TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-w65j-g6c7-g3m4
Summary: Multiple memory safety issues in actix-web
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T20:42:50Z

Affected versions contain multiple memory safety issues, such as:

 - Unsoundly coercing immutable references to mutable references
 - Unsoundly extending lifetimes of strings
 - Adding the `Send` marker trait to objects that cannot be safely sent between threads

This may result in a variety of memory corruption scenarios, most likely use-after-free.
 
A signficant refactoring effort has been conducted to resolve these issues.
Vulnerability: GHSA-hj48-42vr-x3v9
Summary: Regular Expression Denial of Service in path-parse
Aliases: CVE-2021-23343
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-08-10T15:33:47Z

Affected versions of npm package `path-parse` are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Vulnerability: GHSA-7xcv-wvr7-4h6p
Summary: Malicious npm package: an0n-chat-lib
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2021-01-29T18:12:19Z

The npm `an0n-chat-lib` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-q485-j897-qc27
Summary: Moderate severity vulnerability that affects com.mchange:c3p0
Aliases: CVE-2018-20433
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2019-01-07T19:14:34Z

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
Vulnerability: GHSA-h26f-j4mv-84g7
Summary: Malicious Package in asycn
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:39:43Z

All versions of `asycn` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-v4qh-6367-4cx2
Summary: Server-Side Request Forgery (SSRF) in Apache Olingo
Aliases: CVE-2020-1925
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2020-02-04T22:38:38Z

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.
Vulnerability: GHSA-69wp-xwm7-69wm
Summary: Exposure of Resource to Wrong Sphere in ThinkPHP Framework
Aliases: CVE-2022-25481
Severity: HIGH
CVSS score: 7.5
CWE: CWE-668
Published: 2022-03-22T00:00:43Z

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php.
Vulnerability: GHSA-4mp3-385r-v63f
Summary: Denial of service attack due to invalid JSON
Aliases: CVE-2020-26890
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2020-11-24T22:58:58Z

### Impact
A denial of service attack against Matrix clients can be exploited by sending an event including invalid JSON data to Synapse. Synapse would relay the data to clients which could crash or hang. Impact is long-lasting if the event is made part of the room state.

### Patches
At a minimum #8106 and #8291 must be applied. #7372 and #8124 include additional checks.

### Workarounds
There are no known workarounds.

### Upgrading notes
If an invalid event is accepted by an earlier Synapse it can become part of the room state and will not be fixed by upgrading Synapse. Redacting the invalid event should avoid clients receiving the invalid event.
Vulnerability: GHSA-7jgj-8wvc-jh57
Summary: .NET Core Information Disclosure
Aliases: CVE-2018-8292
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-04-21T19:16:06Z

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
Vulnerability: GHSA-fx46-whrj-73v5
Summary: Bypassing Sanitization using DOM clobbering in html-janitor
Aliases: CVE-2017-0928
Severity: HIGH
CVSS score: 0
CWE: CWE-642, CWE-547
Published: 2018-07-24T20:06:17Z

All versions of `html-janitor` are vulnerable to cross-site scripting (XSS).

Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous (XSS) in case user-controlled input is passed to the clean function."


## Recommendation

Upgrade to version 2.0.4 or later.
Vulnerability: GHSA-h5q8-5697-9p9h
Summary: Cross-Site Request Forgery in express-cart
Aliases: CVE-2020-22403
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-08-30T17:22:15Z

The express-cart package through 1.1.10 for Node.js allows CSRF.
Vulnerability: GHSA-f6mq-5m25-4r72
Summary: Improper Validation of Specified Type of Input
Aliases: CVE-2021-20329
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-20, CWE-1287
Published: 2021-06-15T16:08:16Z

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers up to (and including) 1.5.0.
Vulnerability: GHSA-2r5h-gh4x-8hp9
Summary: Resources Downloaded over Insecure Protocol in igniteui
Aliases: CVE-2016-10552
Severity: LOW
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:40:14Z

Affected versions of `igniteui` download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection.




## Recommendation

The `igniteui` package has been deprecated by the package author and now exists under [`ignite-ui`](https://preview.npmjs.com/package/ignite-ui), which should be used in place of this package.
Vulnerability: GHSA-6v39-p2xq-g5c3
Summary: Missing authentication in ShenYu
Aliases: CVE-2022-23944
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-862, CWE-306
Published: 2022-01-28T22:13:44Z

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-p7qp-3fh7-pv4p
Summary: Malicious Package in buffur-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:24:04Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-728c-42pc-fwxg
Summary: Unrestricted Upload of File with Dangerous Type in Crater
Aliases: CVE-2022-0242
Severity: HIGH
CVSS score: 7.2
CWE: CWE-434
Published: 2022-01-21T23:54:50Z

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
Vulnerability: GHSA-2xw5-3767-qxvm
Summary: Malicious Package in ng-ui-library
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:21:20Z

Version 1.0.987 of `ng-ui-library` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qp49-3pvw-x4m5
Summary: sinatra does not validate expanded path matches
Aliases: CVE-2022-29970
Severity: MODERATE
CVSS score: 0
CWE: CWE-426
Published: 2022-05-03T00:00:43Z

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Vulnerability: GHSA-8cpw-73f2-w58m
Summary: Cross-Site Scripting in selectize-plugin-a11y
Aliases: CVE-2019-15482
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-27T17:38:33Z

Versions of `selectize-plugin-a11y ` prior to 1.1.0 are vulnerable to Cross-Site Scripting. The `accessibility.liveRegion.speak` function does not sanitize the `msg` variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.1.0 or later.
Vulnerability: GHSA-57gr-jvqr-3hwm
Summary: Incorrect access control in typo3_forum
Aliases: CVE-2020-15513
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-863
Published: 2020-07-29T18:07:38Z

The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.
Vulnerability: GHSA-w973-2qcc-p78x
Summary: User Impersonation in converse.js
Aliases: CVE-2017-5858
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-346, CWE-20
Published: 2020-09-11T21:19:09Z

Versions of `converse.js` prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of [XEP-0280: Message Carbons](https://xmpp.org/extensions/xep-0280.html) that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks.


## Recommendation

If you're using `converse.js` 1.x, upgrade to 1.0.7 or later.
If you're using `converse.js` 2.x, upgrade to 2.0.5 or later.
Vulnerability: GHSA-hxmg-hm46-cf62
Summary: Remote code execution in mongo-express
Aliases: CVE-2020-24391
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2021-04-13T15:41:01Z

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
Vulnerability: GHSA-rv62-4pmj-xw6h
Summary: Moderate severity vulnerability that affects jupyterhub and notebook
Aliases: CVE-2019-10255
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2019-04-02T15:46:54Z

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Vulnerability: GHSA-w4wq-rvmq-77x7
Summary: Cross-site scripting in anchorme
Aliases: CVE-2021-23411
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-07-26T21:23:58Z

All versions of package anchorme are vulnerable to Cross-site Scripting (XSS) via the main functionality.
Vulnerability: GHSA-j5mg-fpq8-vvxv
Summary: Directory Traversal in commentapp.stetsonwood
Aliases: CVE-2017-16143
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:48:14Z

Affected versions of `commentapp.stetsonwood` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hwhh-2fwm-cfgw
Summary: Doorkeeper is vulnerable to stored XSS and code execution
Aliases: CVE-2018-1000088
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-03-13T20:44:48Z

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
Vulnerability: GHSA-w3hj-wr2q-x83g
Summary: Discovery uses the same AES/GCM Nonce throughout the session
Severity: LOW
CVSS score: 0
CWE: CWE-323
Published: 2021-04-06T17:22:17Z

Discovery uses the same AES/GCM Nonce throughout the session though it should be generated on per message basis which can lead to the leaking of the session key.  As the actual ENR record is signed with a different key it is not possible for an attacker to alter the ENR record. Note that the node private key is not compromised, only the session key generated to communicate with an individual peer.

From [discovery spec](https://github.com/ethereum/devp2p/blob/f97b8a5b8e9589d3355ebbd9d4a58d5d1644bdf7/discv5/discv5-theory.md#session-cache):
> The number of messages which can be encrypted with a certain session key is limited because encryption of each message requires a unique nonce for AES-GCM. In addition to the keys, the session cache must also keep track of the count of outgoing messages to ensure the uniqueness of nonce values. Since the wire protocol uses 96 bit AES-GCM nonces, it is strongly recommended to generate them by encoding the current outgoing message count into the first 32 bits of the nonce and filling the remaining 64 bits with random data generated by a cryptographically secure random number generator.
Vulnerability: GHSA-gf2c-93hm-r9j5
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3963
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-11-23T18:16:43Z

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates.
Vulnerability: GHSA-6gc6-m364-85ww
Summary: Log injection in SimpleSAMLphp
Aliases: CVE-2020-5225
Severity: LOW
CVSS score: 4.4
CWE: CWE-532
Published: 2020-01-24T21:26:13Z

### Background

SimpleSAMLphp has a logging functionality that allows system administrators to keep track of the activity, errors, and statistics. Additionally, it allows users to report errors, shall they happen. An error report contains a report identifier, which is logged once submitted.

### Description

The `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, didn't properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID.

When configured to use the `file` logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the `reportID` parameter received in a request sent to `www/errorreport.php` was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.

### Affected versions

SimpleSAMLphp versions up to **1.18.3**.

### Impact

An attacker may use this issue to inject logs messages into a SimpleSAMLphp log file, trying to trick or confuse system administrators. However, the attack surface is considered small, as the attack will only work with the `file` logging handler, which opens the log file in _append-only_ mode. This means an attacker cannot edit or remove existing log messages, and even if non-ascii characters are written to the log, the file will always be readable with a simple text editor.

### Resolution

Upgrade the SimpleSAMLphp installation to version **1.18.4**.

### Credit

This vulnerability was discovered and reported by Frederic Vleminckx on January 23, 2020.
Vulnerability: GHSA-h76r-vgf3-j6w5
Summary: Auth bypass and account takeover in October CMS
Aliases: CVE-2021-29487
Severity: HIGH
CVSS score: 7.4
CWE: CWE-287
Published: 2021-08-30T16:13:50Z

### Impact

An attacker can exploit this vulnerability to bypass authentication using a specially crafted persist cookie.

- To exploit this vulnerability, an attacker must obtain a Laravel’s secret key for cookie encryption and signing.
- Due to the logic of how this mechanism works, a targeted user account must be logged in while
the attacker is exploiting the vulnerability.
- Authorization via persist cookie not shown in access logs.

### Patches

- Issue has been patched in Build 472 and v1.1.5
- [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648)

### Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[**Update 2022-01-20**] [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648) can be found here.

### Recommendations

We recommend the following steps to make sure your server stays secure:

- Keep server OS and system software up to date.
- Keep October CMS software up to date.
- Use a multi-factor authentication plugin.
- Change the [default backend URL](https://github.com/octobercms/october/blob/1.1/config/cms.php#L39) or block public access to the backend area.
- Include the [Roave/SecurityAdvisories](https://github.com/Roave/SecurityAdvisories) Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

### References

Bugs found as part of Solar Security CMS Research. Credits to:
• Andrey Basarygin
• Andrey Guzei
• Mikhail Khramenkov
• Alexander Sidukov
• Maxim Teplykh

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-jj53-8fmw-f2w2
Summary: Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Aliases: CVE-2021-39163
Severity: LOW
CVSS score: 3.1
CWE: CWE-200
Published: 2021-09-01T18:25:44Z

### Impact
Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where:
- the vulnerable homeserver is in the room; and
- untrusted users are permitted to create groups (communities).

By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting `enable_group_creation` has been set to `true` are impacted.

### Patches
Server administrators should upgrade to 1.41.1 or higher.

### Workarounds
Server administrators can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value) to prevent creation of groups by non-administrators.

Administrators that are using a reverse proxy could, with partial loss of group functionality, block the following endpoints:
* `/_matrix/client/r0/groups/{group_id}/rooms`
* `/_matrix/client/unstable/groups/{group_id}/rooms`

### References
n/a

### For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Vulnerability: GHSA-xcrg-29h7-h4cj
Summary: XXE in PHPSpreadsheet due to encoding issue
Aliases: CVE-2018-19277
Severity: HIGH
CVSS score: 8.8
CWE: CWE-91
Published: 2019-11-20T01:38:52Z

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Vulnerability: GHSA-pffw-p2q5-w6vh
Summary: Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-builder and org.apache.jspwiki:jspwiki-war
Aliases: CVE-2019-0225
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-04-08T16:23:36Z

A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
Vulnerability: GHSA-gc58-v8h3-x2gr
Summary: Incorrect Default Permissions in Apache Tomcat
Aliases: CVE-2020-8022
Severity: HIGH
CVSS score: 7.8
CWE: CWE-276
Published: 2022-02-09T23:01:49Z

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
Vulnerability: GHSA-m6q2-9pfm-2wvr
Summary: Malicious Package in wallet-address-vaildator
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:02:49Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-x7cr-6qr6-2hh6
Summary: Missing input validation can lead to command execution in composer
Aliases: CVE-2022-24828
Severity: HIGH
CVSS score: 8.3
CWE: CWE-94, CWE-20
Published: 2022-04-22T20:15:38Z

The Composer method `VcsDriver::getFileContent()` with user-controlled `$file` or `$identifier` arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.

This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json `readme` field as a vector for injecting parameters into the `$file` argument for the Mercurial driver or via the `$identifier` argument for the Git and Mercurial drivers.

Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.

To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.
Vulnerability: GHSA-9rjp-r58j-fxgq
Summary: Path traversal in elFinder.NetCore
Aliases: CVE-2021-23428
Severity: HIGH
CVSS score: 8.6
CWE: CWE-20, CWE-22
Published: 2021-09-02T22:05:26Z

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
Vulnerability: GHSA-95xm-g58g-3p88
Summary: Integer division by 0 in sparse reshaping
Aliases: CVE-2021-37640
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:44:02Z

### Impact
The implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception:

```python
import tensorflow as tf

tf.raw_ops.SparseReshape(
  input_indices = np.ones((1,3)),
  input_shape = np.array([1,1,0]),
  new_shape = np.array([1,0]))
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements.

The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0.
  
### Patches
We have patched the issue in GitHub commit [4923de56ec94fff7770df259ab7f2288a74feb41](https://github.com/tensorflow/tensorflow/commit/4923de56ec94fff7770df259ab7f2288a74feb41).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-ppxc-pmx9-qjv9
Summary: Out-of-bounds write
Aliases: CVE-2019-1195
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:59Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1140, CVE-2019-1141, CVE-2019-1196, CVE-2019-1197.
Vulnerability: GHSA-xp82-jmw8-mjxp
Summary: Unrestricted Upload of File with Dangerous Type in ShowDoc
Aliases: CVE-2022-1034
Severity: HIGH
CVSS score: 7.2
CWE: CWE-434
Published: 2022-03-23T00:00:23Z

There is a Unrestricted Upload of File vulnerability in ShowDoc prior to version 2.10.4.
Vulnerability: GHSA-jrg3-qq99-35g7
Summary: Deserialization of Untrusted Data in Jodd
Aliases: CVE-2018-21234
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-02-10T23:03:26Z

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
Vulnerability: GHSA-977j-xj7q-2jr9
Summary: Segmentation faultin TensorFlow when converting a Python string to `tf.float16`
Aliases: CVE-2020-5215
Severity: HIGH
CVSS score: 5
CWE: CWE-754
Published: 2020-01-28T21:32:29Z

### Impact

Converting a string (from Python) to a `tf.float16` value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode.

This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a `tf.float16` value.

Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar `tf.float16` value with a scalar string will trigger this issue due to automatic conversions.

This can be easily reproduced by `tf.constant("hello", tf.float16)`, if eager execution is enabled.

### Patches
We have patched the vulnerability in GitHub commit [5ac1b9](https://github.com/tensorflow/tensorflow/commit/5ac1b9e24ff6afc465756edf845d2e9660bd34bf).

We are additionally releasing TensorFlow 1.15.1 and 2.0.1 with this vulnerability patched.

TensorFlow 2.1.0 was released after we fixed the issue, thus it is not affected.

We encourage users to switch to TensorFlow 1.15.1, 2.0.1 or 2.1.0.

### For more information

Please consult [`SECURITY.md`](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-q22g-8fr4-qpj4
Summary: Regular Expression Denial of Service in remarkable
Aliases: CVE-2019-12041
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2019-06-06T15:32:15Z

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
Vulnerability: GHSA-5gjg-jgh4-gppm
Summary: Websocket requests did not call AuthenticateMethod
Severity: MODERATE
CVSS score: 0
CWE: CWE-304
Published: 2021-06-23T17:26:30Z

### Impact

Depending on implementation, a denial-of-service or privilege escalation vulnerability may occur in software that uses the `github.com/ecnepsnai/web` package with Web Sockets that have an AuthenticateMethod.

The `AuthenticateMethod` is not called, and `UserData` will be nil in request methods. Attempts to read the `UserData` may result in a panic.

This issue only affects web sockets where an `AuthenticateMethod` is supplied to the handle options. Users who do not use web sockets, or users who do not require authentication are not at risk.

#### Example

In the example below, one would expect that the `AuthenticateMethod` function would be called for each request to `/example`

```go
handleOptions := web.HandleOptions{
	AuthenticateMethod: func(request *http.Request) interface{} {
		// Assume there is logic here to check for an active sessions, look at cookies or headers, etc...
		var session Session{} // Example

		return session
	},
}

server.Socket("/example", handle, handleOptions)
```

However, the method is not called, and therefor the `UserData` parameter of the request object in the handle will be nil, when it would have been expected to be the `session` object we returned.

### Patches

Release v1.5.2 fixes this vulnerability. The authenticate method is now called for websocket requests.

All users of the web package should update to v1.5.2 or later.

### Workarounds

You may work around this issue by making the authenticate method a named function, then calling that function at the start of the handle method for the websocket. Reject connections when the return value of the method is nil.
Vulnerability: GHSA-pmg9-p9r2-6q87
Summary: ReDoS via long UserAgent header in ua-parser
Aliases: CVE-2017-16086
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T19:46:37Z

Affected versions of `ua-parser` are vulnerable to regular expression denial of service when given a specially crafted `User-Agent` header.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different, functionally equivalent package such as [useragent](https://www.npmjs.com/package/useragent).
Vulnerability: GHSA-r478-c2pc-m7gx
Summary: DNS reply verification issue in dnslinb
Aliases: CVE-2022-22846
Severity: HIGH
CVSS score: 7.5
Published: 2022-01-12T20:07:10Z

The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.
Vulnerability: GHSA-g5m5-v5cp-5p7m
Summary: Directory Traversal in wintiwebdev
Aliases: CVE-2017-16181
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:50:16Z

Affected versions of `wintiwebdev` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cf2x-rqc8-grfq
Summary: Regular expression deinal of service in express-validators
Aliases: CVE-2020-7767
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-05-10T19:16:27Z

All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.
Vulnerability: GHSA-v6fx-752r-ccp2
Summary: CSRF on PgHero gem
Aliases: CVE-2020-16253
Severity: HIGH
CVSS score: 8.1
CWE: CWE-352
Published: 2020-08-05T14:53:43Z

The PgHero gem through 2.6.0 for Ruby allows CSRF.
Vulnerability: GHSA-j27j-4w6m-8fc4
Summary: Path Traversal in statics-server
Aliases: CVE-2019-15596
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2020-03-31T17:02:12Z

All versions of `statics-server` are vulnerable to Path Traversal. The package fails to limit access to files outside of the served folder through symlinks.


## Recommendation

No fix is currently available. Do not use `statics-server` in production or consider using an alternative module until a fix is made available.
Vulnerability: GHSA-gx96-vgf7-hwfg
Summary: In Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computation
Aliases: CVE-2018-11797
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400
Published: 2018-10-17T18:22:29Z

In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Vulnerability: GHSA-7grw-6pjh-jpc9
Summary: Infinite Loop in Apache PDFBox
Aliases: CVE-2021-31812
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835, CWE-834
Published: 2021-06-15T15:54:29Z

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Vulnerability: GHSA-gcfc-mgg3-8j2c
Summary: Malicious Package in sdfjghlkfjdshlkjdhsfg
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:11:29Z

All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version.


## Recommendation

Remove the package from your environment and ensure all packages owned were not impacted.
Vulnerability: GHSA-4449-hg37-77v8
Summary: Command injection in total.js
Aliases: CVE-2020-28494
Severity: HIGH
CVSS score: 8.6
CWE: CWE-78
Published: 2021-02-05T20:43:27Z

There is a command injection vulnerability that affects the package total.js before version 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Vulnerability: GHSA-qffw-8wg7-h665
Summary: Command injection in git-interface
Aliases: CVE-2022-1440
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-04-23T00:03:01Z

A command injection vulnerability exists in git-interface in the GitHub repository yarkeev/git-interface prior to 2.1.2. If both the git remote and destination directory are provided by user input, then the use of an `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
Vulnerability: GHSA-686g-3xr3-x4x6
Summary: Information Exposure on Case Insensitive File Systems in serve
Aliases: CVE-2018-3809
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2018-07-18T18:33:15Z

Versions of `serve` before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems.



## Recommendation

Update to version 7.0.0 or later.
Vulnerability: GHSA-h3rx-g5c9-8q4x
Summary: Prototype Pollution in bmoor
Aliases: CVE-2020-7736
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2021-05-10T18:37:26Z

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-fvm3-cfvj-gxqq
Summary: High severity vulnerability that affects commons-fileupload:commons-fileupload
Aliases: CVE-2016-3092
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-12-21T17:47:47Z

The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
Vulnerability: GHSA-wfj5-2mqr-7jvv
Summary: Expression Language Injection in Netflix Conductor
Aliases: CVE-2020-9296
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-917
Published: 2022-02-10T23:06:57Z

Netflix Conductor uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.
Vulnerability: GHSA-cq6h-w3mc-57f4
Summary: Information exposure via query strings in URL
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2020-12-21T18:01:16Z

### Impact

Information exposure via query strings in URL

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

### Credits
We would like to thank <a rel="noopener" href="https://www.vater-it.de/">Oliver Herrmann</a> for reporting this issue.
Vulnerability: GHSA-wxvm-fh75-mpgr
Summary: Critical severity vulnerability that affects dns-sync
Severity: CRITICAL
CVSS score: 0
Published: 2018-07-26T16:24:34Z

Withdrawn, accidental duplicate publish.

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
Vulnerability: GHSA-5hpj-m323-cphm
Summary: Double free in through
Aliases: CVE-2021-29940
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:54:12Z

An issue was discovered in the through crate through 2021-02-18 for Rust. There is a double free (in through and through_and) upon a panic of the map function.
Vulnerability: GHSA-8vp7-j5cj-vvm2
Summary: Ability to expose data in Sylius by using an unintended serialisation group
Aliases: CVE-2020-5220
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-444
Published: 2020-01-31T18:00:43Z

### Impact

ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API.

Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: `<1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2`.

### Patches

The patch is provided for ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

After it is applied, It allows to choose only the groups that are defined in `serialization_groups` or `allowed_serialization_groups` route definition. Any group not defined in those will not be used.

This behaviour might be a BC break for those using custom groups via the HTTP header, please adjust `allowed_serialization_groups` accordingly.

### Workarounds

Service `sylius.resource_controller.request_configuration_factory` can be overridden with an implementation copied from `\Sylius\Bundle\ResourceBundle\Controller\RequestConfigurationFactory` where the part that handles custom serialisation groups is deleted.
Vulnerability: GHSA-24m3-w8g9-jwpq
Summary: Information disclosure of source code in SimpleSAMLphp
Aliases: CVE-2020-5301
Severity: LOW
CVSS score: 3
CWE: CWE-200, CWE-178
Published: 2020-04-22T20:59:44Z

### Background

The module controller in `SimpleSAML\Module` that processes requests for pages
hosted by modules, has code to identify paths ending with `.php` and process
those as PHP code. If no other suitable way of handling the given path exists it
presents the file to the browser.

### Description

The check to identify paths ending with `.php` does not account for uppercase
letters. If someone requests a path ending with e.g. `.PHP` and the server is
serving the code from a case-insensitive file system, such as on Windows, the
processing of the PHP code does not occur, and the source code is instead
presented to the browser.

### Affected versions

SimpleSAMLphp versions **1.18.5 and older**.

### Impact

An attacker may use this issue to gain access to the source code in third-party
modules that is meant to be private, or even sensitive. However, the attack
surface is considered small, as the attack will only work when SimpleSAMLphp
serves such content from a file system that is not case-sensitive, such as on
Windows.

### Resolution

Upgrade the SimpleSAMLphp installation to version **1.18.6**.

### Credit

This vulnerability was discovered and reported by Sławek Naczyński.
Vulnerability: GHSA-grc3-8q8m-4j7c
Summary: Improper privilege handling in Apache Accumulo
Aliases: CVE-2020-17533
Severity: HIGH
CVSS score: 8.1
CWE: CWE-280, CWE-732
Published: 2022-02-09T22:37:59Z

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values of the 'canFlush' and 'canPerformSystemActions' security functions are not checked in some instances, therefore allowing an authenticated user with insufficient permissions to perform the following actions: flushing a table, shutting down Accumulo or an individual tablet server, and setting or removing system-wide Accumulo configuration properties.
Vulnerability: GHSA-cwqq-w8c3-r2jw
Summary: Uncontrolled Resource Consumption in MetadataExtractor
Aliases: CVE-2019-14262
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2019-08-23T00:04:56Z

MetadataExtractor 2.1.0 allows stack consumption.
Vulnerability: GHSA-xc47-3rch-cv57
Summary: Improper Access Control in snipe-it
Aliases: CVE-2022-0178
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-284
Published: 2022-01-26T20:24:23Z

Users with no system permissions are able to see and create personal access tokens
Vulnerability: GHSA-v2jv-33gh-xx29
Summary: Command Injection in ps-visitor
Aliases: CVE-2021-23374
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-05-07T16:06:23Z

This affects all versions up to and including version 0.0.2 of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-45hx-wfhj-473x
Summary: Arbitrary code execution in H2 Console
Aliases: CVE-2022-23221
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2022-01-21T23:07:39Z

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
Vulnerability: GHSA-83x4-9cwr-5487
Summary: Improper Authorization in Keycloak
Aliases: CVE-2021-4133
Severity: HIGH
CVSS score: 8.8
CWE: CWE-863
Published: 2022-01-06T18:32:58Z

A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
Vulnerability: GHSA-qvm7-23cj-437v
Summary: Remote Code Execution in Apache Dubbo
Aliases: CVE-2021-36161
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-134
Published: 2021-09-10T17:54:37Z

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
Vulnerability: GHSA-hgc3-hp6x-wpgx
Summary: Antilles Dependency Confusion Vulnerability
Aliases: CVE-2021-3840
Severity: HIGH
CVSS score: 8.8
CWE: CWE-427
Published: 2021-11-03T17:36:22Z

### Potential Impact: 
Remote code execution.

### Scope of Impact: 
Open-source project specific.

### Summary Description:
A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). 
MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi.
The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.

### Mitigation Strategy for Customers (what you should do to protect yourself):
Remove previous versions of Antilles as a precautionary measure and Update to version 1.0.1 or later.

### Acknowledgement:
The Antilles team thanks Kotko Vladyslav for reporting this issue.

### References:
https://github.com/lenovo/Antilles/commit/c7b9c5740908b343aceefe69733d9972e64df0b9
Vulnerability: GHSA-976r-qfjj-c24w
Summary: Command injection via Celery broker in Apache Airflow
Aliases: CVE-2020-11981
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-07-27T16:57:33Z

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Vulnerability: GHSA-qcj7-g2j5-g7r3
Summary: In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification
Aliases: CVE-2016-1000342
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2018-10-17T16:24:12Z

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.