TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-6fvw-7vch-x489
Summary: Downloads Resources over HTTP in selenium-portal
Aliases: CVE-2016-10667
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:36Z

Affected versions of `selenium-portal` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-portal`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-gjqc-q9g6-q2j3
Summary: `CHECK`-failures in binary ops in Tensorflow
Aliases: CVE-2022-23583
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-10T00:34:13Z

### Impact
A malicious user can cause a denial of service by altering a `SavedModel` such that [any binary op](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/cwise_ops_common.h#L88-L137) would trigger `CHECK` failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the `dtype` no longer matches the `dtype` expected by the op. In that case, calling the templated binary operator for the binary op would receive corrupted data, due to the type confusion involved:

```cc
functor::BinaryFunctor<Device, Functor, 1>()(
    eigen_device, out->template flat<Tout>(),
    input_0.template flat<Tin>(), input_1.template flat<Tin>(),
    error_ptr);
```
If `Tin` and `Tout` don't match the type of data in `out` and `input_*` tensors then `flat<*>` would interpret it wrongly. In most cases, this would be a silent failure, but we have noticed scenarios where this results in a `CHECK` crash, hence a denial of service.

### Patches
We have patched the issue in GitHub commit [a7c02f1a9bbc35473969618a09ee5f9f5d3e52d9](https://github.com/tensorflow/tensorflow/commit/a7c02f1a9bbc35473969618a09ee5f9f5d3e52d9).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-mq5p-2mcr-m52j
Summary: Code injection in nbgitpuller
Aliases: CVE-2021-39160
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2021-08-30T16:17:06Z

### Impact

Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.

### Patches

0.10.2

### Workarounds

None, other than upgrade to 0.10.2 or downgrade to 0.8.x.


### For more information

If you have any questions or comments about this advisory:

* Open an issue in [nbgitpuller](https://github.com/jupyterhub/nbgitpuller/issues)
* Email our security team at [security@ipython.org](mailto:security@ipython.org)
Vulnerability: GHSA-rg3m-hqc5-344v
Summary: `SparseFillEmptyRows` heap OOB
Aliases: CVE-2021-41224
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-11-10T18:45:55Z

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L194-L241) of `SparseFillEmptyRows` can be made to trigger a heap OOB access:

```python
import tensorflow as tf
  
data=tf.raw_ops.SparseFillEmptyRows(
  indices=[[0,0],[0,0],[0,0]],
  values=['sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss'],
  dense_shape=[5,3],
  default_value='o')
```
  
This occurs whenever the size of `indices` does not match the size of `values`.

### Patches
We have patched the issue in GitHub commit [67bfd9feeecfb3c61d80f0e46d89c170fbee682b](https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-vf7p-j8x6-xvwp
Summary: Incorrect Authorization in Apache Solr
Aliases: CVE-2021-29943
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-863
Published: 2021-05-10T15:17:58Z

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.
Vulnerability: GHSA-qh54-9vc5-m9fg
Summary: MD5 hash support in github.com/foxcpp/maddy
Severity: LOW
CVSS score: 3
CWE: CWE-261
Published: 2021-10-12T16:06:30Z

### Impact

This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module
and an extremely outdated system that still allows MD5 hashes in 
/etc/shadows.

### Patches

Patch is available as part of the 0.5.2 release.

### Workarounds

Ensure MD5 hashes are not present in /etc/shadow.
Vulnerability: GHSA-gc52-xj6p-9pxp
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Aliases: CVE-2019-3868
Severity: MODERATE
CVSS score: 3.8
CWE: CWE-200
Published: 2019-04-30T15:37:21Z

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.
Vulnerability: GHSA-xpgc-j48j-jwv9
Summary: Cross-site Scripting in Keycloak
Aliases: CVE-2021-20323
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-26T00:00:31Z

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak version 15. The issue was fixed in version 17.0.0.
Vulnerability: GHSA-2xmm-g482-4439
Summary: DQL injection through sorting parameters blocked
Aliases: CVE-2022-24752
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-03-15T19:09:16Z

### Impact
Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

### Patches
The issue is fixed in version 1.10.1 and in 1.11-rc.1

### Workarounds

You have to overwrite your `Sylius\Component\Grid\Sorting\Sorter.php` class:

```php
<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}
```
and register it in your container: 

```yaml
# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-rxch-gp62-574w
Summary: snipe-it is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4108
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2021-12-16T14:13:27Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-73qr-pfmq-6rp8
Summary: Embedded malware in coa
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2021-11-04T16:22:28Z

The npm package `coa` had versions published with malicious code. Users of affected versions (2.0.3 and above) should downgrade to 2.0.2 as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/veged/coa/issues/99) for details as they unfold.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-r4r9-mgjc-g6q3
Summary: Path Traversal in 626
Aliases: CVE-2018-3727
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T19:06:15Z

All versions of `626` are vulnerable to path traversal. This enables a remote attacker to read arbitrary files from the remote server using this module.


## Recommendation

No fix is currently available for this vulnerability.
It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-44cw-p2hm-gpf6
Summary: Disabled Hostname Verification in Opencast
Aliases: CVE-2020-26234
Severity: HIGH
CVSS score: 4.8
CWE: CWE-297
Published: 2020-12-08T22:37:59Z

Opencast before version 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests.

Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks.

### Patches

This problem is fixed in Opencast 7.9 and Opencast 8.9

### Self-Signed Certificates

Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate e.g. from [Let's Encrypt](https://letsencrypt.org).
Vulnerability: GHSA-hggv-mcp4-vxc5
Summary: Improper Authentication in FreeTAKServer
Aliases: CVE-2022-25508
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-400
Published: 2022-03-12T00:00:37Z

FreeTAKServer is an open source, lightweight Server for connect TAK clients. An access control issue in the component /ManageRoute/postRoute of FreeTAKServer version 1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users. There is currently no known workaround. This issue was fixed in version 1.9.8.5.
Vulnerability: GHSA-g9wf-393q-4w38
Summary: Malicious Package in only-test-not-install
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:28:26Z

All versions of `only-test-not-install` contain malicious code. The package deletes the folder `~/test` from the system as a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.
Vulnerability: GHSA-vc9j-fhvv-8vrf
Summary: Remote Code Execution in scratch-vm
Aliases: CVE-2020-14000
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-07-27T19:55:52Z

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. 
NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.
Vulnerability: GHSA-xwxc-j97j-84gf
Summary: Race condition in Parc
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:03Z

In the affected versions of this crate, `LockWeak<T>` unconditionally implemented `Send` with no trait bounds on `T`. `LockWeak<T>` doesn't own `T` and only provides `&T`.

This allows concurrent access to a non-Sync `T`, which can cause undefined behavior like data races.
Vulnerability: GHSA-rxq3-5249-8hgg
Summary: Validation bypass vulnerability 
Severity: LOW
CVSS score: 0
Published: 2020-09-09T17:29:41Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-gq9m-qvpx-68hc
Summary: Insufficient Entropy in werkzeug
Aliases: CVE-2019-14806
Severity: HIGH
CVSS score: 7.5
CWE: CWE-331
Published: 2019-08-21T16:15:24Z

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Vulnerability: GHSA-fj59-f6c3-3vw4
Summary: Command Injection in systeminformation
Aliases: CVE-2020-26300
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-78
Published: 2020-10-27T20:40:00Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.26.2

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to `is.services()`, `is.inetChecksite()`, `si.inetLatency()`, `si.networkStats()`, `is.services()` and `si.processLoad()`

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation)
Vulnerability: GHSA-m8fw-534v-xm85
Summary: Cross-Site Scripting (XSS) in cloudcmd
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-06-04T15:43:29Z

Versions of `cloudcmd` before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable.


## Recommendation

Update to version 9.1.6 or later.
Vulnerability: GHSA-mf7c-58q5-7v65
Summary: Downloads Resources over HTTP in npm-test-sqlite3-trunk
Aliases: CVE-2016-10695
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:15:28Z

Affected versions of `npm-test-sqlite3-trunk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `npm-test-sqlite3-trunk`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-6qvp-r6r3-9p7h
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2018-14404
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2019-01-17T14:05:03Z

A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Vulnerability: GHSA-42f2-f9vc-6365
Summary: Private key leak in Apache CXF
Aliases: CVE-2019-12423
Severity: HIGH
CVSS score: 7.5
CWE: CWE-522
Published: 2020-05-22T19:23:04Z

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter `rs.security.keystore.type` to `jwk`. For this case all keys are returned in this file &quot;as is&quot;, including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. `oct` keys, which contain secret keys, are not returned at all.
Vulnerability: GHSA-7v3x-h7r2-34jv
Summary: Insufficient Session Expiration in Pterodactyl API
Severity: MODERATE
CVSS score: 6
CWE: CWE-613
Published: 2022-01-21T18:43:05Z

### Impact
A vulnerability exists in Pterodactyl Panel `<= 1.6.6` that could allow a malicious attacker that compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to remain logged in as the user the key belonged to.

It is important to note that **a malicious user must first compromise an existing API key for a user to exploit this issue**. It cannot be exploited by chance, and requires a coordinated attack against an individual account using a known API key.

### Patches
This issue has been addressed in the `v1.7.0` release of Pterodactyl Panel.

### Workarounds
Those not wishing to upgrade may apply the change below:

```diff
diff --git a/app/Http/Middleware/Api/AuthenticateKey.php b/app/Http/Middleware/Api/AuthenticateKey.php
index eb25dac6..857bfab2 100644
--- a/app/Http/Middleware/Api/AuthenticateKey.php
+++ b/app/Http/Middleware/Api/AuthenticateKey.php
@@ -70,7 +70,7 @@ class AuthenticateKey
         } else {
             $model = $this->authenticateApiKey($request->bearerToken(), $keyType);

-            $this->auth->guard()->loginUsingId($model->user_id);
+            $this->auth->guard()->onceUsingId($model->user_id);
         }
```

### For more information
If you have any questions or comments about this advisory please reach out to `Tactical Fish#8008` on [Discord](https://discord.gg/pterodactyl) or email `dane@pterodactyl.io`.
Vulnerability: GHSA-vmm6-w4cf-7f3x
Summary: Authentication Bypass For Endpoints With Anonymous Access in Opencast
Aliases: CVE-2020-5206
Severity: CRITICAL
CVSS score: 8.7
CWE: CWE-285
Published: 2020-01-30T21:21:30Z

### Impact

Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access.

This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication.


### Patches

This problem is fixed in Opencast 7.6 and Opencast 8.1


### Workarounds

As a workaround for older, unpatched versions, disabling remember-me cookies in `etc/security/mh_default_org.xml` will mitigate the problem but will obviously also disable this feature without obvious indication. To deactivate this, remove the following line from the security configuration:

```xml
<sec:remember-me … />
```

### References

- [Remember-me cookie in the security configuration file](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)


### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-785x-qw4v-6872
Summary: Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible
Aliases: CVE-2020-14330
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-116, CWE-117
Published: 2022-02-09T22:00:08Z

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
Vulnerability: GHSA-9rr6-jpg7-9jg6
Summary: Authentication Bypass by Capture-replay in Apache Spark
Aliases: CVE-2021-38296
Severity: HIGH
CVSS score: 7.5
CWE: CWE-294
Published: 2022-03-11T00:02:36Z

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later
Vulnerability: GHSA-6pj2-5fqq-xvjc
Summary: Incorrect Authorization in latte/latte
Aliases: CVE-2021-23803
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-863
Published: 2022-01-06T20:56:27Z

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.
Vulnerability: GHSA-9w4w-cpc8-h2fq
Summary: Exposure of Sensitive Information to an Unauthorized Actor in httpie
Aliases: CVE-2022-24737
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2022-03-07T23:44:28Z

### Impact
HTTPie have the practical concept of [sessions](https://httpie.io/docs/cli/sessions), which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. As an example, we can make an authenticated request and save it to a [named session](https://httpie.io/docs/cli/named-sessions) called `api`:

```bash
$ http --session api -a user:pass pie.dev/basic-auth/user/pass
```

```json
{
    "authenticated": true,
    "user": "user"
}
```

Since we have now saved the authentication data to that session, we won‘t have to enter it again and again on every invocation. We can simply reference the session, and HTTPie will use the saved state directly from it:

```bash
$ http --session api pie.dev/basic-auth/user/pass
```

```json
{
    "authenticated": true,
    "user": "user"
}
```

One particular use case of these sessions is storing cookies (commonly referred to as a `Cookie Jar`). If a response has a `Set-Cookie`
header, HTTPie will parse it and store the actual cookie in the session. And from that point on, all outgoing requests will attach that cookie (in the form of a `Cookie` header).

This is extremely useful, especially when you are dealing with websites which manage their own state on the client-side through cookies.

```bash
$ http -F --session jar pie.dev/cookies/set/x/y
```

```json
{
    "cookies": {
        "x": "y"
    }
}
```

Before `3.1.0`, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website, e.g:

```bash
$ http -F --session jar pie.dev/redirect-to url==https://httpbin.org/cookies
```

(Pre 3.1.0)
```json
{
    "cookies": {
        "x": "y"
    }
}
```

(Post 3.1.0)
```json
{
    "cookies": {}
}
```

This behavior has been corrected in this release (with taking [RFC 6265 — HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc6265) into the consideration).

A huge credit goes to [@Glyph](https://github.com/glyph) for disclosing the original vulnerability to us (through [huntr.dev](http://huntr.dev/)).

### Patches
We suggest users to upgrade their HTTPie version to `3.1.0` or higher, and run `httpie cli sessions upgrade` command on their sessions.

### For more information
If you have any questions or comments about this advisory:
* Email us: [`security@httpie.io`](mailto:security@httpie.io)

> Please note that this entry is covered by both [CVE-2022-24737](https://www.cvedetails.com/cve/CVE-2022-24737) and [CVE-2022-0430](https://nvd.nist.gov/vuln/detail/CVE-2022-0430).
Vulnerability: GHSA-g5w6-mrj7-75h2
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39141
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502
Published: 2021-08-25T14:48:31Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39141](https://x-stream.github.io/CVE-2021-39141.html).

### Credits
Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-7hpj-hfcr-5qwm
Summary: Code injection in FreeIPA
Aliases: CVE-2019-14867
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94, CWE-400
Published: 2021-12-06T18:17:38Z

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
Vulnerability: GHSA-pw54-mh39-w3hc
Summary: Regular expression denial of service in npm-user-validate
Aliases: CVE-2020-7754
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-10T19:08:15Z

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Vulnerability: GHSA-h97g-4mx7-5p2p
Summary: Open Redirect in apostrophe
Severity: MODERATE
CVSS score: 0
CWE: CWE-601
Published: 2020-09-03T17:11:36Z

Versions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end.



## Recommendation

Update to version 2.92.0 or later.
Vulnerability: GHSA-mm8j-9x84-m9cv
Summary: Arbitrary code injection in json-sanitizer
Aliases: CVE-2021-23899
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2021-06-16T17:34:18Z

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
Vulnerability: GHSA-3357-829x-m9pr
Summary: Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-spring2
Aliases: CVE-2015-5175
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-10-18T16:57:00Z

Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
Vulnerability: GHSA-8p8g-f9vg-r7xr
Summary: Moderate severity vulnerability that affects com.squareup.retrofit2:retrofit
Aliases: CVE-2018-1000850
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-12-21T17:48:19Z

Square Retrofit versions from (including) 2.0 to 2.5.0 (excluding) contain a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter. By manipulating the URL an attacker could add or delete resources otherwise unavailable to her. This attack appears to be exploitable via an encoded path parameter on POST, PUT or DELETE request. This vulnerability appears to have been fixed in 2.5.0 and later.
Vulnerability: GHSA-pjjf-hc4q-g298
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3775
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-11-15T23:16:17Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-5w4p-h4gm-3w26
Summary: Downloads Resources over HTTP in jser-stat
Aliases: CVE-2016-10592
Severity: MODERATE
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:50:53Z

Affected versions of `jser-stat` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rwv8-jvff-jq28
Summary: Path Traversal in public
Aliases: CVE-2018-3731
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-18T21:20:30Z

Versions of `public` before 0.1.3 are vulnerable to path traversal. This is due to lack of file path sanitization which could lead to any file the parent process has access to on the server to be read by malicious user.


## Recommendation

Update to version 0.1.3 or later.
Vulnerability: GHSA-3j6g-hxx5-3q26
Summary: Observable Discrepancy in Apache Kafka
Aliases: CVE-2021-38153
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-203
Published: 2021-09-23T23:18:58Z

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Vulnerability: GHSA-rgq8-25qc-h54q
Summary: Directory Traversal in myserver.alexcthomas18
Aliases: CVE-2017-16144
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:48:05Z

Affected versions of `myserver.alexcthomas18` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-5pr9-v234-jw36
Summary: Remote Code Execution via traversal in TAL expressions
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-22
Published: 2021-06-18T18:44:01Z

### Impact
Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use.

By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk.

### Patches
The problem has been fixed in Zope 5.2 and 4.6.

### Workarounds
A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Zope issue tracker](https://github.com/zopefoundation/Zope/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-52rh-5rpj-c3w6
Summary: Improper handling of multiline messages in node-irc
Severity: HIGH
CVSS score: 0
Published: 2022-05-05T16:00:50Z

node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel.
The vulnerability has been patched in node-irc version 1.2.1.
Vulnerability: GHSA-8m28-w6xg-35hw
Summary: Cross-Site Request Forgery (CSRF) in livehelperchat
Aliases: CVE-2022-0231
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2022-01-26T20:22:08Z

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-vpc2-7xmf-ppmf
Summary: Out-of-bounds Write in ChakraCore
Aliases: CVE-2020-17048
Severity: HIGH
CVSS score: 8.1
CWE: CWE-787
Published: 2021-08-02T17:26:11Z

Chakra Scripting Engine Memory Corruption Vulnerability This CVE ID is unique from CVE-2020-17054.
Vulnerability: GHSA-5hj3-vjjf-f5m7
Summary: Heap OOB in `SdcaOptimizerV2`
Aliases: CVE-2021-37672
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2021-08-25T14:41:39Z

### Impact
An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.SdcaOptimizerV2`:

```python
import tensorflow as tf
  
tf.raw_ops.SdcaOptimizerV2(
  sparse_example_indices=[[1]],
  sparse_feature_indices=[[1]],
  sparse_feature_values=[[1.0,2.0]],
  dense_features=[[1.0]],
  example_weights=[1.0],
  example_labels=[],
  sparse_indices=[1],
  sparse_weights=[1.0],
  dense_weights=[[1.0]],
  example_state_data=[[100.0,100.0,100.0,100.0]],
  loss_type='logistic_loss',
  l1=100.0,
  l2=100.0,
  num_loss_partitions=1,
  num_inner_iterations=1,
  adaptive=True)       
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/sdca_internal.cc#L320-L353) does not check that the length of `example_labels` is the same as the number of examples.

### Patches
We have patched the issue in GitHub commit [a4e138660270e7599793fa438cd7b2fc2ce215a6](https://github.com/tensorflow/tensorflow/commit/a4e138660270e7599793fa438cd7b2fc2ce215a6).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-7r5f-7qr4-pf6q
Summary: Sandbox Breakout / Arbitrary Code Execution in notevil
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T19:03:33Z

Versions of `notevil` prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the `Function` constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading to the Sandbox Escape. An example payload is:  
```
var safeEval = require('notevil')
var input = "" + 
"function fn() {};" + 
"var constructorProperty = Object.getOwnPropertyDescriptors(fn.__proto__).constructor;" + 
"var properties = Object.values(constructorProperty);" + 
"properties.pop();" + 
"properties.pop();" + 
"properties.pop();" + 
"var Function = properties.pop();" + 
"(Function('return this'))()"; 
safeEval(input)```


## Recommendation

Upgrade to version 1.3.2 or later.
Vulnerability: GHSA-7g2w-6r25-2j7p
Summary: Command Injection in libnmap
Aliases: CVE-2018-16461
Severity: MODERATE
CVSS score: 0
CWE: CWE-77
Published: 2018-11-01T14:51:33Z

Versions of `libnmap` before 0.4.16 are vulnerable to command injection. 

Proof of concept

```
const nmap = require('libnmap');
const opts = {
    range: [
        'scanme.nmap.org',
        "x.x.$(touch success.txt)"
    ]
};
nmap.scan(opts, function(err, report) {
    if (err) throw new Error(err);

    for (let item in report) {
        console.log(JSON.stringify(report[item]));
    }
});
```


## Recommendation

Update to version 0.4.16 or later
Vulnerability: GHSA-j4ch-mw66-xmqv
Summary: Malicious Package in pensi-scheduler
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:16:44Z

Version 1.1.3 of `pensi-scheduler` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-72hm-fx78-xwhc
Summary: XSS vulnerability on contacts view
Aliases: CVE-2021-27911
Severity: HIGH
CVSS score: 8.3
CWE: CWE-79
Published: 2021-09-01T18:40:40Z

### Impact
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc. 

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-wwmf-6p58-6vj2
Summary: High severity vulnerability that affects rwiki
Aliases: CVE-2006-2582
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:38Z

The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors.
Vulnerability: GHSA-hfg5-xpvw-c9x4
Summary: Improper Input Validation in Apache Camel
Aliases: CVE-2020-11971
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-05-21T19:20:30Z

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel users should upgrade to 3.2.0.
Vulnerability: GHSA-p493-635q-r6gr
Summary: Remote code execution via the `pretty` option.
Aliases: CVE-2021-21353
Severity: HIGH
CVSS score: 6.8
CWE: CWE-74
Published: 2021-03-03T02:03:52Z

### Impact

If a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.

### Patches

Upgrade to `pug@3.0.1` or `pug-code-gen@3.0.2` or `pug-code-gen@2.0.3`, which correctly sanitise the parameter.

### Workarounds

If there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

### References


Original report: https://github.com/pugjs/pug/issues/3312

### For more information

If you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)
Vulnerability: GHSA-gj76-429m-56wc
Summary: Deserialization of Untrusted Data in Apache Olingo
Aliases: CVE-2019-17556
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-02-04T22:38:22Z

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
Vulnerability: GHSA-h48w-c35p-6m8x
Summary: Out-of-bounds Write in Play Framework
Aliases: CVE-2020-27196
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2022-02-10T20:23:25Z

An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a StackOverflowError and Denial of Service.
Vulnerability: GHSA-7jh9-6cpf-h4m7
Summary: XSS in hello.js
Aliases: CVE-2020-7741
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2021-01-13T19:07:01Z

This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
Vulnerability: GHSA-3m2r-q8x3-xmf7
Summary: Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv
Severity: MODERATE
CVSS score: 0
Published: 2018-10-16T19:59:48Z

Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where
a specially crafted request can cause excess resource consumption in Kestrel.
Vulnerability: GHSA-j3g9-6fx5-gjv7
Summary: Inadequate Encryption Strength in DotNetNuke
Aliases: CVE-2018-18325
Severity: HIGH
CVSS score: 7.5
CWE: CWE-326
Published: 2019-07-05T21:08:16Z

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Vulnerability: GHSA-3h2h-xqr2-2jp7
Summary: Cross-site Scripting (XSS) in Apache ActiveMQ Artemis
Aliases: CVE-2020-13932
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-09T22:14:01Z

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
Vulnerability: GHSA-9jp8-cwwx-p64q
Summary: XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Severity: MODERATE
CVSS score: 0
Published: 2021-12-01T18:28:38Z

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.