TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-3wjm-33mw-h388
Summary: Malicious Package in s3asy
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:34:14Z

Version 0.4.8 of `s3asy` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.4.8 of this module is found installed you will want to replace it with a version before or after 0.4.8. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-3gx7-xhv7-5mx3
Summary: Arbitrary Code Execution in eslint-utils
Aliases: CVE-2019-15657
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2019-08-26T16:59:56Z

Versions of `eslint-utils` >=1.2.0 or <1.4.1 are vulnerable to Arbitrary Code Execution. The `getStaticValue` does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The `getStringIfConstant` and `getPropertyName` functions are not affected.


## Recommendation

Upgrade to version 1.4.1 or later.
Vulnerability: GHSA-3qgw-p4fm-x7gf
Summary: Division by zero in TFLite's convolution code
Aliases: CVE-2021-29594
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:27:45Z

### Impact
TFLite's [convolution code](https://github.com/tensorflow/tensorflow/blob/09c73bca7d648e961dd05898292d91a8322a9d45/tensorflow/lite/kernels/conv.cc) has multiple division where the divisor is controlled by the user and not checked to be non-zero. For example:

```cc 
const int input_size = NumElements(input) / SizeOfDimension(input, 0);
```

### Patches
We have patched the issue in GitHub commit [ff489d95a9006be080ad14feb378f2b4dac35552](https://github.com/tensorflow/tensorflow/commit/ff489d95a9006be080ad14feb378f2b4dac35552).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-gq28-h5vg-8prx
Summary: Privilege escalation in spring security
Aliases: CVE-2021-22112
Severity: HIGH
CVSS score: 8.8
CWE: CWE-269
Published: 2021-05-10T15:22:39Z

Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Vulnerability: GHSA-53m6-44rc-h2q5
Summary: Missing server signature validation in OctoberCMS
Aliases: CVE-2022-23655
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-347
Published: 2022-02-24T13:09:30Z

### Impact

This advisory affects authors of plugins and themes listed on the October CMS marketplace where an end-user will inadvertently expose authors to potential financial loss by entering their private license key into a compromised server.

It has been disclosed that a project fork of October CMS v1.0 is using a compromised gateway to access the October CMS marketplace service. The compromised gateway captures the personal/business information of users and authors, including private source code files. It was also disclosed that captured plugin files are freely redistributed to other users without authorization.

1. End-users are provided with a forked version of October CMS v1.0. The provided software is modified to use a compromised gateway server.

2. The user is instructed to enter their October CMS license key into the administration panel to access the October CMS marketplace. The key is sent to the compromised server while appearing to access the genuine October CMS gateway server.

3. The compromised gateway server uses a "man in the middle" mechanism that captures information while forwarding the request to the genuine October CMS gateway and relaying the response back to the client.

4. The compromised gateway server stores the license key and other information about the user account including client name, email address and contents of purchased plugins and privately uploaded plugin files. 

5. The stored plugin files are made available to other users of the compromised gateway server.

### Patches

The issue has been patched in Build 475 (v1.0.475) and v1.1.11.

### Workarounds

Apply https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a to your installation manually if unable to upgrade to Build 475 or v1.1.11.

### Recommendations

We recommend the following steps to make sure your account information stays secure:

- Do not share your license key with anyone except October CMS.
- Check to make sure that your gateway update server has not been modified.
- Be aware of phishing websites, including other platforms that use the same appearance.
- For authors, you may contact us for help requesting the removal of affected plugins.
- Before providing plugin support, verify that the user holds a legitimate copy of the plugin.

### References

Credits for research on this exploit:
• Nikita Khaetsky

### For more information

If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-4vcm-qfxh-p6c3
Summary: Directory Traversal in getcityapi.yoehoehne
Aliases: CVE-2017-16192
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:40:29Z

Affected versions of `getcityapi.yoehoehne` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6h52-4vmh-8x4f
Summary: Moderate severity vulnerability that affects feedparser
Aliases: CVE-2011-1156
Severity: MODERATE
CVSS score: 0
Published: 2018-07-23T19:50:33Z

feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.
Vulnerability: GHSA-qmfc-6www-fjqw
Summary: Code injection in Apache Dubbo
Aliases: CVE-2021-30181
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2022-03-18T17:57:04Z

Apache Dubbo prior to 2.6.9 and 2.7.10 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Vulnerability: GHSA-5xvc-vgmp-jgc3
Summary: Improper Access Control in jupyterhub-firstuseauthenticator
Aliases: CVE-2021-41194
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-284
Published: 2021-10-28T23:13:57Z

### Impact

When JupyterHub is used with FirstUseAuthenticator, the vulnerability allows unauthorized access to any user's account if `create_users=True` and the username is known or guessed.

### Patches

Upgrade to jupyterhub-firstuseauthenticator to 1.0, or apply patch https://github.com/jupyterhub/firstuseauthenticator/pull/38.patch

### Workarounds

If you cannot upgrade, there is no complete workaround, but it can be mitigated.

If you cannot upgrade yet, you can disable user creation with `c.FirstUseAuthenticator.create_users = False`, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until you can patch or upgrade.
Vulnerability: GHSA-q54r-r9pr-w7qv
Summary: XSS in Hexo
Aliases: CVE-2021-25987
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-79
Published: 2021-12-01T18:27:44Z

Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
Vulnerability: GHSA-w5mp-8p8w-mhh8
Summary: Command injection in connection-tester
Aliases: CVE-2020-7781
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-12-17T21:00:53Z

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. Affected versions of this package are vulnerable to Command Injection
Vulnerability: GHSA-j8qq-58cr-8cc7
Summary: Out of bounds read in bra
Aliases: CVE-2021-25905
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-908, CWE-125
Published: 2021-08-25T20:52:53Z

Buffered Random Access (BRA) provides easy random memory access to a sequential source of data in Rust. This is achieved by greedily retaining all memory read from a given source. Buffered Random Access (BRA) provides easy random memory access to a sequential source of data in Rust. An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory.
Vulnerability: GHSA-qwpp-fgrj-h78q
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32712
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-09-08T17:59:46Z

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
Vulnerability: GHSA-ffxg-xm4w-3wg9
Summary: Command Injection in corenlp-js-interface
Aliases: CVE-2020-28440
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-12-18T18:23:04Z

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.
Vulnerability: GHSA-g4m9-5hpf-hx72
Summary: Firewall configured with unanimous strategy was not actually unanimous in Symfony
Aliases: CVE-2020-5275
Severity: HIGH
CVSS score: 7.6
CWE: CWE-285
Published: 2020-03-30T20:09:44Z

Description
-----------

On Symfony before 4.4.0, when a `Firewall` checks an access control rule (using the unanimous strategy), it iterates over all rule attributes and grant access only if *all* calls to the `accessDecisionManager` decide to grant access.

As of Symfony 4.4.0, a bug was introduced that prevents the check of attributes as soon as `accessDecisionManager` decide to grant access on one attribute.

Resolution
----------

The `accessDecisionManager` is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. 

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf) for the 4.4 branch.

Credits
-------

I would like to thank Antonio J. García Lagar for reporting & Robin Chalas for fixing the issue.
Vulnerability: GHSA-fwhp-2hqr-6g72
Summary: Downloads Resources over HTTP in pk-app-wonderbox
Aliases: CVE-2016-10685
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:01Z

Affected versions of `pk-app-wonderbox` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pk-app-wonderbox`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rqwh-c535-j9hw
Summary: Downloads Resources over HTTP in js-given
Aliases: CVE-2016-10638
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:09Z

Affected versions of `js-given` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `js-given`.


## Recommendation

Update to version 0.0.18 or later.
Vulnerability: GHSA-3p4q-x8f3-p7vq
Summary: Moderate severity vulnerability that affects notebook
Aliases: CVE-2018-19352
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-21T22:19:22Z

Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
Vulnerability: GHSA-vh6r-g38f-q3w8
Summary: Validation bypass in jpv
Aliases: CVE-2020-17479
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2021-05-06T17:27:58Z

jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
Vulnerability: GHSA-mwm4-5qwr-g9pf
Summary: Keycloak is vulnerable to IDN homograph attack
Severity: LOW
CVSS score: 0
CWE: CWE-284
Published: 2022-04-28T21:00:31Z

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.
Vulnerability: GHSA-x87g-rgrh-r6g3
Summary: Malicious Package in rpc-websocket
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:07:15Z

Versions of `rpc-websocket` >= 0.7.6 contained malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a backdoor.


## Recommendation

Any computer that has these versions of the package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-pw4v-gr34-2553
Summary: Denial of service (via resource exhaustion) due to improper input validation
Aliases: CVE-2021-29433
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20, CWE-400
Published: 2021-04-16T19:53:37Z

### Impact

Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.

### Patches

Fixed by 3175fd3.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: GHSA-9mjp-gv34-3jcf
Summary: Malicious Package in aasync
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:37:35Z

All versions of `aasync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-59qh-g7m4-j9m9
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0374
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2022-01-28T23:06:12Z

Stored XSS attacks exist in new the form creation flow. New forms can be given a title which will render javascript.
Vulnerability: GHSA-x268-6jhm-2mx8
Summary: Downloads Resources over HTTP in libsbmlsim
Aliases: CVE-2016-10675
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:22Z

Affected versions of `libsbmlsim` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libsbmlsim`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-7mfr-774f-w5r9
Summary: Improper Certificate Validation
Aliases: CVE-2017-11770
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2022-04-12T00:07:34Z

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".
Vulnerability: GHSA-m5vr-3m74-jwxp
Summary: Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
Aliases: CVE-2020-15098
Severity: HIGH
CVSS score: 8.8
CWE: CWE-325, CWE-200, CWE-20, CWE-327, CWE-502
Published: 2020-07-29T16:15:19Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2)
> * CWE-325, CWE-20, CWE-200, CWE-502

### Problem
It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below.

* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007), [CVE-2020-15099](https://nvd.nist.gov/vuln/detail/CVE-2020-15099): Potential Privilege Escalation
  + the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network)
  + `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5, high)
* [TYPO3-CORE-SA-2016-013](https://typo3.org/security/advisory/typo3-core-sa-2016-013), [CVE-2016-5091](https://nvd.nist.gov/vuln/detail/CVE-2016-5091): Insecure Deserialization & Remote Code Execution
  + an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation
  + `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1, critical)

The overall severity of this vulnerability is **high (8.2)** based on mentioned attack chains and the requirement of having a valid backend user session (authenticated).

### Solution
Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2020-008](https://typo3.org/security/advisory/typo3-core-sa-2020-008)
Vulnerability: GHSA-g64q-3vg8-8f93
Summary: Prototype Pollution in subtext
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T15:47:10Z

All versions of `subtext` are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

This package is deprecated and is now maintained as `@hapi/subtext`. Please update your dependencies to use `@hapi/subtext`.
Vulnerability: GHSA-vv6q-9cfw-4c83
Summary: Hijacked Environment Variables in smb
Aliases: CVE-2017-16079
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:20:27Z

The `smb` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-q2gj-9r85-p832
Summary: Data races in rulinalg
Aliases: CVE-2020-35879
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-362
Published: 2021-08-25T20:48:09Z

An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. There are incorrect lifetime-boundary definitions for RowMut::raw_slice and RowMut::raw_slice_mut.
Vulnerability: GHSA-hqf9-rc9j-5fmj
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2014-0080
Severity: MODERATE
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
Vulnerability: GHSA-4qqc-mp5f-ccv4
Summary: Command Injection in bestzip
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-02T15:05:51Z

Versions of `bestzip` prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `zip` function . This may allow attackers to execute arbitrary code in the system as long as the values of `destination` is user-controlled. This only affects users with a native `zip` command available. The following examples demonstrate the issue from the CLI and also programatically:
- `bestzip test.zip 'sourcefile; mkdir folder'`
- `zip({ source: 'sourcefile', destination: './test.zip; mkdir folder' })`
Vulnerability: GHSA-x8f7-h444-97w4
Summary: The installation wizard in DotNetNuke (DNN) allows privilege escalation
Aliases: CVE-2015-2794
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-10-16T19:33:42Z

The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Vulnerability: GHSA-j3mj-fhpq-qqjj
Summary: Reachable Assertion in Tensorflow
Aliases: CVE-2022-23571
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-09T23:28:57Z

### Impact
When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments, if the tensors have an invalid `dtype` and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes.

### Patches
We have patched the issue in GitHub commit [5b491cd5e41ad63735161cec9c2a568172c8b6a3](https://github.com/tensorflow/tensorflow/commit/5b491cd5e41ad63735161cec9c2a568172c8b6a3).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. 
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-r8hm-w5f7-wj39
Summary: Cross-site scripting vulnerability in TinyMCE plugins
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-64, CWE-79
Published: 2021-11-02T15:42:52Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the `image` and `link` plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.10.0 or higher
- Disable the `image` and `link` plugins

### Acknowledgements
Tiny Technologies would like to thank Yakir6 for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
Vulnerability: GHSA-5645-gc7h-98h8
Summary: Malicious Package in react-dates-sc
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:32:07Z

Version 0.3.0 of `react-dates-sc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.3.0 of this module is found installed you will want to replace it with a version before or after 0.3.0. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-2548-q746-x5x6
Summary: Code injection in port-killer
Aliases: CVE-2021-23359
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-77
Published: 2021-04-13T15:20:49Z

This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
Vulnerability: GHSA-vqgp-4jgj-5j64
Summary: Low severity vulnerability that affects py-evm
Aliases: CVE-2018-18920
Severity: HIGH
CVSS score: 8.8
CWE: CWE-119
Published: 2018-11-21T22:23:04Z

Py-EVM v0.2.0-alpha.33 allows attackers to make a vm.execute_bytecode call that triggers computation._stack.values with '"stack": [100, 100, 0]' where b'\x' was expected, resulting in an execution failure because of an invalid opcode. This is reportedly related to "smart contracts can be executed indefinitely without gas being paid."
Vulnerability: GHSA-64g7-mvw6-v9qj
Summary: Improper Privilege Management in shelljs
Severity: MODERATE
CVSS score: 0
CWE: CWE-269
Published: 2022-01-14T21:09:50Z

### Impact
Output from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user.

Other shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted.

### Patches
Patched in shelljs 0.8.5

### Workarounds
Recommended action is to upgrade to 0.8.5.

### References
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/

### For more information
If you have any questions or comments about this advisory:
* Ask at https://github.com/shelljs/shelljs/issues/1058
* Open an issue at https://github.com/shelljs/shelljs/issues/new
Vulnerability: GHSA-mpcf-4gmh-23w8
Summary: Regular Expression Denial of Service in forwarded
Aliases: CVE-2017-16118
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:16:30Z

Affected versions of `forwarded` are vulnerable to regular expression denial of service when parsing specially crafted user input.


## Recommendation

Update to version 0.1.2 or later
Vulnerability: GHSA-q44r-f2hm-v76v
Summary: Moderate severity vulnerability that affects puppet
Aliases: CVE-2012-3867
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:37Z

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
Vulnerability: GHSA-wx8q-rgfr-cf6v
Summary: Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
Aliases: CVE-2021-22565
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-732, CWE-1220
Published: 2021-11-10T18:20:11Z

### Impact
Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID.

### Patches
v1.1.2+

### Workarounds
There are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time (thus the UUID rotates frequently).

### For more information
Contact exposure-notifications-feedback@google.com
Vulnerability: GHSA-6fpp-rgj9-8rwc
Summary: Deserialization of untrusted data in FasterXML jackson-databind
Aliases: CVE-2019-14379
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2019-08-01T19:18:00Z

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Vulnerability: GHSA-rpch-cqj9-h65r
Summary: High severity vulnerability that affects YamlDotNet and YamlDotNet.Signed
Aliases: CVE-2018-1000210
Severity: HIGH
CVSS score: 7.8
CWE: CWE-502, CWE-639
Published: 2018-10-16T17:01:10Z

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.
Vulnerability: GHSA-pp57-mqmh-44h7
Summary: Command Injection in macaddress
Aliases: CVE-2018-13797
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2018-09-06T23:24:21Z

All versions of `macaddress` are vulnerable to command injection. For this vulnerability to be exploited an attacker needs to control the `iface` argument to the `one` method.


## Recommendation

Update to version 0.2.9 or later.
Vulnerability: GHSA-6834-r92f-jj42
Summary: Moderate severity vulnerability that affects actionview
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:55:54Z

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Vulnerability: GHSA-f52g-6jhx-586p
Summary: Denial of Service in handlebars
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2020-09-03T23:20:12Z

Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 4.4.5 or later.
Vulnerability: GHSA-m87f-39q9-6f55
Summary: Sensitive Auth & Cookie data stored in Jupyter server logs
Aliases: CVE-2022-24758
Severity: HIGH
CVSS score: 7.5
CWE: CWE-532
Published: 2022-04-05T17:47:26Z

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.

Upgrade to notebook version 6.4.10

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: @3coins for reporting. Thank you!
Vulnerability: GHSA-6vrv-94jv-crrg
Summary: Context isolation bypass via Promise in Electron
Aliases: CVE-2020-15096
Severity: LOW
CVSS score: 6.8
CWE: CWE-501
Published: 2020-07-07T00:01:05Z

### Impact
Apps using `contextIsolation` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`
* `6.1.11`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-m9jm-rhrm-gcxj
Summary: Path traversal in org.springframework.integration:spring-integration-zip
Aliases: CVE-2018-1261
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-22
Published: 2018-10-18T18:05:46Z

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Vulnerability: GHSA-84p2-vf58-xhxv
Summary: Billion laughs attack in c3p0
Aliases: CVE-2019-5427
Severity: HIGH
CVSS score: 7.5
CWE: CWE-776
Published: 2019-04-23T16:03:18Z

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
Vulnerability: GHSA-2fch-jvg5-crf6
Summary: Moderate severity vulnerability that affects python-gnupg
Aliases: CVE-2019-6690
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-03-25T16:17:53Z

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
Vulnerability: GHSA-3288-cwgw-ch86
Summary: Unchecked Return Value in xcb
Aliases: CVE-2021-26955
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-252
Published: 2021-08-25T20:53:22Z

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
Vulnerability: GHSA-xmr7-v725-2jjr
Summary: XSS in comrak
Aliases: CVE-2021-27671
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-25T20:52:12Z

An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
Vulnerability: GHSA-92vm-wfm5-mxvv
Summary: Timing Attack in cookie-signature
Aliases: CVE-2016-1000236
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-362
Published: 2020-01-06T18:44:10Z

Affected versions of `cookie-signature` are vulnerable to timing attacks as a result of using a fail-early comparison instead of a constant-time comparison. 

Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.

Under favorable network conditions, an attacker can exploit this to guess the secret in no more than `charset*length` guesses, instead of `charset^length` guesses required were the timing attack not present. 



## Recommendation

Update to 1.0.6 or later.
Vulnerability: GHSA-28gr-86hg-r48w
Summary: Unauthenticated Remote Command Injection in ep_imageconvert
Aliases: CVE-2013-3364
Severity: HIGH
CVSS score: 8.2
CWE: CWE-77
Published: 2020-08-31T22:43:31Z

ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert <= 0.0.2 is vulnerable to remote command injection.

Authentication is not required for remote exploitation.


## Recommendation

Update to version 0.0.3 or greater.
Vulnerability: GHSA-9qgm-w87q-hx89
Summary: Unrestricted Upload of File with Dangerous Type in Strapi
Aliases: CVE-2022-27263
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2022-04-13T00:00:25Z

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
Vulnerability: GHSA-85g2-29m8-qf2p
Summary: Prototype Pollution Vulnerability in object-collider
Aliases: CVE-2021-25914
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-03-19T21:18:33Z

Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-vrmr-f2qh-3hhf
Summary: Improper use of cryptographic key in wal-g
Aliases: CVE-2021-38599
Severity: HIGH
CVSS score: 7.5
CWE: CWE-922
Published: 2021-09-02T17:17:16Z

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."
Vulnerability: GHSA-g6j2-ch25-5mmv
Summary: Missing Token Replay Detection in Saml2 Authentication services for ASP.NET
Aliases: CVE-2020-5261
Severity: HIGH
CVSS score: 8.2
CWE: CWE-294
Published: 2020-03-25T16:52:49Z

### Impact
Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented. 

Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use.

### Patches
The 2.5.0 version is patched.

### Workarounds
There are no workarounds with existing versions. Fixing the issue requires code updates.

### References
https://en.wikipedia.org/wiki/Replay_attack

### For more information
If you have any questions or comments about this advisory:
* Comment on #711.
* Email us at [security@sustainsys.com](mailto:security@susatinsys.com) if you think that there are further security issues.
Vulnerability: GHSA-8q59-q68h-6hv4
Summary: Improper Input Validation in PyYAML
Aliases: CVE-2020-14343
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2021-03-25T21:26:26Z

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
Vulnerability: GHSA-prqf-xr2j-xf65
Summary: Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`
Severity: LOW
CVSS score: 0
CWE: CWE-285
Published: 2021-08-23T19:41:41Z

### Impact

This is pro-active fix. No know exploits exist. 

Impacted:

* You're running Kubernetes >= v1.19
* You're running Argo Server
* It is configured to with `--auth-mode=client`
* Is not configured with `--auth-mode=server`
* You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.
* You're using client key to authenticate on the server. 
* The server has more permissions that the connecting client's account.

The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.

### Patches

https://github.com/argoproj/argo-workflows/pull/6506

### Workarounds

None.
Vulnerability: GHSA-vx6v-2rg6-865h
Summary: Cross-site Scripting in django-js-reverse
Aliases: CVE-2019-15486
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-27T17:39:33Z

django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.
Vulnerability: GHSA-f4jh-ww96-9h9j
Summary: Netflix/Priam: Temporary Directory Information Disclosure
Aliases: CVE-2021-28100
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-377
Published: 2021-03-30T16:23:12Z

### Impact

When `File.createTempFile` creates a file, the permissions on that file are -rw-r--r--. This means that other users can read the contents of these files after they are written, although they can not modify the contents. This allows for local information disclosure if these files contain sensitive information.

Vulnerable locations:
 - https://github.com/Netflix/Priam/blob/362660bb7ebddb0cfa756a282d94678f65af9f06/priam/src/main/java/com/netflix/priam/backup/MetaData.java#L106-L111
 - https://github.com/Netflix/Priam/blob/362660bb7ebddb0cfa756a282d94678f65af9f06/priam/src/main/java/com/netflix/priam/identity/DoubleRing.java#L109-L118
 - https://github.com/Netflix/Priam/blob/362660bb7ebddb0cfa756a282d94678f65af9f06/priam/src/main/java/com/netflix/priam/restore/PostRestoreHook.java#L80-L86

---

The custom CodeQL queries leveraged to find these this as well as their results can be found here:

https://lgtm.com/query/1543383251073929777/
https://lgtm.com/query/3142895023158674709/

## Official Disclosure

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2021-002.md

## Fix

There are no fixed versions.
Vulnerability: GHSA-hwhq-3hrj-v6v5
Summary: Hijacked Environment Variables in cross-env.js
Aliases: CVE-2017-16081
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2020-09-01T19:00:54Z

The `cross-env.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-8ch4-58qp-g3mp
Summary: Observable Timing Discrepancy in aaugustin websockets library
Aliases: CVE-2021-33880
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-208, CWE-203
Published: 2021-06-11T17:43:14Z

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Vulnerability: GHSA-88xx-23mf-rcj2
Summary: Malicious Package in bs-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:51:52Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-668q-qrv7-99fm
Summary: Deserialization of Untrusted Data in logback
Aliases: CVE-2021-42550
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-502
Published: 2021-12-17T20:00:50Z

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Vulnerability: GHSA-67mp-pcv9-vvq6
Summary: Malicious Package in jr-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:57:14Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-2v82-5746-vwqc
Summary: XSS in doc_link
Aliases: CVE-2021-29625
Severity: HIGH
CVSS score: 7.5
CWE: CWE-79
Published: 2022-03-18T17:49:28Z

### Impact
Users of MySQL, MariaDB, PgSQL and SQLite are affected. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected.

### Patches
Patched by 4043092, included in version [4.8.1](https://github.com/vrana/adminer/releases/tag/v4.8.1).

### Workarounds
Do both:
* Use browser supporting strict CSP.
* Enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).

### References
https://sourceforge.net/p/adminer/bugs-and-features/797/

### For more information
If you have any questions or comments about this advisory:
* Comment at 4043092.
Vulnerability: GHSA-r8j5-h5cx-65gg
Summary: ReDOS in IS-SVG
Aliases: CVE-2021-29059
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2021-12-10T19:02:37Z

A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.
Vulnerability: GHSA-fgfm-hqjw-3265
Summary: Out-of-bounds Write in actix-web
Aliases: CVE-2018-25025
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2022-01-06T22:18:46Z

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.