TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-8wwf-2644-f8x4
Summary: Path traversal
Aliases: CVE-2021-34363
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-22
Published: 2021-06-15T15:49:01Z

The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the `undo archive operation` feature.
Vulnerability: GHSA-rc77-xxq6-4mff
Summary: Command Injection in hot-formula-parser
Aliases: CVE-2020-6836
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2020-05-06T19:32:33Z

Versions of `hot-formula-parser` prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the  `parse` function and concatenates it in an `eval` call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands in the server.  
Parsing the following formula creates a `test` file in the present directory:  
`"SUM([(function(){require('child_process').execSync('touch test')})(),2])"`


## Recommendation

Upgrade to version 3.0.1 or later.
Vulnerability: GHSA-99p8-9p2c-49j4
Summary: Improper Access Control in Onionshare
Aliases: CVE-2022-21695
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-287
Published: 2022-01-21T23:20:16Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-009
- Vulnerability type: Improper Access Control
- Threat level: Low

## Description:

Authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants.

## Technical description:

Prerequisites:

- Existing chatroom
- Access to the chatroom (Public or known Private Key)
- Either a modified frontend client or manual requests from burp/curl

If a user opens the chatroom without emitting the join message he will not be present in session.users[x] list. Therefore there is no listing in the frontend and no chat participant knows another party joined the chat. It is still possible to send messages in the chatroom.

If a user decides to abuse OTF-003 (page 22) he can impersonate messages from existing users; others would not be able to distinguish original and faked messages. This is also a prerequisite for OTF-004 (page 19).

## Impact:

An adversary with access to the chat environment can send messages to the chat without being visible in the list of chat participants.

## Recommendation:

- Allow chat access only after emission of the join event.
- Implement proper session handling.
Vulnerability: GHSA-pwhf-7427-9vv2
Summary: Non-atomic writes in cgc
Aliases: CVE-2020-36468
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-657
Published: 2021-08-25T20:56:57Z

An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::write performs non-atomic write operations on an underlying pointer.
Vulnerability: GHSA-782p-53wq-cxmj
Summary: High severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua
Aliases: CVE-2018-12086
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2018-10-16T19:51:31Z

Buffer overflow in OPC UA applications allows remote attackers to trigger a stack overflow with carefully structured requests.
Vulnerability: GHSA-wwf2-5cj8-jx6w
Summary: Hijacked Environment Variables in nodesqlite
Aliases: CVE-2017-16049
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T20:50:21Z

The `nodesqlite` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-jvjp-vh27-r9h5
Summary: Cross-site Scripting in PiranhaCMS
Aliases: CVE-2021-25977
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-10-27T18:53:03Z

In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
Vulnerability: GHSA-x65c-4fgj-5fc3
Summary: Cross-site Scripting in pandao
Aliases: CVE-2019-14653
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-23T00:05:00Z

pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
Vulnerability: GHSA-cr6j-3jp9-rw65
Summary: Critical severity vulnerability that affects org.apache.struts:struts2-core
Aliases: CVE-2018-11776
Severity: HIGH
CVSS score: 8.1
CWE: CWE-20
Published: 2018-10-18T19:24:38Z

Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when using results with no namespace and in same time, its upper action(s) have no or wildcard namespace. Same possibility when using url tag which doesn't have value and action set and in same time, its upper action(s) have no or wildcard namespace.
Vulnerability: GHSA-536q-8gxx-m782
Summary: Cross-Site Scripting in dojo
Aliases: CVE-2010-2273
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2019-09-11T23:02:57Z

Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.4.2 or later.
Vulnerability: GHSA-c9cg-q8r2-xvjq
Summary: Improper Authentication in Auth0.AuthenticationApi
Aliases: CVE-2019-16929
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2019-10-24T20:56:12Z

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.
Vulnerability: GHSA-23c7-6444-399m
Summary: Improper Input Validation in sopel-plugins.channelmgnt
Aliases: CVE-2021-21431
Severity: HIGH
CVSS score: 7.6
CWE: CWE-20, CWE-284
Published: 2021-04-09T15:42:40Z

### Impact
On some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once.
We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that.

Freenode is not affected.

### Patches
Upgrade to 2.0.1 or higher

### Workarounds
Do not use this plugin on networks where TARGMAX > 1.

### For more information
If you have any questions or comments about this advisory:
* Open an issue on [phab](https://phab.mirahezebots.org/maniphest/task/edit/form/1/).
* Email us at [staff(at)mirahezebots(dot)org](mailto:staff@mirahezebots.org)
Vulnerability: GHSA-q6gq-997w-f55g
Summary: Infinite loop in xz
Aliases: CVE-2020-16845
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2021-12-16T19:16:40Z

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
Vulnerability: GHSA-cr8h-x88h-jwj2
Summary: Downloads Resources over HTTP in wixtoolset
Aliases: CVE-2016-10663
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:45Z

Affected versions of `wixtoolset` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `wixtoolset`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rjvj-673q-4hfw
Summary: Command Injection in traceroute
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T17:54:31Z

All versions of `traceroute` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `trace` function is vulnerable and can be abused if the `host` value is controlled by an attacker.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-38cg-gg9j-q9j9
Summary: Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak
Aliases: CVE-2019-3875
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-295, CWE-345
Published: 2019-06-27T17:25:57Z

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
Vulnerability: GHSA-mm4m-qg48-f7wc
Summary: Improper Synchronization and Race Condition in vm-memory
Aliases: CVE-2020-13759
Severity: HIGH
CVSS score: 7.5
CWE: CWE-662, CWE-362
Published: 2021-08-25T21:01:29Z

rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
Vulnerability: GHSA-fcr6-6cph-vmcm
Summary: Stored XSS vulnerability in Jenkins Git Parameter Plugin
Aliases: CVE-2022-29040
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-13T00:00:17Z

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-66hf-2p6w-jqfw
Summary: XSS in laravel/framework
Aliases: CVE-2021-43808
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-12-08T19:57:36Z

A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine.

Given the following two Blade templates:

resources/views/parent.blade.php:

```html
@section('content')
<input value="{{ $value }}">
@show
```

resources/views/child.blade.php:

```html
@extends('parent')

@section('content')
<input value="{{ $value }}">
@endsection
```

And a route like the following:

```php
Route::get('/example', function() {
    $value = '//localhost/###parent-placeholder-040f06fd774092478d450774f5ba30c5da78acc8## onclick=location.assign(this.value);//';

    return view('child', ['value' => $value]);
});
```

The broken HTML element may be clicked and the user is taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed.

This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Vulnerability: GHSA-jv2r-jx6q-89jg
Summary: Use of Uninitialized Resource in bronzedb-protocol.
Aliases: CVE-2021-45682
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:16:32Z

An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
Vulnerability: GHSA-xxx9-3xcr-gjj3
Summary: XML Injection in Xerces Java affects Nokogiri
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-91
Published: 2022-04-11T21:30:00Z

## Summary

Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 "Medium" on the NVD record.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J

- **Severity**: Medium
- **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)
- **Description**: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
Vulnerability: GHSA-q5rx-8c2h-5q7j
Summary: Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service
Aliases: CVE-2021-36152
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-02-06T00:01:07Z

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Vulnerability: GHSA-566x-hhrf-qf8m
Summary: Use after free in ordered-float
Aliases: CVE-2020-35923
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-416
Published: 2021-08-25T20:50:30Z

An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. A NotNan value can contain a NaN.
Vulnerability: GHSA-mw7r-3g6w-85qg
Summary: Out-of-bounds write
Aliases: CVE-2019-1131
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:46Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1139, CVE-2019-1140, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
Vulnerability: GHSA-q2qh-cgc2-qhr3
Summary: Directory Traversal in serve
Aliases: CVE-2018-3712
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2018-07-27T17:07:50Z

Affected versions of `serve` do not properly handle `%2e` (.) and `%2f` (/) characters, and allow the, characters to be used in paths. This can be used to traverse the directory tree and list content of any directory the user running the process has access to.

Mitigating factors:
This vulnerability only allows listing of directory contents and does not allow reading of arbitrary files.


## Recommendation

Update to version 6.4.9 later.
Vulnerability: GHSA-hhff-3c89-5m7p
Summary: Directory Traversal in byucslabsix
Aliases: CVE-2017-16166
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:45:42Z

Affected versions of `byucslabsix` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-whjr-jj69-7prm
Summary: Malicious Package in import-mysql
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:44:35Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-rffp-mc78-wjf7
Summary: Command Injection in cocos-utils
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-02T18:26:48Z

All versions of `cocos-utils` are vulnerable to Remote Code Execution. The `unzip()` function concatenates user input to `exec()` which may allow attackers to execute arbitrary commands  on the server.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-hh8v-jmh3-9437
Summary: Cross-site scripting in SocksJS-node
Aliases: CVE-2020-8823
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-13T15:25:33Z

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
Vulnerability: GHSA-g84j-95x2-7g67
Summary: Downloads Resources over HTTP in tomita
Aliases: CVE-2016-10662
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:50Z

Affected versions of `tomita` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `tomita`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-p9wf-3xpg-c9g5
Summary: XML External Entity Injection in PyWPS
Aliases: CVE-2021-39371
Severity: HIGH
CVSS score: 7.5
CWE: CWE-91, CWE-611
Published: 2021-09-02T17:11:13Z

An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
Vulnerability: GHSA-fj93-7wm4-8x2g
Summary: Cross-Site Scripting in jquery-mobile
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T21:22:47Z

All version of `jquery-mobile` are vulnerable to Cross-Site Scripting. The package checks for content in `location.hash` and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with `innerHTML`. It fails to validate the `Content-Type` of the response, allowing attackers to include malicious payloads as part of query parameters that are reflected back to the user. A response such as `{"q":"<iframe/src='javascript:alert(1)'></iframe>","results":[]}` would be parsed as HTML and the JavaScript payload executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gmw6-94gg-2rc2
Summary: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Aliases: CVE-2021-39135
Severity: MODERATE
CVSS score: 8.2
CWE: CWE-61, CWE-59
Published: 2021-08-31T16:03:34Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.

This is accomplished by extracting package contents into a project's `node_modules` folder.

If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system.

Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed.

1. A `preinstall` script could replace `node_modules` with a symlink.  (This is prevented by using `--ignore-scripts`.)
2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root.  This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe.

### Patches

2.8.2 (included in npm v7.20.7 and above)

### Workarounds

Do not run `npm install` on untrusted codebases, without first ensuring that the `node_modules` directory in the project is not a symbolic link.

### Fix

Prior to extracting any package contents, the `node_modules` folder into which it is extracted is verified to be a real directory.  If it is not, then it is removed.

Caveat: if you are currently relying on creating a symbolic link to the `node_modules` folder in order to share dependencies between projects, then that will no longer be possible.  Please use the `npm link` command, explicit `file:...` dependencies, and/or `workspaces` to share dependencies in a development environment.
Vulnerability: GHSA-jcgr-9698-82jx
Summary: Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build
Severity: LOW
CVSS score: 0
CWE: CWE-77
Published: 2021-05-28T15:53:40Z

### Impact
If you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project.

### Patches
The problem has been patched in v1.0.0 as it uses a proper method to pass configs to esbuild/estrella.

### Workarounds
There is no work around. You should update asap.

### Notes
This notice is mainly just to make sure people update to the latest version. This isn't that bad, but should encourage you to update.
Vulnerability: GHSA-3mw4-6rj6-74g5
Summary: Null pointer dereference in TensorFlow
Aliases: CVE-2022-21739
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-476
Published: 2022-02-09T23:46:46Z

### Impact 
The [implementation of `QuantizedMaxPool`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/quantized_pooling_ops.cc#L114-L130) has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer.

```python
import tensorflow as tf

tf.raw_ops.QuantizedMaxPool(
    input = tf.constant([[[[4]]]], dtype=tf.quint8),
    min_input = [],
    max_input = [1],
    ksize = [1, 1, 1, 1],
    strides = [1, 1, 1, 1],
    padding = "SAME", name=None
)
```

### Patches
We have patched the issue in GitHub commit [53b0dd6dc5957652f35964af16b892ec9af4a559](https://github.com/tensorflow/tensorflow/commit/53b0dd6dc5957652f35964af16b892ec9af4a559).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-x2jp-hh65-4xvf
Summary: Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle
Aliases: CVE-2021-20280
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-03-29T20:42:15Z

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Vulnerability: GHSA-394c-5j6w-4xmx
Summary: Regular Expression Denial of Service (ReDoS) in ua-parser-js
Aliases: CVE-2020-7793
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-09T22:46:53Z

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
Vulnerability: GHSA-wq3v-3grq-6f86
Summary: Improper Control of Dynamically-Managed Code Resources in Crafter CMS Crafter Studio
Aliases: CVE-2020-25802
Severity: HIGH
CVSS score: 7.2
CWE: CWE-913
Published: 2022-02-09T23:07:55Z

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
Vulnerability: GHSA-q28m-8xjw-8vr5
Summary: Keepalive Connections Causing Denial Of Service in puma
Aliases: CVE-2021-29509
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-18T01:27:15Z

This vulnerability is related to [CVE-2019-16770](https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994).

### Impact

The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster.

A `puma` server which received more concurrent `keep-alive` connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections.

### Patches

This problem has been fixed in `puma` 4.3.8 and 5.3.1.

### Workarounds

Setting `queue_requests false` also fixes the issue. This is not advised when using `puma` without a reverse proxy, such as `nginx` or `apache`, because you will open yourself to slow client attacks (e.g. [slowloris](https://en.wikipedia.org/wiki/Slowloris_(computer_security))).

The fix is very small. [A git patch is available here](https://gist.github.com/nateberkopec/4b3ea5676c0d70cbb37c82d54be25837) for those using [unsupported versions](https://github.com/puma/puma/security/policy#supported-versions) of Puma.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma).
* To report problems with this fix or to report another vulnerability, see [our security policy.](https://github.com/puma/puma/security/policy)

### Acknowledgements

Thank you to @MSP-Greg, @wjordan and @evanphx for their review on this issue. 

Thank you to @ioquatix for providing a modified fork of `wrk` which made debugging this issue much easier.
Vulnerability: GHSA-xgj6-pgrm-x4r2
Summary: Moderate severity vulnerability that affects gtk2
Aliases: CVE-2007-6183
Severity: MODERATE
CVSS score: 0
CWE: CWE-134
Published: 2017-10-24T18:33:38Z

Format string vulnerability in the mdiag_initialize function in gtk/src/rbgtkmessagedialog.c in Ruby-GNOME 2 (aka Ruby/Gnome2) 0.16.0, and SVN versions before 20071127, allows context-dependent attackers to execute arbitrary code via format string specifiers in the message parameter.
Vulnerability: GHSA-p65m-qr5x-rrqq
Summary: High severity vulnerability that affects webbynode
Aliases: CVE-2013-7086
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.
Vulnerability: GHSA-mg8r-9g6j-hwv9
Summary: Authentication Bypass in hapi-auth-jwt2
Aliases: CVE-2016-10525
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2019-02-18T23:39:00Z

Versions of `hapi-auth-jwt2` prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the `try` authentication mode. 


## Recommendation

Update to version 5.1.2 or later.
Vulnerability: GHSA-r35g-4525-29fq
Summary: Division by 0 in `FusedBatchNorm`
Aliases: CVE-2021-29555
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:23:58Z

### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.FusedBatchNorm`:

```python
import tensorflow as tf

x = tf.constant([], shape=[1, 1, 1, 0], dtype=tf.float32)
scale = tf.constant([], shape=[0], dtype=tf.float32)
offset = tf.constant([], shape=[0], dtype=tf.float32)
mean = tf.constant([], shape=[0], dtype=tf.float32)
variance = tf.constant([], shape=[0], dtype=tf.float32)
epsilon = 0.0
exponential_avg_factor = 0.0
data_format = "NHWC"
is_training = False

tf.raw_ops.FusedBatchNorm(
    x=x, scale=scale, offset=offset, mean=mean,
    variance=variance, epsilon=epsilon,
    exponential_avg_factor=exponential_avg_factor,
    data_format=data_format, is_training=is_training)
``` 
  
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/828f346274841fa7505f7020e88ca36c22e557ab/tensorflow/core/kernels/fused_batch_norm_op.cc#L295-L297) performs a division based on the last dimension of the `x` tensor:

```cc 
const int depth = x.dimension(3);
const int rest_size = size / depth;
```

Since this is controlled by the user, an attacker can trigger a denial of service.

### Patches
We have patched the issue in GitHub commit [1a2a87229d1d61e23a39373777c056161eb4084d](https://github.com/tensorflow/tensorflow/commit/1a2a87229d1d61e23a39373777c056161eb4084d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-29hg-r7c7-54fr
Summary: Double free in insert_many
Aliases: CVE-2021-29933
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:55:06Z

An issue was discovered in the insert_many crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next() method panics.
Vulnerability: GHSA-w9r2-qrpm-4rmj
Summary: Data race in disrustor
Aliases: CVE-2020-36470
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2021-08-25T20:56:59Z

An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references.
Vulnerability: GHSA-2mw7-wggm-m6w3
Summary: Low severity vulnerability that affects ethereumjs-vm
Aliases: CVE-2018-19183
Severity: HIGH
CVSS score: 7.5
CWE: CWE-119
Published: 2018-11-21T22:22:46Z

ethereumjs-vm 2.4.0 allows attackers to cause a denial of service (vm.runCode failure and REVERT) via a "code: Buffer.from(my_code, 'hex')" attribute.
Vulnerability: GHSA-7ggw-h8pp-r95r
Summary: Session ID not invalidated after logout
Aliases: CVE-2021-3311
Severity: LOW
CVSS score: 0
CWE: CWE-613
Published: 2021-02-10T02:32:35Z

### Impact
When logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.

### Patches
Issue has been patched in Build 472 (v1.0.472) and v1.1.2.

### Workarounds
Apply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.

### References
- Reported by Anisio (Brazilian Information Security Analyst)
- http://cve.circl.lu/cve/CVE-2021-3311

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="699" alt="Screen Shot 2021-02-07 at 11 50 35 PM" src="https://user-images.githubusercontent.com/7253840/107180881-51eaf000-699f-11eb-8828-333128faf2a6.png">
Vulnerability: GHSA-q4cq-539c-3mmm
Summary: Directory Traversal in serveryztyzt
Aliases: CVE-2017-16103
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:48:14Z

Affected versions of `serveryztyzt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-m33v-338h-4v9f
Summary: Path traversal in Node-Red
Aliases: CVE-2021-21298
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2021-02-26T16:31:23Z

### Impact

This vulnerability allows arbitrary path traversal via the Projects API.

If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API.

### Patches

The issue has been patched in Node-RED 1.2.8

### Workarounds

The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.

The primary workaround is not give untrusted users read access to the Node-RED editor.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@nodered.org](mailto:team@nodered.org)

### Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
Vulnerability: GHSA-vmhw-fhj6-m3g5
Summary: Path Traversal in angular-http-server
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-05-31T23:46:33Z

Versions of `angular-http-server` before 1.4.4 are vulnerable to path traversal.


## Recommendation

Update to version 1.4.4 or later.
Vulnerability: GHSA-f34m-x9pj-62vq
Summary: Cross-Site Scripting Vulnerability in @joeattardi/emoji-button
Aliases: CVE-2021-43785
Severity: HIGH
CVSS score: 7.6
CWE: CWE-79
Published: 2021-12-01T18:29:02Z

### Impact

There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:

- A URL for a custom emoji
- An i18n string

In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.

### Patches

This vulnerability is fixed starting in version 4.6.2. This is resolved by properly escaping strings that are inserted into the HTML document.

### Workarounds

There is no workaround other than upgrading to a non-vulnerable version.

### Credit

This issue was discovered by GitHub team member [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh) and was reported by the GitHub Security Lab team.
Vulnerability: GHSA-3mpp-xfvh-qh37
Summary: node-ipc behavior change
Severity: LOW
CVSS score: 0
Published: 2022-03-16T23:54:35Z

node-ipc version 11.0.0 and newer include a message from the maintainer that is written to the user’s desktop. Please review the version changes before proceeding.
Vulnerability: GHSA-2rh5-jvgx-pgw3
Summary: Any storage file can be downloaded from p.sh if full server path is known
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2021-09-14T20:25:13Z

The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.
Vulnerability: GHSA-vrf2-xghr-j52v
Summary: Private files publicly accessible with Cloud Storage providers
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-06-28T18:20:42Z

### Impact

Private files publicly accessible with Cloud Storage providers when the hashed URL is known

### Patches

We recommend first changing your configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`.

When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities
Vulnerability: GHSA-g7j3-p357-cw8p
Summary: Directory Traversal in f2e-server
Aliases: CVE-2017-16038
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-07-24T16:29:12Z

Affected versions of `f2e-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to version 1.12.12 or later.
Vulnerability: GHSA-4x7w-frcq-v4m3
Summary: Path Traversal in @wturyn/swagger-injector
Severity: CRITICAL
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T20:38:47Z

All versions of `@wturyn/swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-2rfj-2mwp-787v
Summary: Out-of-bounds write
Aliases: CVE-2019-0993
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:51Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
Vulnerability: GHSA-g93h-75m9-3qq4
Summary: Downloads Resources over HTTP in pngcrush-installer
Aliases: CVE-2016-10570
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:52:27Z

Affected versions of `pngcrush-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pngcrush-installer`.


## Recommendation

Update to version 1.8.10 or later.
Vulnerability: GHSA-4wm8-fjv7-j774
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8325
Severity: HIGH
CVSS score: 7.5
CWE: CWE-74
Published: 2019-06-20T16:08:21Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
Vulnerability: GHSA-pmv6-gf98-p3r5
Summary: Command Injection in kill-port
Aliases: CVE-2019-5414
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2019-03-25T16:17:18Z

Versions of `kill-port` prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the `kill` function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.


## Recommendation

Upgrade to version 1.3.2 or later.
Vulnerability: GHSA-93f3-23rq-pjfp
Summary: Sensitive information exposure through logs in npm CLI
Aliases: CVE-2020-15095
Severity: LOW
CVSS score: 4.4
CWE: CWE-532
Published: 2020-07-07T18:56:16Z

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.
Vulnerability: GHSA-pxmp-fwjc-4x7q
Summary: HTML Injection in marky-markdown
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T15:45:23Z

All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, such as `youtube.com.evil.co`. This 


## Recommendation

This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`
Vulnerability: GHSA-hm48-76wh-q86v
Summary: High severity vulnerability that affects activerecord
Severity: HIGH
CVSS score: 0
Published: 2018-08-21T19:03:17Z

Withdrawn, accidental duplicate publish.

activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Vulnerability: GHSA-jp5v-5gx4-jmj9
Summary: Ability to forge per-form CSRF tokens in Rails
Aliases: CVE-2020-8166
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2020-05-26T15:11:13Z

It is possible to possible to, given a global CSRF token such as the one
present in the authenticity_token meta tag, forge a per-form CSRF token for
any action for that session.

Impact
------

Given the ability to extract the global CSRF token, an attacker would be able to
construct a per-form CSRF token for that session.

Workarounds
-----------

This is a low-severity security issue. As such, no workaround is necessarily
until such time as the application can be upgraded.
Vulnerability: GHSA-6jx3-rqcx-g3ww
Summary: Downloads Resources over HTTP in air-sdk
Aliases: CVE-2016-10603
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:33:48Z

Affected versions of `air-sdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `air-sdk`.


## Recommendation

No patch is currently available for this vulnerability, and the package hasn't seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3c67-gc48-983w
Summary: Path Traversal in Ansible
Aliases: CVE-2020-10691
Severity: MODERATE
CVSS score: 5.2
CWE: CWE-22
Published: 2021-04-20T16:44:37Z

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
Vulnerability: GHSA-f7r3-p866-q9qr
Summary: Denial of Service in ircdkit
Severity: LOW
CVSS score: 3.7
CWE: CWE-400
Published: 2019-06-03T17:27:49Z

Versions of `ircdkit` before 1.0.3 are vulnerable to a remote denial of service.


## Recommendation

Upgrade to version 1.0.4.
Vulnerability: GHSA-f99g-pg48-wrfc
Summary: twill is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3932
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-352, CWE-268
Published: 2021-11-15T23:19:26Z

twill is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-fgp6-8g62-qx6w
Summary: Malicious Package in smartsearchwp
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:01:45Z

All versions of `smartsearchwp` contain malicious code. The package is malware intended to steal credentials from websites it is loaded in. It traverses DOM elements looking for fields such as `username` and `password` and uploads it to a remote server. The package also port-scans the local gateway and uploads the information to the remote server. It has a feature to fetch commands from the remote server and execute them with `eval`. The npm security team analysis found several bugs in the malware that prevent it from actually performing its actions. The malicious code is also not invoked upon installation or require; it would require transpiling TypeScript code and using it in a website.



## Recommendation

Remove the package from your environment. There is no indication of further compromise.
Vulnerability: GHSA-gf2j-7qwg-4f5x
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2018-14637
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287, CWE-285
Published: 2018-12-21T17:48:45Z

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
Vulnerability: GHSA-9g3v-j3cr-6fc6
Summary: Cross-site Scripting in snipe-it
Aliases: CVE-2021-3879
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2021-10-21T17:48:26Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-q3m9-9fj2-mfwr
Summary: URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal
Aliases: CVE-2021-32806
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-601
Published: 2021-08-05T17:02:12Z

### Impact
Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal.
But the url `https:example.org` without slashes tricks our code and it _is_ considered to be in the portal.
When redirecting, some browsers go to `https://example.org`, others give an error.
Attackers may use this to redirect you to their site, especially as part of a phishing attack.

### Patches
The problem has been patched in `Products.isurlinportal` 1.2.0.
This is a recommended upgrade for all users of Plone 4.3 and 5, on Python 2.7 or higher.
It has not been tested on earlier Plone or Python versions.
Upcoming Plone 5.2.5 and higher will include the new version.

### Discovered
This vulnerability was discovered and reported by Yuji Tounai of Mitsui Bussan Secure Directions, Inc. Thank you!

### For more information
If you have any questions or comments about this advisory:
* Email the Plone Security Team at [security@plone.org](mailto:security@plone.org), especially when you think you have discovered a security problem or when you are not sure.
* Open an issue in [the tracker](https://github.com/plone/Products.isurlinportal/issues) if your question or comment can be public.