TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7w54-gp8x-f33m
Summary: Potential exposure of tokens to an Unauthorized Actor
Aliases: CVE-2022-21671
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2022-01-12T22:44:47Z

### Impact

When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy has changed, so any communication done to the previous URL could potentially reach a server that is outside of Replit's control and the token used to connect to the Repl could be obtained by an attacker, leading to full compromise of that Repl (not of the account).

### Patches

This was patched in 7.3.1, by updating the address of the fallback WebSocket polling proxy to the new one.

### Workarounds

Specify the new address for the polling host (`gp-v2.replit.com`) in the `ConnectArgs`:

```typescript
const connectOptions: ConnectArgs = {
  // ...
  pollingHost: 'gp-v2.replit.com',
};
client.connect(connectOptions);
```

### For more information

Thanks to https://hackerone.com/orlserg for disclosing this.

If you have any questions or comments about this advisory:
* Open an issue in [replit/crosis](https://github.com/replit/crosis)
* Email us at [security@replit.com](mailto:security@replit.com)
Vulnerability: GHSA-4g4p-42wc-9f3m
Summary: Git LFS can execute a Git binary from the current directory
Aliases: CVE-2020-27955
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-427
Published: 2022-02-11T23:39:18Z

### Impact
On Windows, if Git LFS operates on a malicious repository with a `git.bat` or `git.exe` file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code.  This does not affect Unix systems.

This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.

### Patches
This version should be patched in v2.12.1, which will be released in coordination with this security advisory.

### Workarounds
Other than avoiding untrusted repositories, there is no workaround.

### For more information
If you have any questions or comments about this advisory:
* Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).
* If you cannot open a discussion, please email the core team using their usernames at `github.com`.
Vulnerability: GHSA-4hjg-w3ww-38c6
Summary: Malicious Package in tiar
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:03:49Z

All versions of `tiar` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-ffjh-fjgg-mfpq
Summary: Moderate severity vulnerability that affects org.apache.ranger:ranger
Aliases: CVE-2017-7677
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-862
Published: 2018-10-17T17:22:49Z

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.
Vulnerability: GHSA-jmhf-9fj8-88gh
Summary: Open Redirect in AllTube
Aliases: CVE-2022-0692
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-02-23T21:15:01Z

### Impact
Releases prior to 3.0.1 are vulnerable to an open redirect vulnerability that allows an attacker to construct a URL that redirects to an arbitrary external domain.

### Patches
3.0.1 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

### References
* https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
* https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0692
Vulnerability: GHSA-c53v-qmrx-93hg
Summary: Open redirect in shopware
Aliases: CVE-2022-21651
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-601
Published: 2022-01-06T23:49:19Z

### Impact

Arbitrary redirect while using certain URLs 

### Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Vulnerability: GHSA-qw3g-35hc-fcrh
Summary: Cross-Site Scripting (XSS) in restify
Aliases: CVE-2017-16018
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-09T17:45:38Z

Affected versions of `restify` are susceptible to a cross-site scripting vulnerability when using URL encoded script tags in a non-existent URL.

## Proof of Concept:

Request
```
https://localhost:3000/no5_such3_file7.pl?%22%3E%3Cscript%3Ealert(73541);%3C/script%3E
```

Will be included in response:

```<script>alert(73541);</script>```


## Recommendation

Update to version 4.1.0 or later.
Vulnerability: GHSA-h9w3-f7x6-v54c
Summary: Deserialization of Untrusted Data in com.jsoniter:jsoniter
Aliases: CVE-2021-23441
Severity: HIGH
CVSS score: 7
CWE: CWE-502
Published: 2021-09-20T23:18:54Z

# Withdrawn

was withdrawn by its CNA. Further investigation showed that it was not a security issue. 

## Original Description

All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.
Vulnerability: GHSA-rpg7-q4cv-p466
Summary: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4123
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2021-12-17T20:00:16Z

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-8222-6fc8-mhvf
Summary: Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
Aliases: CVE-2019-3773
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2019-01-25T16:18:52Z

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability: GHSA-6hwh-rqwf-cxxr
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util
Aliases: CVE-2019-10806
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20, CWE-915
Published: 2021-05-07T16:32:02Z

vega-util prior to 1.13.1 allows manipulation of object prototype. The &#39;vega.mergeConfig&#39; method within vega-util could be tricked into adding or modifying properties of the Object.prototype.
Vulnerability: GHSA-rprw-h62v-c2w7
Summary: High severity vulnerability that affects pyyaml
Aliases: CVE-2017-18342
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-01-04T17:45:26Z

In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.
Vulnerability: GHSA-fgmx-8h93-26fh
Summary: Moderate severity vulnerability that affects omniauth-oauth2
Aliases: CVE-2012-6134
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2017-10-24T18:33:37Z

Cross-site request forgery (CSRF) vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state.
Vulnerability: GHSA-9m6j-fcg5-2442
Summary: Path traversal in url-parse
Aliases: CVE-2021-27515
Severity: HIGH
CVSS score: 5.3
CWE: CWE-23
Published: 2021-05-06T16:10:51Z

url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Vulnerability: GHSA-74f5-4m28-gq5c
Summary: Directory Traversal in peiserver
Aliases: CVE-2017-16214
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:09:59Z

Affected versions of `peiserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-q4qf-3fc6-8x34
Summary: Segfault and data corruption in tensorflow-lite
Aliases: CVE-2020-15207
Severity: HIGH
CVSS score: 8.7
CWE: CWE-119, CWE-787
Published: 2020-09-25T18:28:43Z

### Impact
To mimic Python's indexing with negative values, TFLite uses `ResolveAxis` to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/reduce.h#L68-L72

If the `DCHECK` does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption.
### Patches
We have patched the issue in 2d88f470dea2671b430884260f3626b1fe99830a and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-rr77-w4w8-w8wp
Summary: Directory Traversal in tencent-server
Aliases: CVE-2017-16216
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:37:46Z

Affected versions of `tencent-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hwch-749c-rv63
Summary: Potential Command Injection in hubot-scripts
Aliases: CVE-2013-7378
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2020-08-31T22:46:38Z

Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the `hubot-scripts/package/src/scripts/email.coffee` module.


### Mitigating Factors
The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.


## Recommendation

Update hubot-scripts to version 2.4.4 or later.
Vulnerability: GHSA-8vv3-jxm8-f4vf
Summary: Prototype Pollution in connie-lang
Aliases: CVE-2020-7706
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-05-06T17:29:25Z

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie.
Vulnerability: GHSA-q347-cg56-pcq4
Summary: SSRF in repository migration
Severity: MODERATE
CVSS score: 5
CWE: CWE-918
Published: 2022-03-14T22:57:00Z

### Impact

The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected.

### Patches

Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

Run Gogs in its own private network.

### References

https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/

### For more information

If you have any questions or comments about this advisory, please post on #6754.
Vulnerability: GHSA-5w65-6875-rhq8
Summary: Undefined Behavior in sailsjs-cacheman
Severity: LOW
CVSS score: 0
Published: 2019-09-11T23:01:57Z

All versions of `sailsjs-cacheman` have a vulnerability that may lead to Undefined Behavior. The config variable is exposing to the global scope which may overwrite other variables and cause the application to misbehave.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-g489-xrw3-3v8w
Summary: Data races in aovec
Aliases: CVE-2020-36207
Severity: HIGH
CVSS score: 7
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:50:46Z

An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
Vulnerability: GHSA-h68q-55jf-x68w
Summary: Prototype pollution in chart.js
Aliases: CVE-2020-7746
Severity: HIGH
CVSS score: 7.5
CWE: CWE-915
Published: 2021-05-10T18:47:53Z

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
Vulnerability: GHSA-mc36-5m36-hjh5
Summary: Data races in slock
Aliases: CVE-2020-36455
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:58:00Z

An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync.
Vulnerability: GHSA-34gh-3cwv-wvp2
Summary: Directory traversal in rollup-plugin-server
Aliases: CVE-2020-7683
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2020-07-29T18:07:11Z

This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.
Vulnerability: GHSA-xfmw-2vmm-579c
Summary: Hijacked Environment Variables in nodesass
Aliases: CVE-2017-16080
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2020-09-01T18:59:50Z

The `nodesass` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-wmrx-57hm-mw7r
Summary: Arbitrary file reads in HashiCorp Nomad
Aliases: CVE-2022-24683
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-02-18T00:00:34Z

Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. There are currently no known workarounds. Users are recommended to upgrade as soon as possible to avoid this issue.
Vulnerability: GHSA-p62r-jf56-h429
Summary: Malicious Package in evil-package
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2020-09-03T20:29:58Z

All versions of `evil-package` contain malicious code. The package uploads the contents of `process.env` to `example.com/log`.


## Recommendation

Remove the package from your environment. Given the host where the information was uploaded to there is no further indication of compromise.
Vulnerability: GHSA-9x4c-63pf-525f
Summary: Arbitrary Code Generation
Aliases: CVE-2020-15142
Severity: HIGH
CVSS score: 8
CWE: CWE-94
Published: 2020-08-20T14:38:24Z

### Impact
Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.

Giving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C .

### Patches
Fix will be included in version 0.5.3

### Workarounds
Inspect OpenAPI documents before generating, or inspect generated code before executing.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [openapi-python-client](https://github.com/triaxtec/openapi-python-client/issues)
* Email us at [danthony@triaxtec.com](mailto:danthony@triaxtec.com)
Vulnerability: GHSA-qh62-ch95-63wh
Summary: python-gnupg allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended
Aliases: CVE-2019-6690
Severity: MODERATE
CVSS score: 0
Published: 2020-03-13T20:05:10Z

**Withdrawn:** Duplicate of GHSA-2fch-jvg5-crf6
Vulnerability: GHSA-h376-j262-vhq6
Summary: RCE in H2 Console
Aliases: CVE-2021-42392
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-01-06T23:55:09Z

### Impact
H2 Console in versions since 1.1.100 (2008-10-14) to 2.0.204 (2021-12-21) inclusive allows loading of custom classes from remote servers through JNDI.

H2 Console doesn't accept remote connections by default. If remote access was enabled explicitly and some protection method (such as security constraint) wasn't set, an intruder can load own custom class and execute its code in a process with H2 Console (H2 Server process or a web server with H2 Console servlet).

It is also possible to load them by creation a linked table in these versions, but it requires `ADMIN` privileges and user with `ADMIN` privileges has full access to the Java process by design. These privileges should never be granted to untrusted users.

### Patches
Since version 2.0.206 H2 Console and linked tables explicitly forbid attempts to specify LDAP URLs for JNDI. Only local data sources can be used.

### Workarounds
H2 Console should never be available to untrusted users.

`-webAllowOthers` is a dangerous setting that should be avoided.

H2 Console Servlet deployed on a web server can be protected with a security constraint:
https://h2database.com/html/tutorial.html#usingH2ConsoleServlet
If `webAllowOthers` is specified, you need to uncomment and edit `<security-role>` and `<security-constraint>` as necessary. See documentation of your web server for more details.

### References
This issue was found and privately reported to H2 team by [JFrog Security](https://www.jfrog.com/)'s vulnerability research team with detailed information.
Vulnerability: GHSA-fm4j-4xhm-xpwx
Summary: Sandbox Breakout / Arbitrary Code Execution in sandbox
Severity: MODERATE
CVSS score: 0
Published: 2020-09-02T15:51:34Z

All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors.

## Proof of concept
```
var Sandbox = require("sandbox")
s = new Sandbox()
code = `new Function("return (this.constructor.constructor('return (this.process.mainModule.constructor._load)')())")()("util").inspect("hi")`
s.run(code)
```


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-q3x2-jvp3-wj78
Summary: Unrestricted XML files leading to cross-site scripting in Microweber
Aliases: CVE-2022-0963
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack.
Vulnerability: GHSA-98pq-pmw9-4gpm
Summary: SQL Injection in sequelize
Aliases: CVE-2016-10550
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2019-02-18T23:54:34Z

Affected versions of `sequelize` are vulnerable to SQL Injection in locations where user input is passed into the `limit` or `order` parameters of `sequelize` query calls, such as `findOne` or `findAll`.



## Recommendation

Update to version 3.17.0 or later.
Vulnerability: GHSA-w8h4-vw8f-rvvj
Summary: Improper Control of Dynamically-Managed Code Resources in config-shield
Aliases: CVE-2021-26276
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-913
Published: 2021-04-13T15:30:09Z

scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data.
Vulnerability: GHSA-w5p7-h5w8-2hfq
Summary: Regular Expression Denial of Service in trim
Aliases: CVE-2020-7753
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-10T18:44:22Z

All versions of package trim lower than 0.0.3 are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
Vulnerability: GHSA-2w8g-m5j8-7m87
Summary: Zalgo-like output that crashes the server
Severity: CRITICAL
CVSS score: 0
Published: 2022-01-12T21:45:59Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

[`colors`](https://npmjs.com/package/colors) package caused zalgo-like output (see https://github.com/soketi/soketi/issues/276, https://github.com/Marak/colors.js/issues/289), breaking the servers.

**Only NPM users that recently upgraded or installed the NPM package are affected.**

Docker users seem to not be affected as the dependencies were bundled at the time of the build, which were tested.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Latest patch. `0.26.1` to be exact at the time of writing.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You cannot get around this as it's related to dependencies.

### References
_Are there any links users can visit to find out more?_

- https://github.com/Marak/colors.js/issues/289

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issues board](https://github.com/soketi/soketi/issues)
* Email us at [alex@renoki.org](mailto:alex@renoki.org)
Vulnerability: GHSA-wvcv-832q-fjg7
Summary: RSA weakness in tslite-ng
Aliases: CVE-2020-26263
Severity: LOW
CVSS score: 7.5
CWE: CWE-326
Published: 2020-12-21T16:56:37Z

### Impact
The code that performs decryption and padding check in RSA PKCS#1 v1.5 decryption is data dependant.
In particular, code in current (as of 0.8.0-alpha38) master
https://github.com/tlsfuzzer/tlslite-ng/blob/0812ed60860fa61a6573b2c0e18771414958f46d/tlslite/utils/rsakey.py#L407-L441
and code in 0.7.5 branch
https://github.com/tlsfuzzer/tlslite-ng/blob/acdde3161124d6ae37c506b3476aea9996d12e97/tlslite/utils/rsakey.py#L394-L425
has multiple ways in which it leaks information (for one, it aborts as soon as the plaintext doesn't start with 0x00, 0x02) about the decrypted ciphertext (both the bit length of the decrypted message as well as where the first unexpected byte lays).

All TLS servers that enable RSA key exchange as well as applications that use the RSA decryption API directly are vulnerable.

All previous versions of tlslite-ng are vulnerable.

### Patches
The patches to fix it are proposed in 
https://github.com/tlsfuzzer/tlslite-ng/pull/438
https://github.com/tlsfuzzer/tlslite-ng/pull/439

Note: the patches depend on Python processing the individual bytes in side-channel free manner, this is known to not be the case: https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/
As such, users that require side-channel resistance are recommended to use different TLS implementations, as stated in the [security policy](https://github.com/tlsfuzzer/tlslite-ng/blob/master/SECURITY.md) of tlslite-ng.

### Workarounds
There is no way to workaround this issue.

### References
https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/

### For more information
If you have any questions or comments about this advisory please open an issue in [tlslite-ng](https://github.com/tlsfuzzer/tlslite-ng/issues).
Vulnerability: GHSA-2mm9-c2fx-c7m4
Summary: XSS in docsify
Aliases: CVE-2021-23342
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2021-03-01T19:44:27Z

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters
Vulnerability: GHSA-7px3-6f6g-hxcj
Summary: Moderate severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2018-8026
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-611
Published: 2018-10-17T19:55:34Z

This vulnerability in Apache Solr 6.0.0 to 6.6.4 and 7.0.0 to 7.3.1 relates to an XML external entity expansion (XXE) in Solr config files (currency.xml, enumsConfig.xml referred from schema.xml, TIKA parsecontext config file). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. The manipulated files can be uploaded as configsets using Solr's API, allowing to exploit that vulnerability.
Vulnerability: GHSA-59m2-j944-839w
Summary: Downloads Resources over HTTP in clang-extra
Aliases: CVE-2016-10655
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:45:13Z

Affected versions of `clang-extra` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `clang-extra`.


## Recommendation

No patch is currently available for this vulnerability. The package author stated that no patch is possible until llvm provides HTTPS support, and a patch would be possible if that ever happened in the future.

The best mitigation option is to reduce the risk of exploitation as much as possible. This can be done by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3hvm-hgpw-rx4j
Summary: Path Traversal in knightjs
Aliases: CVE-2018-16475
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-11-06T23:11:10Z

All versions of `knightjs` are vulnerable to Path Traversal. 

This vulnerability allows an attacker to read content of arbitrary files on the server due to lack of input validation.


## Recommendation

As there is currently no fix for this module we recommend not using this module in production environments.
Vulnerability: GHSA-9w2p-5mgw-p94c
Summary: Integer overflow due to conversion to unsigned
Aliases: CVE-2021-37645
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-681
Published: 2021-08-25T14:43:37Z

### Impact
The implementation of `tf.raw_ops.QuantizeAndDequantizeV4Grad` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value.

```python
import tensorflow as tf

tf.raw_ops.QuantizeAndDequantizeV4Grad(
  gradients=[1.0,2.0],
  input=[1.0,1.0],
  input_min=[0.0],
  input_max=[10.0],
  axis=-100)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L126) uses the `axis` value as the size argument to `absl::InlinedVector` constructor. But, the constructor uses an unsigned type for the argument, so the implicit conversion transforms the negative value to a large integer.

### Patches
We have patched the issue in GitHub commit [96f364a1ca3009f98980021c4b32be5fdcca33a1](https://github.com/tensorflow/tensorflow/commit/96f364a1ca3009f98980021c4b32be5fdcca33a1).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, and TensorFlow 2.4.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-prv2-xwr7-hr57
Summary: Uncontrolled Resource Consumption in rdf-graph-array
Aliases: CVE-2019-10798
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-04-13T15:23:21Z

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.
Vulnerability: GHSA-3227-r97m-8j95
Summary: Relative Path Traversal in afire serve_static
Severity: HIGH
CVSS score: 0
CWE: CWE-22, CWE-34
Published: 2022-04-22T20:16:45Z

### Impact
This vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.

### Patches
The issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).
If you can, just update to the newest version of afire.

### Workarounds
If you can't update afire you can simply disallow paths containing `/..` with the following middleware.
Make sure this is the last middleware added to the server so it runs first, stopping the bad requests.
```rust
use afire::prelude::*;

struct PathTraversalFix;

impl Middleware for PathTraversalFix {
    fn pre(&self, req: Request) -> MiddleRequest {
        if req.path.replace("\\", "/").contains("/..") {
            return MiddleRequest::Send(
                Response::new()
                    .status(400)
                    .text("Paths containing `..` are not allowed"),
            );
        }

        MiddleRequest::Continue
    }
}
```
```rust
let mut server = Server::new(host, port);
PathTraversalFix.attach(&mut server);
```

### References
You can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)

### For more information
If you have any questions or comments about this advisory you can email me or message me on discord.
[[https://connorcode.com/contact](https://connorcode.com/contact)]
Vulnerability: GHSA-p7jq-v8jp-j424
Summary: Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Aliases: CVE-2021-31406
Severity: MODERATE
CVSS score: 4
CWE: CWE-208, CWE-203
Published: 2021-04-19T14:50:38Z

Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

- https://vaadin.com/security/cve-2021-31406
Vulnerability: GHSA-9pgx-gcph-mpqr
Summary: XSS via the history parameter in SQL command
Aliases: CVE-2020-35572
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-02-11T20:42:28Z

### Impact
Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.

### Patches
Patched by 5c395afc, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).

### Workarounds
Use browser which encodes URL parameters (e.g. Chrome or Firefox).

### References
https://sourceforge.net/p/adminer/bugs-and-features/775/

### For more information
If you have any questions or comments about this advisory:
* Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/
Vulnerability: GHSA-cm5x-837x-jf3c
Summary: Division by 0 in inplace operations
Aliases: CVE-2021-37660
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:42:44Z

### Impact
An attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0:

```python
import tensorflow as tf

tf.raw_ops.InplaceSub(x=[],i=[-99,-1,-1],v=[1,1,1])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if `x` and `v` are empty but the code uses `||` instead of `&&`.

### Patches
We have patched the issue in GitHub commit [e86605c0a336c088b638da02135ea6f9f6753618](https://github.com/tensorflow/tensorflow/commit/e86605c0a336c088b638da02135ea6f9f6753618).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-5j2h-h5hg-3wf8
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2011-0696
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2018-07-23T19:51:10Z

Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.
Vulnerability: GHSA-88rc-3p98-rgvx
Summary: After order payment process manipulation in shopware/platform and shopware/core 
Severity: CRITICAL
CVSS score: 0
CWE: CWE-668
Published: 2021-04-13T15:13:48Z

### Impact

After order payment process manipulation

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Vulnerability: GHSA-8554-jxcw-454q
Summary: High severity vulnerability that affects webargs
Aliases: CVE-2019-9710
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362
Published: 2019-03-12T15:16:12Z

An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests.
Vulnerability: GHSA-56pc-6jqp-xqj8
Summary: Context isolation bypass in Electron
Aliases: CVE-2020-15215
Severity: LOW
CVSS score: 5.6
CWE: CWE-668, CWE-693
Published: 2020-10-06T17:46:40Z

### Impact
Apps using both `contextIsolation` and `sandbox: true` are affected.
Apps using both `contextIsolation` and `nativeWindowOpen: true` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `11.0.0-beta.6`
* `10.1.2`
* `9.3.1`
* `8.5.2`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-5f37-gxvh-23v6
Summary: Remote code execution in PHPMailer
Aliases: CVE-2016-10033
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2020-03-05T22:09:17Z

### Impact
The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \&quot; (backslash double quote) in a crafted `Sender` property.

### Patches
Fixed in 5.2.18

### Workarounds
Filter and validate user input before passing it to internal functions.

### References
https://nvd.nist.gov/vuln/detail/CVE-2016-10033
Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-p2v9-g2qv-p635
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2019-20445
Severity: MODERATE
CVSS score: 0
CWE: CWE-444
Published: 2020-02-21T18:55:04Z

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
Vulnerability: GHSA-5v9h-q3gj-c32x
Summary: SQL Injection via GeoJSON in sequelize
Aliases: CVE-2016-1000225
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2020-09-01T15:27:40Z

Affected versions of `sequelize` are vulnerable to SQL Injection in Models that have fields with the `GEOMETRY` DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using `ST_GeomFromGeoJSON`, and MySQL GeoJSON documents using `GeomFromText`.


## Recommendation

Update to version 3.23.6 or later.
Vulnerability: GHSA-cxjc-r2fp-7mq6
Summary: XSS in dijit editor's LinkDialog plugin 
Aliases: CVE-2020-4051
Severity: LOW
CVSS score: 3.7
CWE: CWE-79
Published: 2020-06-15T21:53:12Z

### Impact
XSS possible for users of the Dijit Editor's LinkDialog plugin

### Patches
Yes, 1.11.11, 1.12.9, 1.13.8, 1.14.7, 1.15.4, 1.16.3

### Workarounds
Users may apply the patch made in these releases.


### For more information
If you have any questions or comments about this advisory, open an issue in [dojo/dijit](https://github.com/dojo/dijit/)
Vulnerability: GHSA-mh27-rxmr-8q4c
Summary: Cross-site Scripting in Jenkins SiteMonitor Plugin
Aliases: CVE-2022-28153
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-30T00:00:23Z

Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-2wwc-w2gw-4329
Summary: Out-of-bounds write
Aliases: CVE-2019-1366
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:55:36Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1307, CVE-2019-1308, CVE-2019-1335.
Vulnerability: GHSA-rqrc-8q8f-cp9c
Summary: Infinite loop in .Net Bond
Aliases: CVE-2020-1469
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835, CWE-434
Published: 2022-04-08T18:11:51Z

A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'. Handling of large container lengths that could cause an infinite loop when deserializing some payloads.
Vulnerability: GHSA-7375-vjr2-3g7w
Summary: Cross-Site Scripting in glance
Aliases: CVE-2018-3748
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-27T11:37:19Z

Versions of `glance` before 3.0.8 are vulnerable to Stored Cross-Site Scripting (XSS). This is only exploitable if the attacker is able to control the name of a file that is served by the `glance` package.
Vulnerability: GHSA-7378-6268-4278
Summary: High severity vulnerability that affects DotNetZip
Aliases: CVE-2018-1002205
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-10-16T17:16:40Z

DotNetZip.Semvered before 1.11.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Vulnerability: GHSA-q9mp-79cp-9g8j
Summary: Improper Authentication
Aliases: CVE-2019-20894
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-295
Published: 2021-09-02T22:00:09Z

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred.
Vulnerability: GHSA-85cw-hj65-qqv9
Summary: Polymorphic Typing issue in FasterXML jackson-databind
Aliases: CVE-2019-16335
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-09-23T18:33:45Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
Vulnerability: GHSA-3x8c-fmpc-5rmq
Summary: Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
Aliases: CVE-2020-26891
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-10-16T16:56:04Z

### Impact
The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

### Patches
This is fixed by #8444, which is included in Synapse v1.21.0.

### Workarounds
If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy:

* `/_matrix/client/r0/auth/.*/fallback/web`
* `/_matrix/client/unstable/auth/.*/fallback/web`
Vulnerability: GHSA-p6j8-hgv5-m35g
Summary: Uncontrolled Resource Consumption in jboss-remoting
Aliases: CVE-2020-35510
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-03-18T17:58:30Z

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Vulnerability: GHSA-xw93-v57j-fcgh
Summary: Division by 0 in `SparseMatMul`
Aliases: CVE-2021-29557
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:24:48Z

### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`:

```python
import tensorflow as tf

a = tf.constant([100.0, 100.0, 100.0, 100.0], shape=[2, 2], dtype=tf.float32)
b = tf.constant([], shape=[0, 2], dtype=tf.float32)

tf.raw_ops.SparseMatMul(
    a=a, b=b, transpose_a=True, transpose_b=True,
    a_is_sparse=True, b_is_sparse=True)
``` 
    
The division by 0 occurs deep in Eigen code because the `b` tensor is empty.
    
### Patches
We have patched the issue in GitHub commit [7f283ff806b2031f407db64c4d3edcda8fb9f9f5](https://github.com/tensorflow/tensorflow/commit/7f283ff806b2031f407db64c4d3edcda8fb9f9f5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-8wrg-m8vm-5fvj
Summary: Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server
Aliases: CVE-2021-21403
Severity: HIGH
CVSS score: 7.5
CWE: CWE-305
Published: 2022-02-15T01:57:18Z

### Impact

Authentication Bypass by Primary Weakness (CWE-305)

Commit:

https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1

ALL Users  is impacted.

### Patches

Yes, PLEASE UPGRADE TO v1.3.21-beta.d0ffc0a6
Vulnerability: GHSA-69vj-xx27-g45w
Summary: Data race in eventio
Aliases: CVE-2020-36216
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:51:49Z

An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread, a data race and memory corruption can occur.
Vulnerability: GHSA-9qcf-c26r-x5rf
Summary: XML external entity injection in Terracotta Quartz Scheduler
Aliases: CVE-2019-13990
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2020-07-01T17:55:03Z

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Vulnerability: GHSA-7g65-ghrg-hpf5
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-3465
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
Vulnerability: GHSA-x2fc-mxcx-w4mf
Summary: Prototype Pollution in mathjs
Aliases: CVE-2020-7743
Severity: HIGH
CVSS score: 0
CWE: CWE-915
Published: 2021-05-10T18:39:04Z

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Vulnerability: GHSA-gcv8-gh4r-25x6
Summary: Authorization Bypass Through User-Controlled Key in urijs
Aliases: CVE-2022-0613
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-639
Published: 2022-02-17T00:00:35Z

Attacker can use case-insensitive protocol schemes like HTTP, htTP, HTtp etc. in order to bypass the patch for CVE-2021-3647.
Vulnerability: GHSA-m7fq-cf8q-35q7
Summary: High severity vulnerability that affects crack
Aliases: CVE-2013-1800
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:37Z

The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.