TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-v9w8-hq92-v39m
Summary: Cross-site Scripting (XSS) in baserCMS
Aliases: CVE-2021-20683
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-08T20:10:45Z

Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Vulnerability: GHSA-2p68-f74v-9wc6
Summary: Unintended unmarshalling in ActiveSupport
Aliases: CVE-2020-8165
Severity: HIGH
CVSS score: 0
CWE: CWE-502
Published: 2020-05-26T14:49:24Z

In ActiveSupport, there is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the `raw: true` parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

```
data = cache.fetch("demo", raw: true) { untrusted_string }
```
Versions Affected:  rails < 5.2.5, rails < 6.0.4
Not affected:       Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the `raw` option when storing untrusted user input.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1
  
Impact
------
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling `Rails.cache.fetch` they are using consistent values of the `raw` parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds
-----------
It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the `raw` argument should be double-checked to ensure that they conform to the expected format.
Vulnerability: GHSA-5hxw-r847-qfwp
Summary: Moderate severity vulnerability that affects opencv.js
Aliases: CVE-2017-16066
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:47:07Z

opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.
Vulnerability: GHSA-4q2r-qxp6-h5j6
Summary: Improper Restriction of XML External Entity Reference in Quokka
Aliases: CVE-2020-18705
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2021-08-30T16:25:18Z

XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.
Vulnerability: GHSA-gppp-5xc5-wfpx
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2013-0155
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:37Z

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Vulnerability: GHSA-rjhc-w3fj-j6x9
Summary: Malicious Package in alipayjsapi
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:32:45Z

All versions of `alipayjsapi` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-893h-35v4-mxqx
Summary: Path Traversal in Ansible
Aliases: CVE-2020-1737
Severity: MODERATE
CVSS score: 7.8
CWE: CWE-22
Published: 2021-04-20T16:43:33Z

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Vulnerability: GHSA-hxjf-h2mh-r6hj
Summary: Use After Free in libpulse-binding
Aliases: CVE-2018-25027
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:20:12Z

An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free.
Vulnerability: GHSA-86wf-436m-h424
Summary: Resource Exhaustion Denial of Service in http-proxy-agent 
Aliases: CVE-2019-10196
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-665
Published: 2022-01-06T20:30:13Z

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
Vulnerability: GHSA-gmq2-39ff-f5qg
Summary: A failed upgrade may lead to hung goroutines
Severity: LOW
CVSS score: 0
Published: 2021-05-21T16:25:48Z

### Impact
Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade.

The Go runtime has annoying behaviour around setting and clearing
O_NONBLOCK: exec.Cmd.Start() ends up calling os.File.Fd() for any
file in exec.Cmd.ExtraFiles. os.File.Fd() disables both the use
of the runtime poller for the file and clears O_NONBLOCK from
the underlying open file descriptor.

This can lead to goroutines hanging in a parent process, after at least
one failed upgrade. The bug manifests in goroutines which rely on
either a deadline or interruption via Close() to be unblocked being stuck
in read or accept like syscalls. As far as I can tell we've not experienced
this problem in production, so it's most likely quite rare.

### Patches
The problem has been fixed in v1.2.2.

### Workarounds
None.

### References
* https://github.com/cloudflare/tableflip/commit/cae714b289e199db5da5f08af861ea65be6232c0
Vulnerability: GHSA-2mqv-4j3r-vjvp
Summary: Open redirect in @auth0/nextjs-auth0
Aliases: CVE-2021-43812
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-601
Published: 2021-12-16T18:52:21Z

### Overview

Versions `<=1.6.1` do not filter out certain `returnTo` parameter values from the login url, which expose the application to an open redirect vulnerability.

### Am I affected?
You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `<=1.6.1`.

### How to fix that?
Upgrade to version `>=1.6.2`

### Will this update impact my users?
The fix provided in the patch will not affect your users.
Vulnerability: GHSA-j9wj-26p5-fj2v
Summary: Directory Traversal in gaoxuyan
Aliases: CVE-2017-16153
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:17:29Z

Affected versions of `gaoxuyan` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cvw2-xj8r-mjf7
Summary: Activerecord-session_store Timing Attack
Aliases: CVE-2019-25025
Severity: MODERATE
CVSS score: 0
CWE: CWE-208
Published: 2021-03-09T00:45:31Z

The `activerecord-session_store` (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782. 

## Recommendation

This has been fixed in version 2.0.0.  All users are advised to update to this version or later.
Vulnerability: GHSA-87v6-crgm-2gfj
Summary: Division by zero in Tensorflow
Aliases: CVE-2022-21735
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-369
Published: 2022-02-10T00:21:32Z

### Impact 
The [implementation of `FractionalMaxPool`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_max_pool_op.cc#L36-L192) can be made to crash a TensorFlow process via a division by 0:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.FractionalMaxPool(
  value=tf.constant(value=[[[[1, 4, 2, 3]]]], dtype=tf.int64),
  pooling_ratio=[1.0, 1.44, 1.73, 1.0],
  pseudo_random=False,
  overlapping=False,
  deterministic=False,
  seed=0,
  seed2=0,
  name=None)
```

### Patches
We have patched the issue in GitHub commit [ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb](https://github.com/tensorflow/tensorflow/commit/ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-mf27-wg66-m8f5
Summary: A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.
Aliases: CVE-2020-35210
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2021-12-17T20:41:09Z

A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.
Vulnerability: GHSA-vfvf-6gx5-mqv6
Summary: Incorrect Authorization in ORY Oathkeeper
Aliases: CVE-2021-32701
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863
Published: 2021-06-24T20:16:02Z

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid. A patch will be released with `v0.38.12-beta.1`. Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist. The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes. The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.
Vulnerability: GHSA-f6px-w8rh-7r89
Summary: Data race in Beego
Aliases: CVE-2019-16354
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362, CWE-732
Published: 2021-08-02T17:15:05Z

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
Vulnerability: GHSA-hx7j-43w2-7rj7
Summary: Prototype pollution in nconf-toml
Aliases: CVE-2021-25946
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-06-07T22:12:13Z

Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-9vxv-wpv4-f52p
Summary: Information leakage in Error Handler
Severity: MODERATE
CVSS score: 0
CWE: CWE-209
Published: 2021-05-21T14:29:33Z

### Impact
Information leakage in Error Handler

### Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
Vulnerability: GHSA-pxqr-8v54-m2hj
Summary: Moderate severity vulnerability that affects rails_admin
Aliases: CVE-2016-10522
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2018-08-08T22:30:35Z

rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request forgery (CSRF) attacks. Non-GET methods were not validating CSRF tokens and, as a result, an attacker could hypothetically gain access to the application administrative endpoints exposed by the gem.
Vulnerability: GHSA-97jg-43c9-q6pf
Summary: Unauthenticated user can retrieve the list of users through uorgsuggest.vm
Aliases: CVE-2022-24819
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-359
Published: 2022-04-08T21:53:38Z

A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
Vulnerability: GHSA-2ppp-9496-p23q
Summary: Insufficient Entropy in Spring Security
Aliases: CVE-2020-5408
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-329, CWE-330
Published: 2020-06-15T19:34:31Z

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Vulnerability: GHSA-fp5j-3fpf-mhj5
Summary: Sensitive data written to disk unencrypted in Spark
Aliases: CVE-2019-10099
Severity: HIGH
CVSS score: 7.5
CWE: CWE-312
Published: 2019-08-08T15:18:22Z

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Vulnerability: GHSA-7r96-8g3x-g36m
Summary: Improper Verification of Cryptographic Signature
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2021-06-28T17:16:56Z

### Impact
The `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature of a SHA-512 hash matching the SHA-512 hash of the message even if the signature is invalid.

### Patches
Upgrade to `v7.0.3` immediately to resolve this issue. Since the vulnerability lies within the verification method, the previous signatures are still valid. We highly recommend reverifying any signatures that were previously verified with the vulnerable `verifyWithMessage` method.

### Workarounds
In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`. For example, the return statement should start with `return this.verify(signed, password).verified && ` instead of `return this.verify(signed, password) && `.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/TogaTech/tEnvoy](https://github.com/TogaTech/tEnvoy)
Vulnerability: GHSA-p694-23q3-rvrc
Summary: Remote Code Execution in Apache Synapse
Aliases: CVE-2017-15708
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74, CWE-502
Published: 2020-11-04T18:23:25Z

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
Vulnerability: GHSA-rhrq-64mq-hf9h
Summary: FPE in TFLite division operations
Aliases: CVE-2021-37683
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:40:16Z

### Impact
The implementation of division in TFLite is [vulnerable to a division by 0 error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/div.cc)

There is no check that the divisor tensor does not contain zero elements.

### Patches
We have patched the issue in GitHub commit [1e206baedf8bef0334cca3eb92bab134ef525a28](https://github.com/tensorflow/tensorflow/commit/1e206baedf8bef0334cca3eb92bab134ef525a28).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-2wr2-8qjq-gh55
Summary: Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search
Aliases: CVE-2021-23264
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-402, CWE-668
Published: 2021-12-16T15:27:35Z

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
Vulnerability: GHSA-mc84-xr9p-938r
Summary: High severity vulnerability that affects generator-jhipster
Severity: HIGH
CVSS score: 8.1
CWE: CWE-829, CWE-494
Published: 2019-09-23T18:31:05Z

## Generated code uses repository configuration that downloads over HTTP instead of HTTPS

### Impact
Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time.

### Patches

Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1.
If you are not able to upgrade make sure not to use a Maven repository via `http` in your build file.

### Workarounds

Replace all custom repository definitions in `build.gradle` or `pom.xml` with their `https` version.

e.g.

```xml
 <repository>
            <id>oss.sonatype.org-snapshot</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url> // <-- must be httpS
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
</repository>
```

```gradle
maven { url "https://repo.spring.io/plugins-release" } // <-- must be httpS
```

### References
* https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/jhipster/generator-jhipster/issues](https://github.com/jhipster/generator-jhipster/issues)
Vulnerability: GHSA-2hwp-g4g7-mwwj
Summary: Reflected Cross-Site Scripting in jquery.terminal
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2019-05-29T20:25:35Z

Versions of `jquery.terminal` prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options `anyLinks` or `invokeMethods` set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization.


## Recommendation

Upgrade to version 1.21.0 or later
Vulnerability: GHSA-44m4-9cjp-j587
Summary: IBX-1392: Image filenames sanitization
Severity: HIGH
CVSS score: 0
Published: 2022-01-21T23:24:14Z

ezsystems/ezpublish-kernel versions 7.5.* before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files.
Vulnerability: GHSA-r33q-22hv-j29q
Summary: Denial of service in github.com/ethereum/go-ethereum
Aliases: CVE-2020-26264
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2021-06-29T21:14:07Z

### Impact

A DoS vulnerability can make a LES server crash via malicious `GetProofsV2` request from a connected LES client.

### Patches

The vulnerability was patched in https://github.com/ethereum/go-ethereum/pull/21896. 

### Workarounds

This vulnerability only concerns users explicitly enabling `les` server; disabling `les` prevents the exploit. 
It can also be patched by manually applying the patch in https://github.com/ethereum/go-ethereum/pull/21896. 


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-qxjq-v4wf-ppvh
Summary: Out of bounds read in dync
Aliases: CVE-2020-35903
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2021-08-25T20:49:47Z

An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question.
Vulnerability: GHSA-9hfg-pxr6-q4vp
Summary: Use of a Broken or Risky Cryptographic Algorithm in crypto2
Aliases: CVE-2021-45709
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-327
Published: 2022-01-06T22:04:51Z

An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an unaligned read of a u32 may occur.
Vulnerability: GHSA-v98j-7crc-wvrj
Summary: Authentication bypass in Apache Shiro
Aliases: CVE-2020-17523
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2022-02-09T22:03:57Z

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Vulnerability: GHSA-rvg8-pwq2-xj7q
Summary: Out-of-bounds Read in base64url
Severity: MODERATE
CVSS score: 0
CWE: CWE-125
Published: 2020-09-01T20:42:44Z

Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.


## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-9wrq-xvmp-xjc8
Summary: High severity vulnerability that affects rails.
Aliases: CVE-2006-4112
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:38Z

Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or "data loss," a different vulnerability than CVE-2006-4111.
Vulnerability: GHSA-c56f-grv3-gpfr
Summary: Regular expression denial of service in forms
Aliases: CVE-2021-23388
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-06-07T22:10:13Z

The package forms before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.
Vulnerability: GHSA-7qw8-847f-pggm
Summary: Improper Locking in github.com/containers/storage
Aliases: CVE-2021-20291
Severity: HIGH
CVSS score: 6.5
CWE: CWE-667, CWE-400
Published: 2021-05-10T19:35:07Z

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
Vulnerability: GHSA-58p8-9g59-q2hr
Summary: Potential DOS attack due to unrestricted attachment count in messages
Aliases: CVE-2019-12406
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-770
Published: 2019-11-08T17:15:11Z

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Vulnerability: GHSA-2pwf-xwr3-hp55
Summary: Moderate severity vulnerability that affects actionview
Severity: MODERATE
CVSS score: 0
Published: 2018-08-13T20:48:52Z

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
Vulnerability: GHSA-4hfc-fv33-ph9p
Summary: Malicious Package in sj-tw-abc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:26:33Z

All versions of `sj-tw-abc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-8fg4-j562-mjrc
Summary: Low severity vulnerability that affects apache-airflow
Aliases: CVE-2017-15720
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2019-01-25T16:19:01Z

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
Vulnerability: GHSA-hvmf-r92r-27hr
Summary: Django allows unintended model editing
Aliases: CVE-2019-19118
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-276
Published: 2019-12-04T21:26:28Z

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)
Vulnerability: GHSA-27xw-p8v6-9jjr
Summary: Moderate severity vulnerability that affects org.springframework.security:spring-security-core
Aliases: CVE-2018-15801
Severity: HIGH
CVSS score: 7.4
CWE: CWE-345
Published: 2018-12-20T22:01:31Z

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.
Vulnerability: GHSA-c7vg-w8q8-c3wf
Summary: Session Fixation
Aliases: CVE-2021-32710
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-384
Published: 2021-09-08T18:00:20Z

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-5w74-jx7m-x6hv
Summary: XSS vulnerability in theme config file in Mautic
Aliases: CVE-2018-8071
Severity: LOW
CVSS score: 6.1
CWE: CWE-79
Published: 2021-01-19T21:16:17Z

### Impact
Mautic before v2.13.0 has stored XSS via a theme config file.

### Patches
Update to 2.13.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-rggc-4g3r-j7ff
Summary: Remote Code Execution in Contao Managed Edition
Aliases: CVE-2022-26265
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2022-03-20T00:00:30Z

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
Vulnerability: GHSA-ccmq-qvcp-5mrm
Summary: Critical severity vulnerability that affects owlmixin
Aliases: CVE-2017-16618
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-07-13T16:01:12Z

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A "Load YAML" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Vulnerability: GHSA-v6fq-q792-j46j
Summary: Improper Input Validation in Apache Unomi
Aliases: CVE-2020-11975
Severity: HIGH
CVSS score: 9.8
CWE: CWE-20
Published: 2022-02-09T23:20:47Z

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Vulnerability: GHSA-vhvh-528q-ff3p
Summary: Security feature bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated
Aliases: CVE-2018-8171
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2018-10-16T19:56:50Z

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.
Vulnerability: GHSA-65q2-x652-xx84
Summary: Downloads Resources over HTTP in dalek-browser-ie
Aliases: CVE-2016-10605
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:50:04Z

Affected versions of `dalek-browser-ie` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-ie`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-h4x4-5qp2-wp46
Summary: Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Aliases: CVE-2018-1000873
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2018-12-21T17:46:54Z

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Databind that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Vulnerability: GHSA-jgrh-5m3h-9c5f
Summary: Web Cache Poisoning in find-my-way
Aliases: CVE-2020-7764
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-444
Published: 2020-11-09T22:17:13Z

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.
Vulnerability: GHSA-44gg-pmqr-4669
Summary: Access Restriction Bypass in Docker
Aliases: CVE-2014-6408
Severity: MODERATE
CVSS score: 0
CWE: CWE-285
Published: 2022-02-15T01:57:18Z

Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.
Vulnerability: GHSA-hrjm-c879-pp86
Summary: Side-channel timing attack in libsecp256k1
Aliases: CVE-2019-25003
Severity: HIGH
CVSS score: 7.5
CWE: CWE-208
Published: 2021-08-25T20:46:46Z

An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. Scalar::check_overflow allows a timing side-channel attack; consequently, attackers can obtain sensitive information.
Vulnerability: GHSA-m3f9-w3p3-p669
Summary: Heap buffer overflow in `QuantizedMul`
Aliases: CVE-2021-29535
Severity: LOW
CVSS score: 2.5
CWE: CWE-131, CWE-787
Published: 2021-05-21T14:22:28Z

### Impact
An attacker can cause a heap buffer overflow in `QuantizedMul` by passing in invalid thresholds for the quantization:

```python
import tensorflow as tf

x = tf.constant([256, 328], shape=[1, 2], dtype=tf.quint8)
y = tf.constant([256, 328], shape=[1, 2], dtype=tf.quint8)
min_x = tf.constant([], dtype=tf.float32)
max_x = tf.constant([], dtype=tf.float32)
min_y = tf.constant([], dtype=tf.float32)
max_y = tf.constant([], dtype=tf.float32)

tf.raw_ops.QuantizedMul(x=x, y=y, min_x=min_x, max_x=max_x, min_y=min_y, max_y=max_y)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/87cf4d3ea9949051e50ca3f071fc909538a51cd0/tensorflow/core/kernels/quantized_mul_op.cc#L287-L290) assumes that the 4 arguments are always valid scalars and tries to access the numeric value directly:

```cc 
const float min_x = context->input(2).flat<float>()(0);
const float max_x = context->input(3).flat<float>()(0);
const float min_y = context->input(4).flat<float>()(0);
const float max_y = context->input(5).flat<float>()(0);
```

However, if any of these tensors is empty, then `.flat<T>()` is an empty buffer and accessing the element at position 0 results in overflow.

### Patches
We have patched the issue in GitHub commit [efea03b38fb8d3b81762237dc85e579cc5fc6e87](https://github.com/tensorflow/tensorflow/commit/efea03b38fb8d3b81762237dc85e579cc5fc6e87).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-jvfv-jhw9-jmpp
Summary: Malicious Package in b5ffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:23:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-244r-fcj3-ghjq
Summary: Exposure of class information in RESTEasy
Aliases: CVE-2021-20289
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-209, CWE-668
Published: 2021-04-07T21:51:33Z

A flaw was found in RESTEasy in all current versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
Vulnerability: GHSA-9fj5-jg6f-qg5r
Summary: Use of Hard-coded Credentials in Apache Kylin
Aliases: CVE-2021-45458
Severity: MODERATE
CVSS score: 0
CWE: CWE-798, CWE-326
Published: 2022-01-08T00:43:09Z

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Vulnerability: GHSA-84rm-qf37-fgc2
Summary: Integer Overflow in openssl-src
Aliases: CVE-2021-23841
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-476, CWE-190
Published: 2021-08-25T20:52:21Z

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
Vulnerability: GHSA-6hrm-jqp3-64cv
Summary: Improper Certificate Validation in TweetStream
Aliases: CVE-2020-24393
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2021-04-13T15:42:36Z

TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
Vulnerability: GHSA-8j36-q8x7-pm6q
Summary: OS Command Injection in systeminformation
Aliases: CVE-2020-7778
Severity: HIGH
CVSS score: 7.3
CWE: CWE-78
Published: 2022-02-09T23:14:11Z

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Vulnerability: GHSA-p699-3wgc-7h72
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-1339
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2018-10-17T15:43:59Z

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Vulnerability: GHSA-rjh8-p66p-jrh5
Summary: Data races in rusqlite
Aliases: CVE-2020-35871
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362
Published: 2021-08-25T20:46:59Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API data race.
Vulnerability: GHSA-qppg-v75c-r5ff
Summary: S3Scanner before 2.0.2 allows Directory Traversal
Aliases: CVE-2021-32061
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2021-11-30T22:21:36Z

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult element.
Vulnerability: GHSA-m956-frf4-m2wr
Summary: Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
Aliases: CVE-2016-9587
Severity: HIGH
CVSS score: 8.1
CWE: CWE-20
Published: 2018-10-10T17:22:53Z

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Vulnerability: GHSA-x6wp-rfwh-hcx7
Summary: Regular Expression Denial of Service in content
Aliases: CVE-2017-16111
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T19:55:05Z

Affected versions of `content` are vulnerable to a regular expression denial of service when parsing malicious `Content-Type` and `Content-Disposition` headers.


## Recommendation

Update to version 3.0.6 or later.
Vulnerability: GHSA-39pj-gq8q-9pfj
Summary: Authentication Weakness in keystone
Aliases: CVE-2015-9240
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1255
Published: 2018-06-07T19:43:20Z

Versions of `keystone` prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted.


## Recommendation

Update to version 0.3.16 or later.
Vulnerability: GHSA-fjq3-5pxw-4wj4
Summary: Cross-Site Request Forgery in Webargs
Aliases: CVE-2020-7965
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-352
Published: 2021-04-07T21:06:30Z

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made across domains, leading to CSRF.
Vulnerability: GHSA-9mrq-cjgh-32g2
Summary: Low severity vulnerability that affects smartbanner.js
Severity: LOW
CVSS score: 0
Published: 2019-09-13T13:22:33Z

## rel noopener vulnerability

### Impact
Clicking on smartbanner _View_ link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile 3rd parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner.

### Patches
`rel="noopener"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability.

### Workarounds
If you can not upgrade to `v1.14.1`:
1. Ensure _View_ link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams
2. If _View_ link is going to a 3rd party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel="noopener"` is imposed on all `target="_blank"` links.

    Following combination of smartbanner meta tags can be used to achieve the above:

    ```html
    <meta name="smartbanner:enabled-platforms" content="none">
    <meta name="smartbanner:include-user-agent-regex" content="Mobile.*Safari">
    ```

### References
* [About rel=noopener](https://mathiasbynens.github.io/rel-noopener/)
* [Safari 12.1 Release Notes](https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes#3130296)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [smartbanner.js](https://github.com/ain/smartbanner.js/issues/new)
Vulnerability: GHSA-484f-743f-6jx2
Summary: Object injection in cookie driver in phpfastcache
Aliases: CVE-2019-16774
Severity: HIGH
CVSS score: 4.4
CWE: CWE-94
Published: 2019-12-12T22:50:20Z

## Object injection in cookie driver

### Impact
An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).

### Patches
The issue has been addressed by enforcing JSON conversion when deserializing

### Workarounds
If you can't fix it, use another driver such as "Files" (Filesystem)

### References
Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues)
* Email us at [security@geolim4.com](mailto:security@geolim4.com)
Vulnerability: GHSA-fxjm-wvj9-9c39
Summary: Information disclosure in Apache Superset
Aliases: CVE-2020-1932
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2020-02-26T19:54:57Z

An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.
Vulnerability: GHSA-jfvf-rfmq-qwf8
Summary: Croos-site scripting in Croogo
Aliases: CVE-2019-20789
Severity: LOW
CVSS score: 4.8
CWE: CWE-79
Published: 2021-06-22T15:23:21Z

Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
Vulnerability: GHSA-jx6h-3fjx-cgv5
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2018-1305
Severity: MODERATE
CVSS score: 6.5
Published: 2018-10-17T16:31:48Z

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
Vulnerability: GHSA-jchg-g94r-64qg
Summary: Malicious Package in mogobd
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:50:10Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.