TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-mg98-x2cm-4cpf
Summary: Out-of-bounds write
Aliases: CVE-2019-1106
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:15Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1092, CVE-2019-1103, CVE-2019-1107.
Vulnerability: GHSA-rfx6-vp9g-rh7v
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2017-17485
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-18T17:42:48Z

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.
Vulnerability: GHSA-pgq6-ccqj-hpqr
Summary:  Elasticsearch privilege escalation issue
Aliases: CVE-2022-23708
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-269
Published: 2022-03-04T00:00:15Z

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index. Users running a cluster on an affected version that had previously been upgraded from 6.x, should upgrade to 7.17.1. Users that are planning to upgrade from 6.x should not perform an upgrade from 6.x to versions 7.16 through 7.17.0 and should use 7.17.1+ for upgrades from 6.x.
Vulnerability: GHSA-vhfr-v4w9-45v8
Summary: Improper Input Validation in renderdoc
Aliases: CVE-2019-16142
Severity: HIGH
CVSS score: 9.8
CWE: CWE-20
Published: 2021-08-25T20:44:51Z

An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable reference, which is incompatible with a multi-threaded application.
Vulnerability: GHSA-h24p-2c3m-5qf4
Summary: Malicious Package in owl-orchard-apple-sunshine
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:23:23Z

All versions of `owl-orchard-apple-sunshine` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-8w54-22w9-3g8f
Summary: Cross-site Scripting and Open Redirect in Products.CMFPlone
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-79
Published: 2022-01-28T23:10:40Z

### Impact
Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.
The technique is known as cache poisoning.
Any later visitor can get redirected when clicking on a link on this page.
Usually only anonymous users are affected, but this depends on your cache settings.

### Patches
No patch is available for the Products.CMFPlone 4 series.
Versions 5.0 and higher are not affected, but two other packages used by these versions are affected.

`plone.app.contenttypes` has the same problem in all versions, see [advisory](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x).
In Plone 5.0-5.2, the default Products.ATContentTypes version has the same problem. See [advisory](https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh).
Plone 5.2.7 and 6.0.0a3 will be released today and will include these fixes.

For all unpatched versions of the three packages, you can use the following workaround.

### Workaround
Make sure the image_view_fullscreen page is not stored in the cache.
In Plone:

* Login as Manager and go to Site Setup.
* Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable.
* Click on the tab 'Caching operations'.
* Under 'Legacy template mappings' locate the ruleset 'Content item view'.
* From the last column ('Templates')  remove 'image_view_fullscreen'.
* Click on Save.

### Reporter
This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!

### For more information
If you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org)
This is also the correct address to use when you want to report a possible vulnerability.
See [our security report policy](https://plone.org/security/report).
Vulnerability: GHSA-mpvw-25mg-59vx
Summary: Server-side Request Forgery (SSRF) via img tags in reportlab
Aliases: CVE-2020-28463
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-918
Published: 2021-03-29T16:32:27Z

All versions of package reportlab at time of writing are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF
Vulnerability: GHSA-pf2j-9qmp-jqr2
Summary: SQL Injection and MAID in TypeORM
Aliases: CVE-2020-8158
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89, CWE-471
Published: 2021-05-07T16:46:42Z

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
Vulnerability: GHSA-pccm-j6vj-jwwf
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0962
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-15T00:00:54Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.webma` file upload.
Vulnerability: GHSA-pq2f-3fg3-rw99
Summary: SQL Injection in WordPress Zero Spam WordPress plugin
Aliases: CVE-2022-0254
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-03-15T00:00:57Z

The WordPress Zero Spam WordPress plugin before 5.2.13 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Vulnerability: GHSA-4p4p-www8-8fv9
Summary: Reference binding to null in `ParameterizedTruncatedNormal`
Aliases: CVE-2021-29568
Severity: LOW
CVSS score: 2.5
CWE: CWE-824
Published: 2021-05-21T14:25:19Z

### Impact
An attacker can trigger undefined behavior by binding to null pointer in `tf.raw_ops.ParameterizedTruncatedNormal`:

```python
import tensorflow as tf
    
shape = tf.constant([], shape=[0], dtype=tf.int32)
means = tf.constant((1), dtype=tf.float32)
stdevs = tf.constant((1), dtype=tf.float32)
minvals = tf.constant((1), dtype=tf.float32)
maxvals = tf.constant((1), dtype=tf.float32)
  
tf.raw_ops.ParameterizedTruncatedNormal(
  shape=shape, means=means, stdevs=stdevs, minvals=minvals, maxvals=maxvals)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/3f6fe4dfef6f57e768260b48166c27d148f3015f/tensorflow/core/kernels/parameterized_truncated_normal_op.cc#L630) does not validate input arguments before accessing the first element of `shape`:

```cc
int32 num_batches = shape_tensor.flat<int32>()(0);
``` 

If `shape` argument is empty, then `shape_tensor.flat<T>()` is an empty array.

### Patches
We have patched the issue in GitHub commit [5e52ef5a461570cfb68f3bdbbebfe972cb4e0fd8](https://github.com/tensorflow/tensorflow/commit/5e52ef5a461570cfb68f3bdbbebfe972cb4e0fd8).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-wq8f-46ww-6c2h
Summary: Integer underflow in untrusted
Aliases: CVE-2018-20989
Severity: HIGH
CVSS score: 7.5
CWE: CWE-191
Published: 2021-08-25T20:43:49Z

An issue was discovered in the untrusted crate before 0.6.2 for Rust. Error handling can trigger an integer underflow and panic.
Vulnerability: GHSA-8qfc-cvjp-mgpq
Summary: Moderate severity vulnerability that affects org.apache.ignite:ignite-core
Aliases: CVE-2016-6805
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-611
Published: 2018-10-16T20:53:31Z

Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.
Vulnerability: GHSA-86mr-6m89-vgj3
Summary: Buffer Overflow in node-weakauras-parser
Severity: MODERATE
CVSS score: 0
CWE: CWE-120
Published: 2020-09-03T15:51:38Z

Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems.


## Recommendation

Upgrade to versions 1.0.5, 2.0.2, 3.0.1 or later.
Vulnerability: GHSA-v4cr-m5f8-gxw8
Summary: yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4092
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-12-16T14:14:56Z

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-m86m-5m44-pc93
Summary: Denial of Service in grpc-ts-health-check
Severity: LOW
CVSS score: 0
Published: 2020-09-03T19:05:46Z

Versions of `grpc-ts-health-check` prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status.


## Recommendation

Upgrade to version 2.0.0 or later.
Vulnerability: GHSA-2jhm-qp48-hv5j
Summary: Missing authorization in xwiki-platform
Aliases: CVE-2022-23621
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-862
Published: 2022-02-09T21:56:05Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString:

```
$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")
```

### Patches

It has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-18870

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-7w8j-85wm-6xfq
Summary: Prototype Pollution in jquery-bbq
Aliases: CVE-2021-20086
Severity: HIGH
CVSS score: 8.8
CWE: CWE-1321
Published: 2021-05-24T19:51:58Z

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
Vulnerability: GHSA-2ww3-fxvq-293j
Summary: Inefficient Regular Expression in nltk
Aliases: CVE-2021-3828
Severity: HIGH
CVSS score: 7.5
CWE: CWE-697, CWE-1333
Published: 2021-09-29T17:14:53Z

nltk is contains an Inefficient Regular Expression and is vulnerable to regular expression denial of service attacks.
Vulnerability: GHSA-m8rp-q82r-c5mf
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0278
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-21T18:06:49Z

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-qj3v-q2vj-4c8h
Summary: Calculation error in ark-r1cs-std
Aliases: CVE-2021-38194
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-682
Published: 2021-08-25T20:55:58Z

An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified.
Vulnerability: GHSA-93jq-624g-4p9p
Summary: Moderate severity vulnerability that affects org.asynchttpclient:async-http-client
Aliases: CVE-2017-14063
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-10-19T16:50:50Z

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. Similar bugs were previously identified in cURL (CVE-2016-8624) and Oracle Java 8 java.net.URL.
Vulnerability: GHSA-46q2-93hm-52p5
Summary: Directory Traversal in serverlyr
Aliases: CVE-2017-16089
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:53:37Z

Affected versions of `serverlyr` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-282f-qqgm-c34q
Summary: Prototype Pollution in node-jsonpointer
Aliases: CVE-2021-23807
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:44:45Z

This affects the package `jsonpointer` before `5.0.0`. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
Vulnerability: GHSA-m34j-p8rj-wjxq
Summary: Division by 0 in `QuantizedBiasAdd`
Aliases: CVE-2021-29546
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:23:28Z

### Impact
An attacker can trigger an integer division by zero undefined behavior in `tf.raw_ops.QuantizedBiasAdd`:

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.quint8)
bias = tf.constant([], shape=[0], dtype=tf.quint8)
min_input = tf.constant(-10.0, dtype=tf.float32)
max_input = tf.constant(-10.0, dtype=tf.float32)
min_bias = tf.constant(-10.0, dtype=tf.float32)
max_bias = tf.constant(-10.0, dtype=tf.float32)

tf.raw_ops.QuantizedBiasAdd(input=input_tensor, bias=bias, min_input=min_input,
                            max_input=max_input, min_bias=min_bias,
                            max_bias=max_bias, out_type=tf.qint32)
```

This is because the [implementation of the Eigen kernel](https://github.com/tensorflow/tensorflow/blob/61bca8bd5ba8a68b2d97435ddfafcdf2b85672cd/tensorflow/core/kernels/quantization_utils.h#L812-L849) does a division by the number of elements of the smaller input (based on shape) without checking that this is not zero:

```cc
template <typename T1, typename T2, typename T3>
void QuantizedAddUsingEigen(const Eigen::ThreadPoolDevice& device,
                            const Tensor& input, float input_min,
                            float input_max, const Tensor& smaller_input,
                            float smaller_input_min, float smaller_input_max,
                            Tensor* output, float* output_min,
                            float* output_max) {
  ...
  const int64 input_element_count = input.NumElements();
  const int64 smaller_input_element_count = smaller_input.NumElements();
  ...
  bcast[0] = input_element_count / smaller_input_element_count;
  ...
}
```

This integral division by 0 is undefined behavior.

### Patches
We have patched the issue in GitHub commit [67784700869470d65d5f2ef20aeb5e97c31673cb](https://github.com/tensorflow/tensorflow/commit/67784700869470d65d5f2ef20aeb5e97c31673cb).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-x3g3-jh26-76cf
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0375
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2022-01-28T23:06:00Z

LiveHelperChat is vulnerable to Stored XSS at the Name field in the Admin themes of System configuration.
Vulnerability: GHSA-j336-34q7-cgj3
Summary: Downloads Resources over HTTP in healthcenter
Aliases: CVE-2016-10684
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:06Z

Affected versions of `healthcenter` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `healthcenter`.


## Recommendation

This package has been deprecated, and moved to a new package on npm: [`appmetrics`](https://npmjs.com/package/appmetrics).

In order to mitigate this vulnerability, please install the `appmetrics` package in place of `healthcenter` via the following commands:
```
npm uninstall healthcenter -s
npm install appmetrics -s
```
Vulnerability: GHSA-p3rp-vmj9-gv6v
Summary: Incorrect sanitisation function leads to `XSS` in mermaid
Aliases: CVE-2021-43861
Severity: HIGH
CVSS score: 7.2
CWE: CWE-20, CWE-79
Published: 2022-01-06T19:45:59Z

### Impact
Malicious diagrams can contain javascript code that can be run at diagram readers machines.

### Patches
The users should upgrade to version 8.13.8

### Workarounds
You need to upgrade in order to avoid this issue.
Vulnerability: GHSA-2j9c-9vmv-7m39
Summary: Missing anchor in Rack-Cors allows malicious third party site to perform CORS request
Aliases: CVE-2017-11173
Severity: HIGH
CVSS score: 8.8
Published: 2018-07-31T18:18:39Z

Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
Vulnerability: GHSA-6hgr-2g6q-3rmc
Summary: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-287
Published: 2021-04-22T16:11:26Z

`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

- https://vaadin.com/security/cve-2021-31408
Vulnerability: GHSA-fh37-cx83-q542
Summary: Improper Authentication in Apache Airflow
Aliases: CVE-2021-26697
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-287, CWE-269
Published: 2021-06-18T18:30:11Z

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue only affects Apache Airflow 2.0.0.
Vulnerability: GHSA-j66f-h9hm-975m
Summary: Unrestricted Upload of File with Dangerous Type in Umbraco CMS
Aliases: CVE-2020-9472
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-434
Published: 2021-08-02T17:38:56Z

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
Vulnerability: GHSA-gw97-f6h8-gm94
Summary: Email relay in Apache Traffic Control
Aliases: CVE-2021-42009
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20
Published: 2021-10-13T18:55:04Z

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
Vulnerability: GHSA-m5pj-vjjf-4m3h
Summary: Arbitrary Code Execution in grunt
Aliases: CVE-2020-7729
Severity: HIGH
CVSS score: 7.1
CWE: CWE-1188
Published: 2021-05-06T18:27:18Z

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Vulnerability: GHSA-686f-ch3r-xwmh
Summary: Data races in unicycle
Aliases: CVE-2020-36436
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:58:17Z

Affected versions of this crate unconditionally implemented `Send` & `Sync` for types `PinSlab<T>` & `Unordered<T, S>`. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads.

This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within `PinSlab<T>` or `Unordered<T, S>` and accessed concurrently from multiple threads.

The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound `T: Send` to `Send` impls for `PinSlab<T>` & `Unordered<T, S>` and adding `T: Sync` to `Sync` impls for `PinSlab<T>` & `Unordered<T, S>`.
Vulnerability: GHSA-x64g-4xx9-fh6x
Summary: Denial of Service in Cryptacular
Aliases: CVE-2020-7226
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2020-06-10T20:02:58Z

CiphertextHeader.java in Cryptacular before 1.2.4, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with &quot;new byte&quot; may depend on untrusted input within the header of encoded data.
Vulnerability: GHSA-9mxw-4856-9cm5
Summary: Data races in rusb
Aliases: CVE-2020-36206
Severity: HIGH
CVSS score: 7
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:50:51Z

An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.
Vulnerability: GHSA-6xc2-mj39-q599
Summary: Privilege Escalation in strapi
Aliases: CVE-2019-18818
Severity: HIGH
CVSS score: 9.8
CWE: CWE-640
Published: 2019-12-02T18:20:41Z

Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.


## Recommendation

Upgrade to version 3.0.0-beta.17.5 or later.
Vulnerability: GHSA-vc89-hccf-rq55
Summary: Hash collision in typelevel jawn
Aliases: CVE-2022-21653
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-326, CWE-400
Published: 2022-01-06T23:48:35Z

### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
Vulnerability: GHSA-r6fw-8m27-43c9
Summary: Command injection in portkiller
Aliases: CVE-2021-23379
Severity: HIGH
CVSS score: 7.3
CWE: CWE-77
Published: 2021-05-06T15:53:20Z

This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-pvmx-g8h5-cprj
Summary: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
Aliases: CVE-2021-41164
Severity: HIGH
CVSS score: 8.2
CWE: CWE-79
Published: 2021-11-17T21:55:10Z

### Affected packages
The vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 Advanced Content Filter (ACF) core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.17.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Maurice Dauer ([laytonctf](https://twitter.com/laytonctf)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-xqfj-35wv-m3cr
Summary: Null pointer dereference in `StringNGrams`
Aliases: CVE-2021-29541
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:23:12Z

### Impact
An attacker can trigger a dereference of a null pointer in `tf.raw_ops.StringNGrams`:

```python
import tensorflow as tf

data=tf.constant([''] * 11, shape=[11], dtype=tf.string)

splits = [0]*115
splits.append(3)
data_splits=tf.constant(splits, shape=[116], dtype=tf.int64)

tf.raw_ops.StringNGrams(data=data, data_splits=data_splits, separator=b'Ss',
                        ngram_widths=[7,6,11],
                        left_pad='ABCDE', right_pad=b'ZYXWVU',
                        pad_width=50, preserve_short_sequences=True)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/1cdd4da14282210cc759e468d9781741ac7d01bf/tensorflow/core/kernels/string_ngrams_op.cc#L67-L74) does not fully validate the `data_splits` argument. This would result in [`ngrams_data`](https://github.com/tensorflow/tensorflow/blob/1cdd4da14282210cc759e468d9781741ac7d01bf/tensorflow/core/kernels/string_ngrams_op.cc#L106-L110) to be a null pointer when the output would be computed to have 0 or negative size.

Later writes to the output tensor would then cause a null pointer dereference.

### Patches
We have patched the issue in GitHub commit [ba424dd8f16f7110eea526a8086f1a155f14f22b](https://github.com/tensorflow/tensorflow/commit/ba424dd8f16f7110eea526a8086f1a155f14f22b).
    
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-pcwq-7wrw-r8jv
Summary: Cross-site Scripting in intelliants/subrion
Aliases: CVE-2020-18325
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
Vulnerability: GHSA-5h5r-23r4-m87h
Summary: Cross-Site Scripting in gitbook
Aliases: CVE-2017-16019
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T16:04:39Z

Affected versions of `gitbook` do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.


## Recommendation

Update to version 3.2.2 or later.
Vulnerability: GHSA-39vw-qp34-rmwf
Summary: Uncontrolled recursion leads to abort in deserialization
Severity: MODERATE
CVSS score: 0
CWE: CWE-674
Published: 2021-08-25T21:00:18Z

Affected versions of this crate did not properly check for recursion
while deserializing aliases.

This allows an attacker to make a YAML file with an alias referring
to itself causing an abort.

The flaw was corrected by checking the recursion depth.
Vulnerability: GHSA-63rq-p8fp-524q
Summary: Potential API key leak
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2021-04-13T15:12:06Z

If a user is actively blackholing the location or weather APIs, or those APIs become otherwise unavailable, it is possible for the API keys to get leaked to the active IRC channel.

This is patched in v1.2.4
Vulnerability: GHSA-jf2m-435m-mxw8
Summary: High severity vulnerability that affects org.apache.hive:hive-jdbc
Aliases: CVE-2018-1282
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-89
Published: 2018-11-21T22:24:34Z

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
Vulnerability: GHSA-6vx5-cg2p-7g5v
Summary: Unrestricted Upload of File with Dangerous Type in microweber
Aliases: CVE-2022-0912
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-434
Published: 2022-03-12T00:00:35Z

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-hpf7-4c2g-9chf
Summary: Remote Code Execution in Halibut
Aliases: CVE-2021-31819
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-09-23T23:17:07Z

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
Vulnerability: GHSA-ccw5-7vfh-p5hm
Summary: Directory Traversal in dmmcquay.lab6
Aliases: CVE-2017-16208
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:14:15Z

Affected versions of `dmmcquay.lab6` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fjqr-fx3f-g4rv
Summary: Electron protocol handler browser vulnerable to Command Injection
Aliases: CVE-2018-1000118
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2018-03-26T16:41:20Z

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
Vulnerability: GHSA-3p8f-j2vw-7hw9
Summary: Hijacked Environment Variables in mssql-node
Aliases: CVE-2017-16059
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-11-09T17:43:44Z

The `mssql-node` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this module is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-v7q4-97x4-4qw2
Summary:  Use of Uninitialized Resource in truetype
Aliases: CVE-2021-28030
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2021-08-25T20:51:58Z

An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.
Vulnerability: GHSA-x5x2-mfc7-r22f
Summary: Directory Traversal in picard
Aliases: CVE-2017-16194
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:40:20Z

Affected versions of `picard` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rg32-m3hf-772v
Summary: Deserialization of Untrusted Data in Slanger
Aliases: CVE-2019-1010306
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-07-16T00:41:40Z

Slanger 0.6.0 is affected by Remote Code Execution (RCE). The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
Vulnerability: GHSA-fr6q-jv7j-35g3
Summary: Path Traversal in w-zip
Aliases: CVE-2022-0401
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2022-02-02T00:01:46Z

Path Traversal in NPM w-zip prior to 1.0.12.
Vulnerability: GHSA-jc43-qrrp-98f5
Summary: Insert tag injection in the Contao login module
Aliases: CVE-2019-19714
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-116
Published: 2019-12-17T22:53:40Z

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. It is possible to inject insert tags into the login module which will be replaced when the page is rendered. It is recommended to update to Contao 4.8.6. There are currently no known workarounds at this time.
Vulnerability: GHSA-3wh2-2pp3-2823
Summary: Malicious Package in simple-alipay
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:35:18Z

Version 1.0.1 of `simple-alipay` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.1 of this module is found installed you will want to replace it with a version before or after 1.0.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-j77q-2qqg-6989
Summary: High severity vulnerability that affects org.apache.struts:struts2-core
Aliases: CVE-2017-5638
Severity: CRITICAL
CVSS score: 10
CWE: CWE-20
Published: 2018-10-18T19:24:26Z

The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
Vulnerability: GHSA-pf38-cw3p-22q9
Summary: Keycloak is vulnerable to IDN homograph attack
Aliases: CVE-2021-3424
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-287
Published: 2022-04-28T21:00:21Z

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
Vulnerability: GHSA-374m-jm66-3vj8
Summary: Heap OOB in `SparseBinCount`
Aliases: CVE-2021-41226
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-11-10T18:41:47Z

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/bincount_op.cc#L353-L417) of `SparseBinCount` is vulnerable to a heap OOB:

```python
import tensorflow as tf
  
  
tf.raw_ops.SparseBincount(
  indices=[[0],[1],[2]]
  values=[0,-10000000]
  dense_shape=[1,1]
  size=[1]
  weights=[3,2,1]
  binary_output=False)
```

This is because of missing validation between the elements of the `values` argument and the shape of the sparse output:


```cc
for (int64_t i = 0; i < indices_mat.dimension(0); ++i) {
  const int64_t batch = indices_mat(i, 0);
  const Tidx bin = values(i);
  ...
  out(batch, bin) = ...;
}
```

### Patches
We have patched the issue in GitHub commit [f410212e373eb2aec4c9e60bf3702eba99a38aba](https://github.com/tensorflow/tensorflow/commit/f410212e373eb2aec4c9e60bf3702eba99a38aba).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-gfp2-w5jm-955q
Summary: OMERO.web exposes some unnecessary session information in the page
Aliases: CVE-2021-21376
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2021-03-23T15:26:34Z

### Background
OMERO.web loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. Some additional information being loaded is not used by the webclient and is being removed in this release.

### Impact
OMERO.web before 5.9.0

### Patches
5.9.0

### Workarounds
No workaround

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [omero-web](https://github.com/ome/omero-web)
* Email us at [security](mailto:security@openmicroscopy.org.uk)
Vulnerability: GHSA-8h2f-7jc4-7m3m
Summary: Open Redirect in urijs
Aliases: CVE-2022-0868
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-03-07T00:00:40Z

urijs prior to version 1.19.10 is vulnerable to open redirect. This is the result of a bypass for the fix to CVE-2022-0613.
Vulnerability: GHSA-qjhr-c23f-w76q
Summary: Inline JS XSS vulnerability in Mautic
Aliases: CVE-2017-1000488
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-01-19T21:16:24Z

### Impact

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

### Patches
Upgrade to 2.12.0 or later.

### Workarounds
None

### References
https://github.com/mautic/mautic/releases/tag/2.12.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-5557-j87h-cvf4
Summary: Missing Authorization in jenkins xray-connector
Aliases: CVE-2021-21653
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2021-06-16T17:29:26Z

Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability: GHSA-9crf-c6qr-r273
Summary: Integer division by 0 in `tf.raw_ops.AllToAll`
Aliases: CVE-2021-41218
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-11-10T18:52:24Z

### Impact
The [shape inference code for `AllToAll`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/tpu_cross_replica_ops.cc#L25-L74) can be made to execute a division by 0:

```python
import tensorflow as tf
  
@tf.function
def func():
  return tf.raw_ops.AllToAll(
    input=[0.0, 0.1652, 0.6543],
    group_assignment=[1, -1],
    concat_dimension=0,
    split_dimension=0,
    split_count=0)

func()
```

This occurs whenever the `split_count` argument is 0:
  
```cc
TF_RETURN_IF_ERROR(c->GetAttr("split_count", &split_count));
...                  
for (int32_t i = 0; i < rank; ++i) {      
  ...                                     
  dims[i] = c->MakeDim(c->Value(dims[i]) / split_count);
  ...                
}
```

### Patches
We have patched the issue in GitHub commit [a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc](https://github.com/tensorflow/tensorflow/commit/a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-p93v-m2r2-4387
Summary: Denial of service via insufficient metadata validation
Severity: MODERATE
CVSS score: 0
Published: 2022-03-01T21:05:01Z

The PAM module for `fscrypt` through v0.3.2 doesn't adequately validate `fscrypt` metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a `fscrypt` metadata file that prevents other users from logging into the system. We recommend upgrading to v0.3.3 or above.

For more details, see [CVE-2022-25327](https://www.cve.org/CVERecord?id=CVE-2022-25327).
Vulnerability: GHSA-jfgq-g48x-jq83
Summary: Downloads Resources over HTTP in iedriver
Aliases: CVE-2016-10562
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:20Z

Affected versions of `iedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `iedriver`.


## Recommendation

Update to iedriver version 3.0.0 or greater.
Vulnerability: GHSA-4cx9-7xqc-2jxm
Summary: Reflected cross-site scripting in francoisjacquet/rosariosis
Aliases: CVE-2020-13278
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-06T18:54:48Z

Reflected Cross-Site Scripting vulnerability in Modules.php in RosarioSIS Student Information System < 6.5.1 allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in a GET request.
Vulnerability: GHSA-hpw7-3vq3-mmv6
Summary: Insecure deserialization in Wire
Aliases: CVE-2021-29508
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-502
Published: 2021-05-19T23:02:38Z

Due to how Wire handles type information in its serialization format, malicious payloads can be passed to a deserializer. e.g. using a surrogate on the sender end, an attacker can pass information about a different type for the receiving end. And by doing so allowing the serializer to create any type on the deserializing end.

**This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300?view=vs-2019**

This also applies to the fork of Wire, AkkaDotNet/Hyperion.
Vulnerability: GHSA-jpxj-vgq5-prjc
Summary: OS command execution vulnerability in Docker Commons Plugin
Aliases: CVE-2022-20617
Severity: HIGH
CVSS score: 0
CWE: CWE-78
Published: 2022-01-13T00:01:03Z

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.
Vulnerability: GHSA-8p52-7cxv-6c95
Summary: Downloads Resources over HTTP in curses
Aliases: CVE-2016-10615
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:56:47Z

Affected versions of `curses` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `curses`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-v542-8q9x-cffc
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2020-35681
Severity: HIGH
CVSS score: 7.4
CWE: CWE-200
Published: 2021-03-19T21:29:02Z

Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.