OP_REQUIRES` in `ValidateInputTensors` should fire and interrupt execution. However, given the implementation of `OP_REQUIRES`, after the `in0.dims() >= 2` fails, execution moves to the initialization of the `bcast` object. This initialization is done with invalid data and results in heap OOB read.

### Patches
We have patched the issue in GitHub commit [480641e3599775a8895254ffbc0fc45621334f68](https://github.com/tensorflow/tensorflow/commit/480641e3599775a8895254ffbc0fc45621334f68).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ye Zhang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-974j-wjxx-wggj
Summary: Incorrect Access Control vulnerability in api-platform/core
Aliases: CVE-2019-1000011
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-284
Published: 2019-10-14T21:23:26Z

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
Vulnerability: GHSA-h5vm-jhq7-w647
Summary: Malicious Package in momen
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:17:13Z

All versions of `momen` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-mmf6-6597-3v6m
Summary: Open Redirect in Spring Security OAuth
Aliases: CVE-2019-11269
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-601
Published: 2019-06-13T20:18:28Z

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
Vulnerability: GHSA-h47j-hc6x-h3qq
Summary: Remote Code Execution Vulnerability in NPM mongo-express
Aliases: CVE-2019-10758
Severity: HIGH
CVSS score: 0
Published: 2019-12-30T19:30:31Z

### Impact

Remote code execution on the host machine by any authenticated user.

### Proof Of Concept

Launching mongo-express on a Mac, pasting the following into the "create index" field will pop open the Mac calculator:

```javascript
this.constructor.constructor("return process")().mainModule.require('child_process').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')
```

### Patches
Users should upgrade to version `0.54.0`

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
[Snyk Security Advisory](https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215)
[CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10758)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)

#### Thanks

@JLLeitschuh for finding and reporting this vulnerability
Vulnerability: GHSA-7c2r-3jqf-c9rw
Summary: Moderate severity vulnerability that affects com.fasterxml.jackson.dataformat:jackson-dataformat-xml
Aliases: CVE-2016-7051
Severity: HIGH
CVSS score: 8.6
CWE: CWE-611, CWE-918
Published: 2018-10-18T17:43:28Z

XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors related to a DTD.
Vulnerability: GHSA-q9p8-33wc-h432
Summary: Authenticated users can exploit an enumeration vulnerability in Harbor
Aliases: CVE-2020-13794
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2021-05-24T16:58:06Z

### **Impact**

Hidde Smit from Cyber Eagle has discovered an User Enumeration flaw in Harbor. The issue is present in the "/users" api endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained via the "search" functionality.

Non-administrator users (such as those created via self-registration) can list all usernames and user IDs by sending a GET request to /api/users/search with parameter "username" and value "_", as follows:

`curl -X GET "https://<host>/api/users/search?username=_" -H "accept: application/json" --user <user>:<password>`

The vulnerability was immediately fixed by the Harbor team and all supported versions were patched. With the patched versions of Harbor, the username is required for search and we have removed the support for querying by email.

### **Patches**
If your product uses the affected releases of Harbor, update to either version 2.1.0 or 2.0.3 to fix this issue immediately

https://github.com/goharbor/harbor/releases/tag/v2.1.0
https://github.com/goharbor/harbor/releases/tag/v2.0.3

### **Workarounds**
There is no workaround for this issue

### **For more information**
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13794
Vulnerability: GHSA-mjww-934m-h4jw
Summary: Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua
Aliases: CVE-2020-29457
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-295
Published: 2021-11-19T20:19:53Z

A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates.
Vulnerability: GHSA-4g88-fppr-53pp
Summary: Prototype Pollution in set-value
Aliases: CVE-2019-10747
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-400
Published: 2019-08-27T17:43:33Z

Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

If you are using `set-value` 3.x, upgrade to version 3.0.1 or later.
If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.