TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fwh7-v4gf-xv7w
Summary: yetiforcecrm is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4116
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-79
Published: 2021-12-16T21:00:45Z

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-vqqx-jw6p-q3rf
Summary: Cross-Site Scripting in Fluid view helpers
Aliases: CVE-2020-26227
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-12-21T16:28:11Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7)
> * CWE-79

### Problem
It has been discovered that system extension Fluid (`typo3/cms-fluid`) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.

```
<f:form ... fieldNamePrefix="{payload}" />
<f:be.labels.csh ... label="{payload}" />
<f:be.menus.actionMenu ... label="{payload}" />
```

### Solution
Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2020-010](https://typo3.org/security/advisory/typo3-core-sa-2020-010)
Vulnerability: GHSA-g6xv-8q23-w2q3
Summary: SQL Injection in Gogs
Aliases: CVE-2014-8682
Severity: HIGH
CVSS score: 7.3
CWE: CWE-89
Published: 2021-06-29T18:32:48Z

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.
Vulnerability: GHSA-cr6c-85fh-cqpg
Summary: Downloads Resources over HTTP in haxeshim
Aliases: CVE-2016-10692
Severity: HIGH
CVSS score: 8.1
Published: 2018-07-31T22:27:04Z

Affected versions of `haxeshim` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxeshim`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-cvj4-g3gx-8vqq
Summary: Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request
Aliases: CVE-2017-14949
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-17T00:04:18Z

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.
Vulnerability: GHSA-qh2h-chj9-jffq
Summary: Command Injection in growl
Aliases: CVE-2017-16042
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2018-06-08T12:43:43Z

Affected versions of `growl` do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.


## Recommendation

Update to version 1.10.2 or later.
Vulnerability: GHSA-446w-rrm4-r47f
Summary: Exposure of home directory through shescape on Unix with Bash
Aliases: CVE-2022-24725
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-200
Published: 2022-03-03T19:26:11Z

### Impact

The issue allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected.

```javascript
const cp = require("child_process");
const shescape = require("shescape");

const payload = "home_directory=~";
const options = { interpolation: true };
console.log(cp.execSync(`echo ${shescape.escape(payload, options)}`));
// home_directory=/home/user
```

Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_.

### Patches

The issue was patched in `v1.5.1`.

### Workarounds

Manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, "\\~")`.

### References

See GitHub issue https://github.com/ericcornelissen/shescape/issues/169.
Vulnerability: GHSA-jrj9-5qp6-2v8q
Summary: Machine-In-The-Middle in airtable
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T23:22:19Z

Affected versions of `airtable` are vulnerable to Machine-In-The-Middle. The package has SSL certificate validation disabled by default unintentionally. This may allow attackers in a privileged network position to decrypt intercepted traffic.


## Recommendation

Upgrade to version 0.7.2 or later.
Vulnerability: GHSA-q74r-4xw3-ppx9
Summary: Stored cross-site scripting in Grid component in Vaadin 7 and 8
Aliases: CVE-2019-25028
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79, CWE-80
Published: 2021-04-19T14:49:48Z

Missing variable sanitization in `Grid` component in `com.vaadin:vaadin-server` versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector.

- https://vaadin.com/security/cve-2019-25028
Vulnerability: GHSA-g644-pr5v-vppf
Summary: Insertion of Sensitive Information into Log File in Apache NiFi
Aliases: CVE-2020-9486
Severity: HIGH
CVSS score: 7.5
CWE: CWE-532
Published: 2022-01-06T20:41:02Z

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.
Vulnerability: GHSA-552w-rqg8-gxxm
Summary: Moderate severity vulnerability that affects validator
Aliases: CVE-2013-7453
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.
Vulnerability: GHSA-5726-g6r9-5f22
Summary: Potential for Script Injection in syntax-error
Aliases: CVE-2014-7192
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

Versions of `syntax-error` prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified. 

## Recommendation

Update to version 1.1.1 or later.
Vulnerability: GHSA-v6r6-84gr-92rm
Summary: Heap buffer overflow in `AvgPool3DGrad`
Aliases: CVE-2021-29577
Severity: LOW
CVSS score: 2.5
CWE: CWE-119, CWE-787
Published: 2021-05-21T14:26:18Z

### Impact
The implementation of `tf.raw_ops.AvgPool3DGrad` is vulnerable to a heap buffer overflow:

```python
import tensorflow as tf

orig_input_shape = tf.constant([10, 6, 3, 7, 7], shape=[5], dtype=tf.int32)
grad = tf.constant([0.01, 0, 0], shape=[3, 1, 1, 1, 1], dtype=tf.float32)
ksize = [1, 1, 1, 1, 1]
strides = [1, 1, 1, 1, 1]
padding = "SAME"

tf.raw_ops.AvgPool3DGrad(
  orig_input_shape=orig_input_shape, grad=grad, ksize=ksize, strides=strides,
  padding=padding)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/d80ffba9702dc19d1fac74fc4b766b3fa1ee976b/tensorflow/core/kernels/pooling_ops_3d.cc#L376-L450) assumes that the `orig_input_shape` and `grad` tensors have similar first and last dimensions but does not check that this assumption is validated.

### Patches
We have patched the issue in GitHub commit [6fc9141f42f6a72180ecd24021c3e6b36165fe0d](https://github.com/tensorflow/tensorflow/commit/6fc9141f42f6a72180ecd24021c3e6b36165fe0d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-qf5x-qgx7-437h
Summary: Moderate severity vulnerability that affects actionpack
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:54:11Z

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Vulnerability: GHSA-69q2-p9xp-739v
Summary: XML Injection in petl
Aliases: CVE-2020-29128
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-91
Published: 2021-04-20T16:32:08Z

petl before 1.68, in some configurations, allows resolution of entities in an XML document.
Vulnerability: GHSA-6xj3-fhrf-rjgc
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-1504
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2022-04-28T00:00:34Z

XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
Vulnerability: GHSA-9298-m7jf-55h2
Summary: Malicious Package in bitconid-rpc
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:42:08Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-cvx5-m8vg-vxgc
Summary: Arbitrary filesystem write access from velocity.
Aliases: CVE-2022-24897
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-04-28T21:16:40Z

### Impact

The velocity scripts is not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Now writing an attacking script in velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. 

### Patches
The problem has been patched on versions 12.6.7, 12.10.3 and 13.0RC1.

### Workarounds
There's no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

### References
https://jira.xwiki.org/browse/XWIKI-5168

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-pxqp-mv67-g528
Summary: Malicious Package in bqffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:38:34Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-32f7-cmr3-vpjv
Summary: Moderate severity vulnerability that affects aioxmpp
Severity: MODERATE
CVSS score: 0
Published: 2019-02-07T18:18:30Z

**Withdrawn:** Duplicate of GHSA-6m9g-jr8c-cqw3
Vulnerability: GHSA-7qcc-g2m9-8533
Summary: Null pointer deference in fltk
Aliases: CVE-2021-28307
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-08-25T20:53:53Z

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a non-raster image for a window icon.
Vulnerability: GHSA-9f46-5r25-5wfm
Summary: Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
Aliases: CVE-2021-32708
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-367
Published: 2021-06-29T03:13:28Z

### Impact

The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.

The conditions: 

- A user is allowed to supply the path or filename of an uploaded file.
- The supplied path or filename is not checked against unicode chars.
- The supplied pathname checked against an extension deny-list, not an allow-list.
- The supplied path or filename contains a unicode whitespace char in the extension.
- The uploaded file is stored in a directory that allows PHP code to be executed.

Given these conditions are met a user can upload and execute arbitrary code on the system under attack.

### Patches

The unicode whitespace removal has been replaced with a rejection (exception).

The library has been patched in:
- 1.x: https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32
- 2.x: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74

### Workarounds

For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.
Vulnerability: GHSA-wwvv-x5mq-h3jj
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev
Aliases: CVE-2021-3692
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-338, CWE-330
Published: 2021-09-01T18:35:26Z

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Vulnerability: GHSA-59j4-wjwp-mw9m
Summary: Sandbox Bypass in Apache Velocity Engine
Aliases: CVE-2020-13936
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2022-01-06T20:32:36Z

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Vulnerability: GHSA-5jg5-w395-9684
Summary: Directory Traversal in ltt
Aliases: CVE-2017-16212
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:39:59Z

Affected versions of `ltt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-76w9-p8mg-j927
Summary: Out-of-bounds Write in nix
Aliases: CVE-2021-45707
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2022-01-06T22:07:14Z

An issue was discovered in the nix crate before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2 for Rust. unistd::getgrouplist has an out-of-bounds write if a user is in more than 16 /etc/groups groups.
Vulnerability: GHSA-p99p-726h-c8v5
Summary: Moderate severity vulnerability that affects org.apache.juddi:juddi-client
Aliases: CVE-2018-1307
Severity: HIGH
CVSS score: 8.1
CWE: CWE-611
Published: 2018-10-19T16:42:15Z

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.
Vulnerability: GHSA-x5r6-x823-9848
Summary: Arbitrary Code Execution in json-ptr
Aliases: CVE-2020-7766
Severity: HIGH
CVSS score: 7.3
CWE: CWE-74, CWE-400
Published: 2021-05-10T19:15:43Z

npm `json-ptr` before 2.0.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
Vulnerability: GHSA-gh32-pc56-4c96
Summary: Information Exposure in jaegar
Aliases: CVE-2020-10750
Severity: LOW
CVSS score: 7.1
CWE: CWE-200, CWE-532
Published: 2021-05-18T18:35:02Z

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.
Vulnerability: GHSA-qg5x-66hp-cw5p
Summary: Uncontrolled Resource Consumption in Apache DolphinScheduler
Aliases: CVE-2022-25598
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-03-31T00:00:23Z

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
Vulnerability: GHSA-6cm4-gm85-972c
Summary: Command Injection in Cobbler
Aliases: CVE-2021-45082
Severity: HIGH
CVSS score: 7.8
CWE: CWE-77
Published: 2022-02-20T00:00:35Z

An issue was discovered in Cobbler through 3.3.0. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
Vulnerability: GHSA-fmx4-26r3-wxpf
Summary: Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption
Severity: HIGH
CVSS score: 8.8
CWE: CWE-190
Published: 2022-03-03T20:28:47Z

### Impact

CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/). An [integer overflow in `cmark-gfm`'s table row parsing](https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x) may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution.

If affected versions of CommonMarker are used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE).

### Patches

This vulnerability has been patched in the following CommonMarker release:

- v0.23.4

### Workarounds

The vulnerability exists in the table markdown extensions of `cmark-gfm`. Disabling any use of the table extension will prevent this vulnerability from being triggered.

### References

- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x

### Acknowledgements

We would like to thank Felix Wilhelm of Google's Project Zero for reporting this vulnerability

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [CommonMarker](http://github.com/gjtorikian/commonmarker)
Vulnerability: GHSA-75w6-p6mg-vh8j
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-0446
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Vulnerability: GHSA-2f88-5hg8-9x2x
Summary: Origin Validation Error in Apache Maven
Aliases: CVE-2021-26291
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-346
Published: 2021-06-16T17:32:49Z

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
Vulnerability: GHSA-h6ch-v84p-w6p9
Summary: Regular Expression Denial of Service (ReDoS)
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2019-06-13T18:58:54Z

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability: GHSA-hmg3-c7xj-6qwm
Summary: Heap buffer overflow in `SparseTensorToCSRSparseMatrix`
Aliases: CVE-2021-29545
Severity: LOW
CVSS score: 2.5
CWE: CWE-131
Published: 2021-05-21T14:23:25Z

### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in converting sparse tensors to CSR Sparse matrices:

```python
import tensorflow as tf
import numpy as np
from tensorflow.python.ops.linalg.sparse import sparse_csr_matrix_ops

indices_array = np.array([[0, 0]])
value_array = np.array([0.0], dtype=np.float32)
dense_shape = [0, 0]

st = tf.SparseTensor(indices_array, value_array, dense_shape)

values_tensor = sparse_csr_matrix_ops.sparse_tensor_to_csr_sparse_matrix(
       st.indices, st.values, st.dense_shape)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/800346f2c03a27e182dd4fba48295f65e7790739/tensorflow/core/kernels/sparse/kernels.cc#L66) does a double redirection to access an element of an array allocated on the heap:

```cc
csr_row_ptr(indices(i, 0) + 1) += 1;
```
                      
If the value at `indices(i, 0)` is such that `indices(i, 0) + 1` is outside the bounds of `csr_row_ptr`, this results in writing outside of bounds of heap allocated data.

### Patches
We have patched the issue in GitHub commit [1e922ccdf6bf46a3a52641f99fd47d54c1decd13](https://github.com/tensorflow/tensorflow/commit/1e922ccdf6bf46a3a52641f99fd47d54c1decd13).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-mhwp-qhpc-h3jm
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2014-3482
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Vulnerability: GHSA-43fp-vwwg-qgv6
Summary: Moderate severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17194
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-12-20T22:02:32Z

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-w3gh-g32m-cvhr
Summary: High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3
Aliases: CVE-2018-8038
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2018-10-18T16:56:47Z

Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.
Vulnerability: GHSA-fwr7-v2mv-hh25
Summary: Prototype Pollution in async
Aliases: CVE-2021-43138
Severity: HIGH
CVSS score: 7.8
CWE: CWE-1321
Published: 2022-04-07T00:00:17Z

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the `mapValues()` method.
Vulnerability: GHSA-c77r-6f64-478q
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-2582
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-201
Published: 2018-10-18T16:49:40Z

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
Vulnerability: GHSA-xv5h-v7jh-p2qh
Summary: Authentication bypass for specific endpoint
Aliases: CVE-2021-29442
Severity: HIGH
CVSS score: 0
CWE: CWE-306
Published: 2021-04-27T20:09:25Z

The [`ConfigOpsController`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java) lets the user perform management operations like querying the database or even wiping it out. While the [`/data/remove`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L133-L135) endpoint is properly protected with the `@Secured` annotation, the [`/derby`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L99-L100) endpoint is not protected and can be openly accessed by unauthenticated users. 

For example, the following request will list the tables of the database:
```
❯ curl -X GET 'http://console.nacos.io/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st'
{"code":200,"message":null,"data":[{"TABLENAME":"APP_CONFIGDATA_RELATION_PUBS"},{"TABLENAME":"APP_CONFIGDATA_RELATION_SUBS"},{"TABLENAME":"APP_LIST"},{"TABLENAME":"CONFIG_INFO"},{"TABLENAME":"CONFIG_INFO_AGGR"},{"TABLENAME":"CONFIG_INFO_BETA"},{"TABLENAME":"CONFIG_INFO_TAG"},{"TABLENAME":"CONFIG_TAGS_RELATION"},{"TABLENAME":"GROUP_CAPACITY"},{"TABLENAME":"HIS_CONFIG_INFO"},{"TABLENAME":"PERMISSIONS"},{"TABLENAME":"ROLES"},{"TABLENAME":"SYSALIASES"},{"TABLENAME":"SYSCHECKS"},{"TABLENAME":"SYSCOLPERMS"},{"TABLENAME":"SYSCOLUMNS"},{"TABLENAME":"SYSCONGLOMERATES"},{"TABLENAME":"SYSCONSTRAINTS"},{"TABLENAME":"SYSDEPENDS"},{"TABLENAME":"SYSDUMMY1"},{"TABLENAME":"SYSFILES"},{"TABLENAME":"SYSFOREIGNKEYS"},{"TABLENAME":"SYSKEYS"},{"TABLENAME":"SYSPERMS"},{"TABLENAME":"SYSROLES"},{"TABLENAME":"SYSROUTINEPERMS"},{"TABLENAME":"SYSSCHEMAS"},{"TABLENAME":"SYSSEQUENCES"},{"TABLENAME":"SYSSTATEMENTS"},{"TABLENAME":"SYSSTATISTICS"},{"TABLENAME":"SYSTABLEPERMS"},{"TABLENAME":"SYSTABLES"},{"TABLENAME":"SYSTRIGGERS"},{"TABLENAME":"SYSUSERS"},{"TABLENAME":"SYSVIEWS"},{"TABLENAME":"TENANT_CAPACITY"},{"TABLENAME":"TENANT_INFO"},{"TABLENAME":"USERS"}]}% 
```

These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
Vulnerability: GHSA-4487-x383-qpph
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1272
Severity: HIGH
CVSS score: 7.5
Published: 2018-10-17T20:27:47Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
Vulnerability: GHSA-4vfj-c2xf-8r48
Summary: Directory Traversal in looppake
Aliases: CVE-2017-16169
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:45:20Z

Affected versions of `looppake` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hjfx-8p6c-g7gx
Summary: Insufficient Verification of Data Authenticity in Pillow
Aliases: CVE-2021-28678
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-345
Published: 2021-06-08T18:49:20Z

An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.
Vulnerability: GHSA-f7vx-j8mp-3h2x
Summary: Insufficient Verification of Data Authenticity in Eclipse Theia
Aliases: CVE-2019-17636
Severity: HIGH
CVSS score: 8.1
CWE: CWE-345
Published: 2021-04-13T15:18:01Z

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the hosts filesystem, given their path, without restrictions on the requesters origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.
Vulnerability: GHSA-47wv-vhj2-g66m
Summary: Use of insecure temporary file in Horovod
Aliases: CVE-2022-0315
Severity: HIGH
CVSS score: 8.2
CWE: CWE-668, CWE-377
Published: 2022-03-29T19:18:32Z

### Impact
The insecure `tempfile.mktemp()` is used when Horovod is run in an LSF job with `jsrun`. In that situation, a jsrun rank file is created with `mktemp`, which could be hijacked by another process to read or manipulate the content.

This issue does not impact the use of MPI, Gloo, Spark or Ray.

### Patches
The problem has been fixed in [b96ecae4](https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41).

### Workarounds
The rank file is not created when `binding_args` are provided in the `Settings` instance.

### References
Please see https://github.com/horovod/horovod/pull/3358 for details.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/horovod/horovod](https://github.com/horovod/horovod/issues/new/choose)
Vulnerability: GHSA-jgwr-3qm3-26f3
Summary: Potential remote code execution in Apache Tomcat
Aliases: CVE-2021-25329
Severity: CRITICAL
CVSS score: 7
CWE: CWE-502
Published: 2021-03-19T20:11:13Z

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Vulnerability: GHSA-8cxv-76p7-jxwr
Summary: Null-dereference in Tensorflow
Aliases: CVE-2022-23577
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-476
Published: 2022-02-10T00:32:29Z

### Impact
The [implementation of `GetInitOp`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61) is vulnerable to a crash caused by dereferencing a null pointer:

```cc
const auto& init_op_sig_it =
    meta_graph_def.signature_def().find(kSavedModelInitOpSignatureKey);
if (init_op_sig_it != sig_def_map.end()) {
  *init_op_name = init_op_sig_it->second.outputs()
                      .find(kSavedModelInitOpSignatureKey)
                      ->second.name();
  return Status::OK();
}
```

Here, we have a nested map and we assume that if the first `.find` succeeds then so would be the search in the internal map. However, the maps are built based on the `SavedModel` protobuf format and a malicious user can alter that on disk before loading to cause the second `.find` to return `nullptr`.
### Patches
We have patched the issue in GitHub commit [4f38b1ac8e42727e18a2f0bde06d3bee8e77b250](https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-h8w4-qv99-f7vj
Summary: High severity vulnerability that affects org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2018-15758
Severity: HIGH
CVSS score: 9.6
Published: 2018-10-19T22:00:28Z

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability does not expose applications that: Act in the role of an Authorization Server and use the default Approval Endpoint, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Vulnerability: GHSA-2hpg-vwqj-6h6w
Summary: Authentication bypass in Apache Kylin
Aliases: CVE-2020-13937
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-922
Published: 2022-02-10T20:25:56Z

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.
Vulnerability: GHSA-fjfg-q662-gm6j
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-5379
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2017-10-24T18:33:38Z

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Vulnerability: GHSA-cfhh-xgwq-5r67
Summary: Sudden swap of user auth tokens in Volto
Aliases: CVE-2022-24740
Severity: MODERATE
CVSS score: 5
CWE: CWE-287
Published: 2022-03-14T22:15:19Z

### Impact
Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account and privileges. A proven exploit for this vulnerability does not exist, since the exact requisites for it to happen have not been fully clarified, and the attempts to reproduce it under testing conditions have been unsuccessful, but it still can happen randomly and unintentionally in the wild. 

### Patches
The patch and fix is present in Volto 15.0.0-alpha.0 (or later). See PR: https://github.com/plone/volto/pull/3051.
We recommend upgrading to the final release of Volto 15 as soon as possible if running an affected version.
See the upgrade guide https://6-dev-docs.plone.org/volto/upgrade-guide/index.html#upgrading-to-volto-15-x-x

### Workarounds
It is possible to create a fix by manually upgrading the react-cookie package to 4.1.1 and then overriding all Volto components that use this library as in https://github.com/plone/volto/pull/3051. As this is substantial work, an update to the Volto 15 is recommended. The upgrade steps for going from Volto 14 to Volto 15 are quite easy and do not involve any complexity. Please take a look at the upgrade guide: https://6-dev-docs.plone.org/volto/upgrade-guide/index.html#upgrading-to-volto-15-x-x


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [volto](https://github.com/plone/volto/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-fvrf-9428-527m
Summary: Backport for CVE-2021-21024 Blind SQLi from Magento 2
Aliases: CVE-2021-21427
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-89
Published: 2021-04-22T16:11:01Z

### Impact
This vulnerability allows an administrator unauthorized access to restricted resources. 

We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. 


### Patches
_Has the problem been patched? What versions should users upgrade to?_
> v20.0.9 v19.4.13
Vulnerability: GHSA-3pg8-c473-w6rr
Summary: Stored Cross-site Scripting in showdoc
Aliases: CVE-2022-0967
Severity: MODERATE
CVSS score: 6.9
CWE: CWE-79
Published: 2022-03-16T00:00:46Z

ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.
Vulnerability: GHSA-w7jx-j77m-wp65
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-01-06T19:27:54Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Manually sanitize `iframe`, `object` and `embed` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter).
- Disable `iframe`, `object`, and `embed` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.

#### Example: Sanitizing using a node filter
```js
editor.parser.addNodeFilter('iframe,object,embed', function(nodes) {
  nodes.forEach(function(node) {
    if (node.attributes) {
      node.attributes.forEach(function(attr) {
        var name = attr.name;
        var value = attr.value;
        // Sanitize the attribute value here or remove it entirely
        var sanitizedValue = ...;
        node.attr(name, santizedValue);
      });
    }
  });
});
```

#### Example: Using invalid_elements
```js
invalid_elements: 'iframe,object,embed'
```

### Acknowledgements
Tiny Technologies would like to thank Aaron Bishop at SecurityMetrics for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-rrqm-p222-8ph2
Summary: Prototype Pollution in Dynamoose
Aliases: CVE-2021-21304
Severity: MODERATE
CVSS score: 7.2
CWE: CWE-1321, CWE-915
Published: 2021-02-08T17:44:01Z

### Impact

In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method [`lib/utils/object/set.ts`](https://github.com/dynamoose/dynamoose/blob/master/lib/utils/object/set.ts). This method is used throughout the codebase for various operations throughout Dynamoose.

We have not seen any evidence of this vulnerability being exploited.

We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.

### Patches

v2.7.0 includes a patch for this vulnerability.

### Workarounds

We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.

### References

- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e

### For more information

If you have any questions or comments about this advisory:

* [Contact me](https://charlie.fish/contact)
* [Read our Security Policy](https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md)

### Credit

- GitHub CodeQL Code Scanning
Vulnerability: GHSA-vv7g-pjw9-4qj9
Summary: Malicious Package in scrytsy
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:03:56Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rmmc-8cqj-hfp3
Summary: Authentication Bypass in otpauth
Severity: HIGH
CVSS score: 0
CWE: CWE-287
Published: 2020-09-03T18:24:43Z

Versions of `otpauth` prior to 3.2.8 are vulnerable to Authentication Bypass. The package's `totp.validate()` function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.


## Recommendation

Upgrade to version 3.2.8 or later.
Vulnerability: GHSA-v2f3-f8x4-m3w8
Summary: Cross Site Scripting in LavaLite CMS
Aliases: CVE-2020-23234
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-08-09T20:38:54Z

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
Vulnerability: GHSA-w7fj-336r-vw49
Summary: Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend
Aliases: CVE-2021-43776
Severity: HIGH
CVSS score: 7.4
CWE: CWE-79
Published: 2021-12-01T18:29:21Z

### Impact
This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities.

### Patches
This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-rh89-x75f-rh3c
Summary: Exposure of uninitialized memory in memoffset
Aliases: CVE-2019-15553
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2021-08-25T20:44:00Z

An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.
Vulnerability: GHSA-2969-8hh9-57jc
Summary: Allocation of Resources Without Limits or Throttling in ckb
Aliases: CVE-2021-45699
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2022-01-06T22:09:49Z

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
Vulnerability: GHSA-6w39-qhmq-g8cp
Summary: CSRF vulnerability in Jenkins Publish Over FTP Plugin
Aliases: CVE-2022-29050
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-04-13T00:00:16Z

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials.
Vulnerability: GHSA-vx6v-xg64-pmr8
Summary: Cross-site Scripting in django-helpdesk
Aliases: CVE-2021-3945
Severity: HIGH
CVSS score: 8.8
CWE: CWE-79
Published: 2021-11-15T23:12:41Z

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-65fg-84f6-3jq3
Summary: SQL Injection in Log4j 1.2.x
Aliases: CVE-2022-23305
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-01-21T23:26:47Z

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.