TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-6qfg-8799-r575
Summary: Symlink Attack
Aliases: CVE-2019-11251
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-61, CWE-59
Published: 2021-05-18T15:30:07Z

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.
Vulnerability: GHSA-c2vr-2c89-ph88
Summary: Downloads Resources over HTTP in node-bsdiff-android
Aliases: CVE-2016-10641
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2018-09-18T13:49:54Z

Affected versions of `node-bsdiff-android` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m2q4-qghh-p9cq
Summary: Server-Side Request Forgery in yoast_seo
Aliases: CVE-2021-31779
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-918
Published: 2021-05-21T19:21:38Z

The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
Vulnerability: GHSA-qfcv-5whw-7pcw
Summary: Exposure of Sensitive Information to an Unauthorized Actor in AEgir
Aliases: CVE-2020-11059
Severity: CRITICAL
CVSS score: 9.6
CWE: CWE-200
Published: 2020-05-27T21:09:15Z

### Impact
`aegir publish` and `aegir build` may leak secrets from environmental variables in the browser bundle published to npm.

### Patches
The code has been patched, users should upgrade to >= 21.10.1

### Workarounds
Run `printenv` to check your environment variables and revoke any secrets.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [aegir](https://github.com/ipfs/aegir)
Vulnerability: GHSA-72fv-qgj6-2w2p
Summary: Cross-site Scripting in NodeBB
Aliases: CVE-2015-9286
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-05-01T18:37:08Z

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
Vulnerability: GHSA-f554-x222-wgf7
Summary: Command Injection in Xstream
Aliases: CVE-2013-7285
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2019-05-29T18:05:03Z

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Vulnerability: GHSA-rgcm-rpq9-9cgr
Summary: Missing Authentication for Critical Function in Saleor
Aliases: CVE-2020-7964
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-306
Published: 2021-07-28T17:57:09Z

An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
Vulnerability: GHSA-r74q-gxcg-73hx
Summary: High severity vulnerability that affects simple_form
Aliases: CVE-2019-16676
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2019-09-30T19:41:15Z

## Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

### Impact
For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

```erb
<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>
```

The string provided in the variable `@user_supplied_string` would be invoked as a method call inside the `@user` object (unless the string contains any of the following: `password`, `time_zone`, `country`, `email`, `phone` and `url`).

By manipulation that input, an attacker could do any of the following:

- Code execution (call actions like `#destroy`)
- Denial of Service (by executing a computation intensive method)
- Information Disclosure (check the presence of methods, leak user information)

### Patches
The problem was fixed in version `5.0`. Although it's a major version, there should be no issues with upgrading for `4.x`. The reason it was released in a major version is that the configuration `SimpleForm.file_methods` was deprecated in order to fix the problem.

### Workarounds
The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected.
A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the `as` option, like the following:
```erb
<%= form.input :avatar, as: :file %>
```

### References
[TDB]

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/plataformatec/simple_form](https://github.com/plataformatec/simple_form)
* Email us at [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)
Vulnerability: GHSA-6jf5-rmhv-38cw
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0639
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2019-04-09T19:44:03Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
Vulnerability: GHSA-mfwh-gqx8-c787
Summary: Allocation of Resources Without Limits or Throttling in Apache Tika
Aliases: CVE-2019-10088
Severity: HIGH
CVSS score: 8.8
CWE: CWE-770
Published: 2019-08-06T01:43:40Z

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
Vulnerability: GHSA-9cph-cqqh-36pw
Summary: Malicious Package in babel-loqder
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:29:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-53hp-jpwq-2jgq
Summary: Uncontrolled Resource Consumption in Apache Tomcat
Aliases: CVE-2020-11996
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-09T23:01:22Z

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
Vulnerability: GHSA-rch7-f4h5-x9rj
Summary: Identity Spoofing in libp2p-secio
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-290
Published: 2019-08-23T00:04:52Z

Affected versions of `libp2p-secio` does not correctly verify that the `PeerId` of `DstPeer` matches the `PeerId` discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability. 


## Recommendation

Update to version 0.9.0 or later.
Vulnerability: GHSA-mm62-wxc8-cf7m
Summary: Code Execution Through IIFE in serialize-to-js
Aliases: CVE-2017-5954
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-07-18T18:27:41Z

Affected versions of `serialize-to-js` may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE). 

## Proof of Concept
```
var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }"
var serialize = require('serialize-to-js');
serialize.deserialize(payload);
```


## Recommendation

Update to version 1.0.0, or later, and review [this disclaimer](https://www.npmjs.com/package/serialize-to-js#deserialize) from the author.
Vulnerability: GHSA-9r27-994c-4xch
Summary: discord-html not escaping HTML code blocks when lacking a language identifier
Severity: HIGH
CVSS score: 0
Published: 2020-02-24T17:34:02Z

### Impact
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

### Patches
This has been patched in version 2.3.1

### Workarounds
Escape the characters `&lt;&gt;&amp;` before sending plain code blocks to discord-markdown.

### References
https://github.com/brussell98/discord-markdown/issues/13
Vulnerability: GHSA-h7pc-85cg-wmch
Summary: Downloads Resources over HTTP in kindlegen
Aliases: CVE-2016-10575
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:35:10Z

Affected versions of `kindlegen` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `kindlegen`.


## Recommendation

Update to version 1.1.0 or greater.
Vulnerability: GHSA-w222-53c6-c86p
Summary: Remote Code Execution in electron
Aliases: CVE-2018-1000006
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2018-01-23T03:57:44Z

Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met:
1. The electron application is running on Windows.
2. The electron application registers as the default handler for a protocol, such as `nodeapp://`.

This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.

MacOS and Linux are not vulnerable.


## Recommendation

Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:


If for some reason you are unable to upgrade your Electron version, you can append `--` as the last argument when calling `app.setAsDefaultProtocolClient`, which prevents Chromium from parsing further options. The double dash `--` signifies the end of command options, after which only positional parameters are accepted.
```
app.setAsDefaultProtocolClient(protocol, process.execPath, [
  '--your-switches-here',
  '--'
])
```
Vulnerability: GHSA-cv9j-78f7-w6v9
Summary: Incorrect Authorization in TYPO3 extension
Aliases: CVE-2020-25025
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-863
Published: 2021-07-26T21:41:22Z

The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
Vulnerability: GHSA-9f5r-vqm5-m342
Summary: Use of Uninitialized Resource in ms3d
Aliases: CVE-2021-26952
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2021-08-25T20:53:16Z

An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read.
Vulnerability: GHSA-jp27-cwp2-5qqr
Summary: Hijacked Environment Variables in jquery.js
Aliases: CVE-2017-16045
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T20:54:24Z

The `jquery.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-hqqv-9x3v-mp7w
Summary: Privilege Escalation Flaw in Elasticsearch
Aliases: CVE-2020-7014
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-269, CWE-266
Published: 2021-03-18T19:27:20Z

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges.
Vulnerability: GHSA-582f-p4pg-xc74
Summary: Regular Expression Denial of Service in csv-parse
Aliases: CVE-2019-17592
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-400
Published: 2019-10-15T20:06:16Z

Versions of `csv-parse` prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The `__isInt()` function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the `cast` option.


## Recommendation

Upgrade to version 4.4.6 or later.
Vulnerability: GHSA-xh8g-j88w-6v59
Summary: Malicious Package in cionstring
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:42:16Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-x24j-87x9-jvv5
Summary: Improper Authorization in Publify
Aliases: CVE-2021-25973
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863, CWE-285
Published: 2021-11-03T17:34:22Z

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.
Vulnerability: GHSA-xmw9-q7x9-j5qc
Summary: Unbounded connection acceptance leads to file handle exhaustion
Aliases: CVE-2021-21293
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-02-02T21:42:49Z

### Impact

All servers running blaze-core <= 0.14.14, including blaze-http and http4s-blaze-server users, are affected.

Blaze, accepts connections unconditionally on a dedicated thread pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections.

The vast majority of affected users are using it as part of http4s-blaze-server <= 0.21.16.  http4s provides a mechanism for limiting open connections, but is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open.

### Patches

The issue is fixed in version 0.14.15 for `NIO1SocketServerGroup`.  A `maxConnections` parameter is added, with a default value of 512.  Concurrent connections beyond this limit are rejected.  To run unbounded, which is not recommended, set a negative number.

The `NIO2SocketServerGroup`  has no such setting and is now deprecated.

### Workarounds
* An Nginx side-car acting as a reverse proxy for the local http4s-blaze-server instance would be able to apply a connection limiting semantic before the sockets reach blaze-core. Nginx’s connection bounding is both asynchronous and properly respects backpressure.
* A similar sidecar strategy is viable for other non-HTTP services running on blaze-core.
* http4s-ember-server is an alternative to http4s-blaze-server, but does not yet have HTTP/2 or web socket support.  Its performance in terms of RPS is appreciably behind Blaze’s, and as the newest backend, has substantially less industrial uptake.
* http4s-jetty is an alternative to http4s-blaze-server, but does not yet have web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.
* http4s-tomcat is an alternative to http4s-blaze-server, but does not yet have HTTP/2 web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http4s/blaze](http://github.com/http4s/blaze)
* Contact us according to the [http4s security policy](https://github.com/http4s/http4s/security/policy)
Vulnerability: GHSA-22gh-3r9q-xf38
Summary: Lacking Protection against HTTP Request Smuggling in mitmproxy
Aliases: CVE-2021-39214
Severity: HIGH
CVSS score: 8.1
CWE: CWE-444
Published: 2021-09-20T19:53:30Z

### Impact

In mitmproxy 7.0.2 and below, a malicious client or server is able to perform [HTTP request smuggling](https://en.wikipedia.org/wiki/HTTP_request_smuggling) attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

Unless you use mitmproxy to protect an HTTP/1 service, no action is required.


### Patches

The vulnerability has been fixed in mitmproxy 7.0.3 and above.


### Acknowledgements

We thank João Sobral (@chinchila) for responsibly disclosing this vulnerability to the mitmproxy team.


### Timeline

- **2021-09-08**: Received initial report for mitmproxy <= 6.0.2.
- **2021-09-08**: Requested clarification if 7.x is affected.
- **2021-09-10**: Received additional details, 7.x situation still unclear.
- **2021-09-13**: Internally determined that 7.x is also affected.
- **2021-09-13**: Shared initial fix with researcher.
- **2021-09-14**: Received confirmation that fix is working, but H2.TE/H2.CL should also be looked at.
- **2021-09-14**: Shared revised fix that includes additional H2.TE mitigations.
- **2021-09-14**: Received confirmation that revised fix is working.
- **2021-09-16**: Completed internal patch review.
- **2021-09-16**: Published patch release and advisory.
Vulnerability: GHSA-jp6h-mxhx-pgqh
Summary: Shopware guest session is shared between customers
Aliases: CVE-2022-24745
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-384
Published: 2022-03-10T17:28:55Z

### Impact
Guest sessions are shared between customers when HTTP cache is enabled. Setups with Varnish are not affected by this issue

## Patches

We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds

### Security Plugin
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

### Disable HTTP Cache

Disabling HTTP Cache is also a valid workaround
Vulnerability: GHSA-vwpg-f6gw-rjvf
Summary: Incorrect Authorization in Spring Cloud Netflix Zuul
Aliases: CVE-2021-22113
Severity: MODERATE
CVSS score: 0
CWE: CWE-863
Published: 2021-05-10T15:18:50Z

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing.
Vulnerability: GHSA-xgxc-v2qg-chmh
Summary: Directory Traversal in Django
Aliases: CVE-2021-28658
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2021-04-08T18:11:48Z

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
Vulnerability: GHSA-34r7-q49f-h37c
Summary: Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Aliases: CVE-2015-8857
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1254
Published: 2017-10-24T18:33:36Z

Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.

## Recommendation

Upgrade UglifyJS to version >= 2.4.24.
Vulnerability: GHSA-3cpj-mj3q-82wr
Summary: Malicious Package in bs58chek
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:49:43Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-5635-9mvj-r6hp
Summary: Malicious Package in vue-backbone
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T02:34:39Z

Version 0.1.2 of `vue-backbone` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-h77f-xxx7-4858
Summary: User impersonation due to incorrect handling of the login JWT
Aliases: CVE-2021-39177
Severity: HIGH
CVSS score: 7.4
CWE: CWE-287
Published: 2021-09-07T23:04:04Z

### Impact
<!--_What kind of vulnerability is it? Who is impacted?_-->
This allows anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any Bedrock user. Unless credentials are saved in your configuration, online mode is not affected as users are still required to log in separately. If your credentials are saved, there is no risk of exposing your email or password.

### Patches
<!--_Has the problem been patched? What versions should users upgrade to?_-->
This was patched as part of https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6 and https://github.com/GeyserMC/Geyser/commit/ab2f5b326fe590e09167e8b45b4b165ac06ecd13. if your Geyser version is `1.4.2-SNAPSHOT` or later, the issue has been addressed on your build.

### Workarounds
<!--_Is there a way for users to fix or remediate the vulnerability without upgrading?_-->
Geyser strongly recommends updating to fix this issue. If this isn't possible:
- Use online mode and don't save credentials in your Geyser configuration
- Use an additional authentication method on the Java server

### References
<!--_Are there any links users can visit to find out more?_-->
This was disclosed to us by a staff member over at Hive; you can read their disclosure here: https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY

### For more information
If you have any questions or comments about this advisory:
* Come talk to us over on our [Discord](https://discord.gg/geysermc) server in the [#development](https://discord.com/channels/613163671870242838/613170125696270357) channel
Vulnerability: GHSA-793h-6f7r-6qvm
Summary: Authenticated users can read data from other sources than intended
Aliases: CVE-2021-26920
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863
Published: 2021-08-13T15:21:50Z

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
Vulnerability: GHSA-3wj8-vp9h-rm6m
Summary: Remote Code Execution (RCE)
Aliases: CVE-2021-23344
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-03-19T21:32:20Z

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
Vulnerability: GHSA-3fw4-4h3m-892h
Summary: OS Command Injection in serial-number
Aliases: CVE-2019-10804
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:22:19Z

serial-number through 1.3.0 allows execution of arbritary commands. The &quot;cmdPrefix&quot; argument in serialNumber function is used by the &quot;exec&quot; function without any validation.
Vulnerability: GHSA-x4qx-4fjv-hmw6
Summary: Integer overflow leading to crash in Tensorflow
Aliases: CVE-2022-21738
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-190
Published: 2022-02-09T23:45:09Z

### Impact 
The [implementation of `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/count_ops.cc#L168-L273) can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation:

```python
import tensorflow as tf
import numpy as np
    
tf.raw_ops.SparseCountSparseOutput(
  indices=[[1,1]],
  values=[2],
  dense_shape=[2 ** 31, 2 ** 32],
  weights=[1],
  binary_output=True,
  minlength=-1,
  maxlength=-1,
  name=None)
```

### Patches
We have patched the issue in GitHub commit [6f4d3e8139ec724dbbcb40505891c81dd1052c4a](https://github.com/tensorflow/tensorflow/commit/6f4d3e8139ec724dbbcb40505891c81dd1052c4a).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-99cv-8cvv-666c
Summary: High severity vulnerability that affects apache-airflow
Aliases: CVE-2018-20244
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-79
Published: 2019-03-06T17:35:58Z

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Vulnerability: GHSA-xhv5-w9c5-2r2w
Summary: Unbounded connection acceptance in http4s-blaze-server
Aliases: CVE-2021-21294
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-02-02T21:42:56Z

### Impact

blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections.

http4s provides a general `MaxActiveRequests` middleware mechanism for limiting open connections, but it is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open.

### Patches

In 0.21.18, 0.22.0-M3, and 1.0.0-M16, a new`maxConnections` property, with a default value of 1024, has been added to the `BlazeServerBuilder`.  Setting the value to a negative number restores unbounded behavior, but is strongly disrecommended.  

The NIO2 backend does not respect `maxConnections`.  Its use is now deprecated in http4s-0.21, and the option is removed altogether starting in http4s-0.22.

The connections are bounded in 0.21.17, 0.22.0-M2, and 1.0.0-M14, but the `maxConnections` parameter was passed incorrectly, making it impossible to change the Blaze default of 512. 

### Workarounds
* An Nginx side-car acting as a reverse proxy for the local http4s-blaze-server instance would be able to apply a connection limiting semantic before the sockets reach blaze-core. Nginx’s connection bounding is both asynchronous and properly respects backpressure.
* http4s-ember-server is an alternative to http4s-blaze-server, but does not yet have HTTP/2 or web socket support.  Its performance in terms of RPS is appreciably behind Blaze’s, and as the newest backend, has substantially less industrial uptake.
* http4s-jetty is an alternative to http4s-blaze-server, but does not yet have web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.
* http4s-tomcat is an alternative to http4s-blaze-server, but does not yet have HTTP/2 web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.

### References

See [the Blaze GHSA](https://github.com/http4s/blaze/security/advisories/GHSA-xmw9-q7x9-j5qc) for more on the underlying issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http4s/http4s](http://github.com/http4s/http4s)
* Contact us according to the [http4s security policy](https://github.com/http4s/http4s/security/policy)
Vulnerability: GHSA-mq76-m7gv-xhfm
Summary: Downloads Resources over HTTP in sauce-connect
Aliases: CVE-2016-10599
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:34:00Z

Affected versions of `sauce-connect` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `sauce-connect`.


## Recommendation

No patch is currently available for this vulnerability, and this package has not been updated since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-g4rf-pc26-6hmr
Summary: OMERO webclient does not validate URL redirects on login or switching group.
Aliases: CVE-2021-21377
Severity: MODERATE
CVSS score: 0
CWE: CWE-601
Published: 2021-03-23T15:26:49Z

### Background
OMERO.web supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the ``omero.web.redirect_allowed_hosts`` setting.

### Impact
OMERO.web before 5.9.0

### Patches
5.9.0

### Workarounds
No workaround

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [omero-web](https://github.com/ome/omero-web)
* Email us at [security](mailto:security@openmicroscopy.org.uk)
Vulnerability: GHSA-cr3q-pqgq-m8c2
Summary: Spoofing attack in swagger-ui
Aliases: CVE-2018-25031
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20
Published: 2022-03-12T00:00:36Z

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
Vulnerability: GHSA-8hrq-9wm7-v3jw
Summary: Malicious Package in btffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:39:41Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vh5w-fg69-rc8m
Summary: Improper Input Validation in Google Closure Library
Aliases: CVE-2020-8910
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2021-05-07T16:06:34Z

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation -- update your library to version v20200315.
Vulnerability: GHSA-3v3c-r5v2-68ph
Summary: High severity vulnerability that affects private_address_check
Aliases: CVE-2017-0909
Severity: HIGH
CVSS score: 0
CWE: CWE-184
Published: 2017-11-30T23:14:55Z

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
Vulnerability: GHSA-9frf-r7c7-j2vg
Summary: Out of bounds write in stackvector
Aliases: CVE-2021-29939
Severity: HIGH
CVSS score: 7.3
CWE: CWE-787
Published: 2021-08-25T20:54:14Z

An issue was discovered in the stackvector crate before 1.0.9 for Rust. There is an out-of-bounds write in StackVec::extend if size_hint provides certain anomalous data.
Vulnerability: GHSA-hph2-m3g5-xxv4
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39151
Severity: HIGH
CVSS score: 8.5
CWE: CWE-434, CWE-502
Published: 2021-08-25T14:47:09Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39151](https://x-stream.github.io/CVE-2021-39151.html).

### Credits
Smi1e of DBAPPSecurity WEBIN Lab found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-jj9h-mwhq-8vhm
Summary: Moderate severity vulnerability that affects org.apache.qpid:qpid-broker
Aliases: CVE-2016-3094
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-287, CWE-20
Published: 2018-10-16T19:50:13Z

PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
Vulnerability: GHSA-4rm3-4mq4-mfwr
Summary: Moderate severity vulnerability that affects org.hswebframework.web:hsweb-commons
Aliases: CVE-2018-20595
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2019-01-04T17:43:22Z

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.
Vulnerability: GHSA-4jhw-2p6j-5wmp
Summary: Open Redirection in Login Handling
Aliases: CVE-2021-21338
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-03-23T01:53:35Z


### Problem
It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability.

### Solution
Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-001](https://typo3.org/security/advisory/typo3-core-sa-2021-001)
Vulnerability: GHSA-5xjx-4xcm-hpcm
Summary: Prototype Pollution in ts-nodash
Aliases: CVE-2021-23403
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321, CWE-915
Published: 2021-12-10T18:53:42Z

`ts-nodash` before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
Vulnerability: GHSA-rf6r-2c4q-2vwg
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-10968
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2020-05-15T18:58:54Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
Vulnerability: GHSA-c6c4-jmqx-3r33
Summary: Open Redirect in xdLocalStorage
Aliases: CVE-2020-11611
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-12-09T19:30:14Z

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
Vulnerability: GHSA-mwp6-j9wf-968c
Summary: Critical severity vulnerability that affects generator-jhipster
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-338
Published: 2019-09-13T21:33:25Z

Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Generated applications must be manually patched, following instructions in the release notes: https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html
Vulnerability: GHSA-g7mw-5cq6-fv82
Summary: Cross-Site Scripting in wangeditor
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T21:20:40Z

All versions of `wangeditor` are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-c6rp-xvqv-mwmf
Summary: Cross-site Scripting in epubjs
Aliases: CVE-2021-33040
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2022-01-21T23:52:17Z

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
Vulnerability: GHSA-952m-m83c-3xm6
Summary: Open redirect in direct_mail
Aliases: CVE-2020-12699
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-05-24T16:58:37Z

The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
Vulnerability: GHSA-74xw-82v7-hmrm
Summary: Improper Input Validation in python-dbusmock
Aliases: CVE-2015-1326
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2019-04-23T16:04:36Z

python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
Vulnerability: GHSA-rwg6-3fmj-w4wx
Summary: Hijacked Environment Variables in tkinter
Aliases: CVE-2017-16061
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506, CWE-433
Published: 2018-11-01T14:47:21Z

The `tkinter` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-rrfw-hg9m-j47h
Summary: Signature Validation Bypass
Severity: CRITICAL
CVSS score: 0
CWE: CWE-347
Published: 2021-05-24T16:59:42Z

### Impact

An authentication bypass exists in the [goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.

### Patches

Version 0.4.2 bumps the dependency which should fix the issue.

### For more information

Please see [the advisory in goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)

## Credits

The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.
Vulnerability: GHSA-q26w-wjj2-22vv
Summary: Cross-site scripting in Joplin
Aliases: CVE-2020-28249
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-10T18:47:36Z

Joplin allows XSS via a LINK element in a note.
Vulnerability: GHSA-94m7-w873-6wwf
Summary: Malicious Package in modlibrary
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:28:56Z

Version 0.1.1 of `modlibrary` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.1.1 of this module is found installed you will want to replace it with a version before or after 0.1.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-33h2-69j3-r336
Summary: Out-of-bounds Read in OpenCV 
Aliases: CVE-2017-12598
Severity: HIGH
CVSS score: 8.8
CWE: CWE-125
Published: 2021-10-12T22:00:51Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case.
Vulnerability: GHSA-jh37-772x-4hpw
Summary: Double free in algorithmica
Aliases: CVE-2021-31996
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T21:01:52Z

An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. In the affected versions of this crate, `merge_sort::merge()` wildly duplicates and drops ownership of `T` without guarding against double-free. Due to such implementation, simply invoking `merge_sort::merge()` on `Vec<T: Drop>` can cause **double free** bugs.
Vulnerability: GHSA-v3r2-3fp4-rp46
Summary: Prototype pollution in paypal-adaptive
Aliases: CVE-2020-7643
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-400
Published: 2021-12-10T20:05:57Z

paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Vulnerability: GHSA-h2g5-2rhx-ffgj
Summary: Command injection in Weblate
Aliases: CVE-2022-24727
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2022-03-05T00:00:44Z

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.
Vulnerability: GHSA-f3pc-c2gf-hvgw
Summary: Malicious Package in requets
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:13:14Z

All versions of `requets` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-x752-qjv4-c4hc
Summary: Remote code injection in dompdf/dompdf
Aliases: CVE-2022-28368
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2022-04-04T00:00:55Z

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).