TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-gwpf-62xp-vrg6
Summary: Information Exposure in cordova-android
Aliases: CVE-2016-6799
Severity: HIGH
CVSS score: 7.5
CWE: CWE-532
Published: 2020-09-11T21:14:49Z

Versions of `cordova-android` prior to 6.0.0 are vulnerable to Information Exposure through log files. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition to the current log. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.


## Recommendation

Upgrade to version 6.0.0 or later.
Vulnerability: GHSA-p9vv-3945-x93h
Summary: Cross-Site Scripting in semantic-ui-search
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T15:47:10Z

All versions of `semantic-ui-search` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-gg84-qgv9-w4pq
Summary: CRLF injection in httplib2
Aliases: CVE-2020-11078
Severity: LOW
CVSS score: 6.8
CWE: CWE-93
Published: 2020-05-20T15:55:47Z

### Impact
Attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.

Impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping.

### Patches
Problem has been fixed in 0.18.0
Space, CR, LF characters are now quoted before any use.
This solution should not impact any valid usage of httplib2 library, that is uri constructed by urllib.

### Workarounds
Create URI with `urllib.parse` family functions: `urlencode`, `urlunsplit`.

```diff
user_input = " HTTP/1.1\r\ninjected: attack\r\nignore-http:"
-uri = "https://api.server/?q={}".format(user_input)
+uri = urllib.parse.urlunsplit(("https", "api.server", "/v1", urllib.parse.urlencode({"q": user_input}), ""))
http.request(uri)
```

### References
https://cwe.mitre.org/data/definitions/93.html
https://docs.python.org/3/library/urllib.parse.html

Thanks to Recar https://github.com/Ciyfly for finding vulnerability and discrete notification.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [httplib2](https://github.com/httplib2/httplib2/issues/new)
* Email [current maintainer at 2020-05](mailto:temotor@gmail.com)
Vulnerability: GHSA-xxfh-x98p-j8fr
Summary: Remote code injection in Log4j (through pax-logging-log4j2)
Severity: CRITICAL
CVSS score: 0
Published: 2021-12-10T20:15:37Z

### Impact
Remote Code Execution.

### Patches
Users of pax-logging 1.11.9 should update to 1.11.10.
Users of pax-logging 2.0.10 should update to 2.0.11.

### Workarounds
Set system property `-Dlog4j2.formatMsgNoLookups=true`

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
Vulnerability: GHSA-g83m-67wh-whpw
Summary: Command injection in kekbit
Aliases: CVE-2020-36449
Severity: HIGH
CVSS score: 8.1
CWE: CWE-77
Published: 2021-08-25T20:57:10Z

An issue was discovered in the kekbit crate before 0.3.4 for Rust. For ShmWriter<H>, Send is implemented without requiring H: Send.
Vulnerability: GHSA-jv74-f9pj-xp3f
Summary: Apache Camel's Mail is vulnerable to path traversal
Aliases: CVE-2018-8041
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2018-10-16T23:07:57Z

Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
Vulnerability: GHSA-mrx7-8hxf-f853
Summary: Cross-Site Scripting in swagger-ui
Aliases: CVE-2016-1000233
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:36:27Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting. This vulnerability exists because `swagger-ui` automatically executes external Javascript that is loaded in via the `url` query string parameter when a `Content-Type: application/javascript` header is included.

An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a `swagger-ui` URL that includes the location to their server/script in the `url` query string parameter. When viewed, such a link would execute the attacker's malicious script.


## Recommendation

Update to 2.2.1 or later.
Vulnerability: GHSA-8fxw-76px-3rxv
Summary: Memory leak in Tensorflow
Aliases: CVE-2020-15192
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20
Published: 2020-09-25T18:28:17Z

### Impact
If a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L100-L104

The allocated memory is from
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L256

The issue occurs because the `status` argument during validation failures is not properly checked:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L265-L267

Since each of the above methods can return an error status, the `status` value must be checked before continuing.

### Patches
We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered during variant analysis of [GHSA-rjjg-hgv6-h69v](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rjjg-hgv6-h69v).
Vulnerability: GHSA-p5hg-3xm3-gcjg
Summary: Spring Framework allows applications to expose STOMP over WebSocket endpoints
Aliases: CVE-2018-1270
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-358
Published: 2018-10-17T20:05:59Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
Vulnerability: GHSA-vrr3-5r3v-7xfw
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in casperjs
Aliases: CVE-2020-7679
Severity: HIGH
CVSS score: 7.3
CWE: CWE-915
Published: 2021-05-17T21:00:52Z

The mergeObjects utility function is susceptible to Prototype Pollution.
Vulnerability: GHSA-frxx-2m33-6wcr
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow
Aliases: CVE-2018-8825
Severity: HIGH
CVSS score: 8.8
CWE: CWE-119
Published: 2019-04-24T16:11:30Z

Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).
Vulnerability: GHSA-7mc5-chhp-fmc3
Summary: Regular Expression Denial of Service in negotiator
Aliases: CVE-2016-10539
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-10-09T00:30:30Z

Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.




## Recommendation

Update to version 0.6.1 or later.
Vulnerability: GHSA-2rcm-phc9-3945
Summary: Moderate severity vulnerability that affects pyopenssl
Aliases: CVE-2018-1000808
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-404
Published: 2018-10-10T16:10:23Z

Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.
Vulnerability: GHSA-6c73-2v8x-qpvm
Summary: Argo Server TLS requests could be forged by attacker with network access
Severity: MODERATE
CVSS score: 0
Published: 2021-08-23T19:41:30Z

### Impact

We are not aware of any exploits. This is a pro-active fix.

Impacted: 

* You are running Argo Server < v3.0 with `--secure=true` or >= v3.0 with `--secure` unspecified (note - running in secure mode is recommended regardless).
* The attacker is within your network. If you expose Argo Server to the Internet then "your network" is "the Internet". 

The Argo Server's keys are packaged within the image. They could be extracted and used to decrypt traffic, or forge requests.

### Patches

https://github.com/argoproj/argo-workflows/pull/6540

### Workarounds

* Make sure that your Argo Server service or pod are not directly accessible outside of your cluster. Put TLS load balancer in front of it.

This was identified by engineers at Jetstack.io
Vulnerability: GHSA-3c9c-2p65-qvwv
Summary: Prototype pollution in aurelia-path
Aliases: CVE-2021-41097
Severity: HIGH
CVSS score: 9.1
CWE: CWE-1321, CWE-915
Published: 2021-09-27T20:12:16Z

### Impact
The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`

### Patches
The problem should be patched in version `1.1.7`. Any version earlier than this is vulnerable.

### Workarounds
A partial work around is to free the Object prototype:
```ts
Object.freeze(Object.prototype)
```
Vulnerability: GHSA-f5gc-p5m3-v347
Summary: XXE in petl
Severity: LOW
CVSS score: 0
CWE: CWE-611
Published: 2020-12-02T18:28:30Z

### Impact
Information Disclosure

### Summary

[petl](https://github.com/petl-developers/petl) is a Python library that provides functions for extraction, transformation, and loading (ETL) of data.

petl before 1.68, in some configurations, allows resolution of entities in XML input.

An attacker who is able to submit XML input to an application using petl can disclose arbitrary files on the file system in the context of the user under which the application is running.

### Affected Applications

Applications that:

- accept attacker-supplied XML input that is processed using petl < 1.68
- return the response generated by petl back to the attacker
- configure lxml as the underlying XML processing library used by petl
- have read privileges in filesystem files with sensitive information

### Mitigation
Update to petl >= 1.68

### Workarounds

- Assure there is no user/external access to the application using [petl](https://github.com/petl-developers/petl)
- Assure your application is not using the function [fromxml()](https://petl.readthedocs.io/en/stable/io.html#petl.io.xml.fromxml)

### References
- https://github.com/nvn1729/advisories/blob/master/cve-2020-29128.md
- https://github.com/petl-developers/petl/pull/527
- https://github.com/petl-developers/petl/releases/tag/v1.6.8
- https://petl.readthedocs.io/en/stable/changes.html
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing

### For more information
If you have any questions or comments about this advisory:
* Add a comment in the Github [issue](https://github.com/petl-developers/petl/pull/527)

Thaks to Naveen Sunkavally.
Vulnerability: GHSA-73c6-vwjh-g3qh
Summary: Malicious Package in crpyto-js
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:40:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-8gr3-2gjw-jj7g
Summary: Hidden functionality in node-ipc
Severity: LOW
CVSS score: 0
CWE: CWE-912
Published: 2022-03-16T23:54:33Z

The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions < 9.2.2.
Vulnerability: GHSA-634c-v2xv-ffpg
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2017-14136
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-787
Published: 2021-10-12T22:02:51Z

OpenCV (Open Source Computer Vision Library) 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12597.
Vulnerability: GHSA-36m2-8rhx-f36j
Summary: Sandbox bypass in Latte templates
Aliases: CVE-2022-21648
Severity: HIGH
CVSS score: 8.2
CWE: CWE-79
Published: 2022-01-06T23:17:07Z

### Impact
The problem affects users who use the sandbox in Latte and templates from untrusted sources.

### Patches
Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. 

### References
The issues were discovered by
- JinYiTong (https://github.com/JinYiTong)
- 赵钰迪 <20212010122@fudan.edu.cn>
Vulnerability: GHSA-v63x-xc9j-hhvq
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Aliases: CVE-2019-10769
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-20
Published: 2019-12-11T02:01:44Z

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input. This may allow attackers to execute arbitrary code in the system.


## Recommendation

The package is not meant to receive user input. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-h3hw-g4hm-7gr4
Summary: SQL injection without credentials in ming-soft MCMS
Aliases: CVE-2020-23262
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-02-09T22:18:13Z

An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.
Vulnerability: GHSA-47wr-426j-fr82
Summary: Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer
Aliases: CVE-2020-26277
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-59
Published: 2022-02-12T00:14:07Z

### Impact
_Users unpacking a tarball through dbdeployer may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defences._

### Mitigating factors
For the attach to succeed, the following factors need to contribute:

* The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user.
*  The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack.

### Analysis

An attacker could inject a symbolic link into the tarball, so that a file could result into `fake_file -> /etc/passwd` or some equally  important file.
As it is now, dbdeployer would create the symlink as defined, with a local file `fake_file` linked to `/etc/passwd`. The danger here is that any process with the privileges to write to both `fake_file` and `/etc/passwd` could overwrite the system file. Even without malicious intent, this could result in the system to become unusable.
As noted above, the user must have write privileges to the target file to do the damage.

### Remedies

It has been suggested that the extract procedure use `filepath.EvalSymlinks` to determine whether the target is within the extraction directory. Unfortunately, this approach is unavailable in this context, because it would prevent legitimate patterns from being carried out.
A simple case is a file `mysql-8.0.22-macos10.15-x86_64/bin/libprotobuf-lite.3.11.4.dylib` with a linkName `../lib/libprotobuf-lite.3.11.4.dylib`, if the linked file has not been created yet, `filepath.EvalSymlinks` would fail, as it acts on existing files only.

An alternative method is comparing the depth (how many directories) of the file name with the depth of the link name. If the link name has a higher depth than the local file, we block the operation with an appropriate error:

```
Unpacking tarball exploit/mysql-8.0.22-macos10.15-x86_64.tar.gz to $HOME/opt/mysql/test8.0.22
......
link '../../../../../../../../../../etc' points outside target directory

exit status 1
```
As an additional fortifier, we can check whether the link points to an existing file, calculate its absolute name, and compare it with the absolute name of the extraction directory. A link to a full path (such as `/etc/passwd`) would fail this test, and trigger an error.

The same check can be applied to a link to a non existing file with absolute path.

### Patches

Patched in release 1.58.2

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [dbdeployer](https://github.com/datacharmer/dbdeployer)
Vulnerability: GHSA-pxpf-v376-7xx5
Summary: tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload
Aliases: CVE-2022-25854
Severity: MODERATE
CVSS score: 0
Published: 2022-04-30T00:00:33Z

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.
Vulnerability: GHSA-48gc-5j93-5cfq
Summary: Path Traversal in serve
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-11T21:15:54Z

Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.


## Recommendation

Upgrade to version 10.1.2 or later.
Vulnerability: GHSA-476p-r2wx-2wch
Summary: Downloads Resources over HTTP in ntfserver
Aliases: CVE-2016-10650
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:05Z

Affected versions of `ntfserver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `ntfserver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-f8vf-6hwg-hw55
Summary: Malicious Package in bictore-lib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:38:21Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4r7g-7cpj-5jr7
Summary: Moderate severity vulnerability that affects org.apache.qpid:qpid-broker
Aliases: CVE-2017-15701
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-10-19T16:41:15Z

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive) the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate.  Older AMQP protocols are not affected.
Vulnerability: GHSA-7gcp-w6ww-2xv9
Summary: Path traversal and files overwrite with unsquashfs in singularity
Aliases: CVE-2020-15229
Severity: HIGH
CVSS score: 8.2
CWE: CWE-22
Published: 2021-05-24T16:59:53Z

### Impact

Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs` (a distribution provided utility used by Singularity), it is possible to overwrite/create any files on the host filesystem during the extraction of a crafted squashfs filesystem.

Squashfs extraction occurs automatically for unprivileged execution of Singularity (either `--without-suid` installation or with `allow setuid = no`) when a user attempts to run an image which:

- is a local SIF image or a single file containing a squashfs filesystem
- is pulled from remote sources `library://` or `shub://`

Image build is also impacted in a more serious way as it is often performed by the root user, allowing an attacker to overwrite/create files leading to a system compromise.  Bootstrap methods `library`, `shub` and `localimage` trigger a squashfs extraction.

### Patches

This issue is addressed in Singularity 3.6.4.

All users are advised to upgrade to 3.6.4 especially if they use Singularity mainly for building image as root user.

### Workarounds

There is no solid workaround except to temporarily avoid use of unprivileged mode with single file images, in favor of sandbox images instead. Regarding image build, temporarily avoid building from `library` and `shub` sources, and as much as possible use `--fakeroot` or a VM to limit potential impact.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-6978-vg2j-cc9q
Summary: Improper Privilege Management and Execution with Unnecessary Privileges in Kata Containers
Aliases: CVE-2020-2023
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-269, CWE-250
Published: 2022-02-15T01:57:18Z

Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
Vulnerability: GHSA-g7w9-vm5m-48q8
Summary: Downloads Resources over HTTP in arcanist
Aliases: CVE-2016-10683
Severity: MODERATE
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:09Z

Affected versions of `arcanist` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `arcanist`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-cjvr-mfj7-j4j8
Summary: Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
Aliases: CVE-2022-0577
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-863
Published: 2022-03-01T22:12:47Z

### Impact

If you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.

### Patches

Upgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.

¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.

² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.

### Workarounds

If you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the [`Request` documentation](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request), and set the right domain for each cookie.

Alternatively, you can [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to domains that you trust with all your user-set cookies.

### References
* Originally reported at [huntr.dev](https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585/)

### For more information

If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
Vulnerability: GHSA-92vm-mxjf-jqf3
Summary: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Aliases: CVE-2021-43572
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2021-11-10T20:41:39Z

The `verify` function in the Stark Bank Python ECDSA library (starkbank-ecdsa) 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Vulnerability: GHSA-vm67-7vmg-66vm
Summary: Arbitrary Command Injection in portprocesses
Aliases: CVE-2021-23348
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-77, CWE-78
Published: 2021-04-06T17:24:50Z

### Impact

An Arbitrary Command Injection vulnerability was reported in `portprocesses` impacting versions <= 1.0.4.

### Example (Proof of Concept)

The following example demonstrates the vulnerability and will run `touch success` therefore creating a file named `success`.

```js
const portprocesses = require("portprocesses");

portprocesses.killProcess("$(touch success)");
```
Vulnerability: GHSA-prmc-5v5w-c465
Summary: Client TLS credentials sent raw to server in npm package nats
Severity: CRITICAL
CVSS score: 0
CWE: CWE-522
Published: 2021-04-06T17:32:38Z

Nats is a Node.js client for the NATS messaging system.

## Problem Description

_Preview versions_ of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials.

The _connection_ configuration options in these JavaScript-based implementations were fully serialized and sent to the server in the client's `CONNECT` message, immediately after TLS establishment.

The nats.js client supports Mutual TLS and the credentials for the TLS client key are included in the connection configuration options; disclosure of the client's TLS private key to the server has been observed.

Most authentication mechanisms are handled after connection, instead of as part of connection, so other authentication mechanisms are unaffected.
For clarity: NATS account NKey authentication **is NOT affected**.

Neither the nats.ws nor the nats.deno clients support Mutual TLS: the affected versions listed below are those where the logic flaw is
present.  We are including the nats.ws and nats.deno versions out of an abundance of caution, as library maintainers, but rate as minimal the likelihood of applications leaking sensitive data.


## Affected versions

### Security impact

* NPM package nats.js:
  + **mainline is unaffected**
  + beta branch is vulnerable from 2.0.0-201, fixed in 2.0.0-209

### Logic flaw

* NPM package nats.ws:
  + status: preview
  + flawed from 1.0.0-85, fixed in 1.0.0-111

* Deno repository https://github.com/nats-io/nats.deno
  + status: preview
  + flawed in all git tags prior to fix
  + fixed with git tag v1.0.0-9


## Impact

For deployments using TLS client certificates (for mutual TLS), private key material for TLS is leaked from the client application to the
server.  If the server is untrusted (run by a third party), or if the client application also disables TLS verification (and so the true identity of the server is unverifiable) then authentication credentials are leaked.

## Workaround

*None*

## Solution

Upgrade your package dependencies to fixed versions, and then reissue any TLS client credentials (with new keys, not just new certificates) and revoke the old ones.
Vulnerability: GHSA-7w7c-867m-4mqc
Summary: Malicious Package in rceat
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:04:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6635-c626-vj4r
Summary: Command Injection Vulnerability with Mercurial in VCS
Aliases: CVE-2022-21235
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-88, CWE-77
Published: 2022-04-01T14:05:33Z

URLs and local file paths passed to the Mercurial (hg) APIs that are specially crafted can contain commands which are executed by Mercurial if it is installed on the host operating system. The `vcs` package uses the underly version control system, in this case `hg`, to implement the needed functionality. When `hg` is executed, argument strings are passed to `hg` in a way that additional flags can be set. The additional flags can be used to perform a command injection. Other version control systems with an implemented interface may also be vulnerable. The issue has been fixed in version 1.13.2. A work around is to sanitize data passed to the `vcs` package APIs to ensure it does not contain commands or unexpected data. This is important for user input data that is passed directly to the package APIs.
Vulnerability: GHSA-2mvm-66q7-m256
Summary: Downloads Resources over HTTP in selenium-download
Aliases: CVE-2016-10559
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:40:25Z

Affected versions of `selenium-download` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-download`.


## Recommendation

Update to version 2.0.7 or later.
Vulnerability: GHSA-q42q-523g-3fwv
Summary: Cross-Site Request Forgery
Aliases: CVE-2020-7780
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-352
Published: 2022-02-09T23:06:40Z

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Vulnerability: GHSA-pwqf-9h7j-7mv8
Summary: Incorrect threshold signature computation in TUF
Aliases: CVE-2020-6174
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2020-08-21T16:25:26Z

### Impact
Metadadata signature verification, as used in `tuf.client.updater`, counted each of multiple signatures with identical authorized keyids  separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid.

The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.

### Patches
A [fix](https://github.com/theupdateframework/tuf/pull/974) is available in version [0.12.2](https://github.com/theupdateframework/tuf/releases/tag/v0.12.2) or newer.

### Workarounds
No workarounds are known for this issue.

### References
* [CVE-2020-6174](https://nvd.nist.gov/vuln/detail/CVE-2020-6174)
* Pull request resolving the issue [PR 974](https://github.com/theupdateframework/tuf/pull/974)
Vulnerability: GHSA-23r4-5mxp-c7g5
Summary: New anonymous user session acts as if it's created with password
Aliases: CVE-2021-39138
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-287
Published: 2021-08-23T19:41:52Z

### Impact

Developers that use the REST API to signup users and also allow users to login anonymously. When an anonymous user is first signed up using REST, the server creates session incorrectly, particularly the `authProvider` field in `_Session` class under `createdWith` shows the user logged in creating a password. If a developer later depends on the `createdWith` field to provide a different level of access between a password user and anonymous user, the server incorrectly classified the session type as being created with a `password`.

The server currently doesn't use `createdWith` to make decisions on how things work internally, so if a developer isn't using `createdWith` directly, there's nothing to worry about. The vulnerability only affects users who depend on `createdWith` by using it directly.   

### Patches
Upgrade to version 4.5.1.

### Workarounds
Don't use the `createdWith` Session field to make decisions if you allow anonymous login.

### References
n/a
Vulnerability: GHSA-8674-26jc-wh98
Summary: Improper Access Control in infinispan-server-runtime
Aliases: CVE-2020-25711
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-862, CWE-269
Published: 2022-02-09T22:56:32Z

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
Vulnerability: GHSA-cf55-rq8x-hm6f
Summary: Path Traversal in Dutchcoders transfer.sh
Aliases: CVE-2021-33497
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-22
Published: 2021-06-29T21:25:33Z

Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.
Vulnerability: GHSA-wc73-w5r9-x9pc
Summary: Cross-site Scripting in XXL-JOB
Aliases: CVE-2020-29204
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-12T16:41:36Z

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
Vulnerability: GHSA-4fr2-j4g9-mppf
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in deephas
Aliases: CVE-2020-28271
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-09-24T15:42:21Z

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-559q-92vx-xvjp
Summary: Malicious Package in qingting
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:44:36Z

All versions of `qingting` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fpv6-f8jw-rc3r
Summary: Remote code execution via the web UI backend
Aliases: CVE-2021-41088
Severity: MODERATE
CVSS score: 8
CWE: CWE-668
Published: 2021-09-23T23:17:33Z

### Impact

Elvish's backend for the experimental web UI (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI.

The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.

### Patches

All Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.

The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

### Workarounds

Do not use the experimental web UI.

### For more information

If you have any questions or comments about this advisory, please email xiaqqaix@gmail.com.
Vulnerability: GHSA-627p-rr78-99rj
Summary: GitLab auth uses full name instead of username as user ID, allowing impersonation
Aliases: CVE-2020-5415
Severity: CRITICAL
CVSS score: 7.5
CWE: CWE-290
Published: 2021-12-20T17:56:03Z

### Impact

Installations which use the GitLab auth connector are vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another GitLab user who is granted access to a Concourse team by having their full name listed under `users` in the team configuration or given to the `--gitlab-user` flag.

See the [GitLab auth docs](https://concourse-ci.org/gitlab-auth.html) for details.

Concourse installations which do not configure the GitLab auth connector are not affected.

### Patches

Concourse [v6.3.1](https://github.com/concourse/concourse/releases/tag/v6.3.1) and [v6.4.1](https://github.com/concourse/concourse/releases/tag/v6.4.1) were both released with a fix on August 4th, 2020.

Both versions change the GitLab connector to use the username, rather than the full name. This was always the intent, and the previous behavior was originally reported as a bug (concourse/dex#7) prior to being reported as a security issue.

Any Concourse teams which configure GitLab users will have to switch each user from their full name to their username upon upgrading to these versions.

### Workarounds

GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.

### References

* concourse/dex#12: PR with the fix

### For more information

If you have any questions or comments about this advisory, you may reach us privately at [concourseteam+security@gmail.com](mailto:concourseteam+security@gmail.com).
Vulnerability: GHSA-p24j-h477-76q3
Summary: Uncontrolled Search Path Element in sharkdp/bat
Aliases: CVE-2021-36753
Severity: HIGH
CVSS score: 7.8
CWE: CWE-427
Published: 2021-08-25T21:01:37Z

bat on windows before 0.18.2 executes programs named less.exe from the current working directory. This can lead to unintended code execution.
Vulnerability: GHSA-3r8j-pmch-5j2h
Summary: Internal exception message exposure for login action in Sylius
Aliases: CVE-2019-16768
Severity: LOW
CVSS score: 3.5
CWE: CWE-209
Published: 2019-12-05T19:57:04Z

## Internal exception message exposure for login action

### Impact
Exception messages from internal exceptions (like database exception) are wrapped by `\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. 

A validation message with the exception details will be presented to the user when one will try to log into the shop. 

### Patches
_Has the problem been patched? What versions should users upgrade to?_

### Workarounds
The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` file should be overridden and lines https://github.com/Sylius/Sylius/blob/1.4/src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig#L13-L17 should be replaced with
```twig
        {% if last_error %}
            <div class="ui left aligned basic segment">
                {{ messages.error(last_error.messageKey) }}
            </div>
        {% endif %}
``` 

The `messageKey` field should be used instead of the `message`.
Vulnerability: GHSA-2fw5-rvf2-jq56
Summary: High severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2014-0002
Severity: HIGH
CVSS score: 0
Published: 2018-10-16T23:13:26Z

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability: GHSA-gv87-q66h-4277
Summary: Command injection in itext7-core
Aliases: CVE-2021-43113
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-12-16T00:02:15Z

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
Vulnerability: GHSA-cg42-4wrc-gp47
Summary: Code Injection in node-extend
Aliases: CVE-2020-7673
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-17T21:00:37Z

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.
Vulnerability: GHSA-4w2v-q235-vp99
Summary: Server-Side Request Forgery in Axios
Aliases: CVE-2020-28168
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2021-01-04T20:59:40Z

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Vulnerability: GHSA-gwcx-jrx4-92w2
Summary: Segfault in `simplifyBroadcast` in Tensorflow
Aliases: CVE-2022-23593
Severity: HIGH
CVSS score: 5.9
CWE: CWE-754
Published: 2022-02-09T23:32:08Z

### Impact
The [`simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205) is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.

```cc 
  size_t maxRank = 0;
  for (auto shape : llvm::enumerate(shapes)) {
    auto found_shape = analysis.dimensionsForShapeTensor(shape.value());
    if (!found_shape) return {};
    shapes_found.push_back(*found_shape);
    maxRank = std::max(maxRank, found_shape->size());
  }   

  SmallVector<const ShapeComponentAnalysis::SymbolicDimension*>
      joined_dimensions(maxRank);
```

If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`.

### Patches
We have patched the issue in GitHub commit [35f0fabb4c178253a964d7aabdbb15c6a398b69a](https://github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69a).

The fix will be included in TensorFlow 2.8.0. This is the only affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-jcxv-2j3h-mg59
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
Aliases: CVE-2017-17760
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-119
Published: 2021-10-12T22:03:09Z

OpenCV 3.3.1 (corresponding with opencv-python and opencv-contrib-python 3.3.1.11) has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
Vulnerability: GHSA-j9f8-8h89-j69x
Summary: Remote Code Execution in node-os-utils
Severity: HIGH
CVSS score: 7.3
CWE: CWE-94
Published: 2019-06-11T16:16:34Z

Versions of `node-os-utils` prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

Upgrade to version 1.1.0 or later.
Vulnerability: GHSA-6w9p-88qg-p3g3
Summary: Cross-site Scripting in CKAN
Aliases: CVE-2021-25967
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-12-03T20:44:48Z

In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture
Vulnerability: GHSA-jc4v-vvg6-xg78
Summary: SQL Injection in ImpressCMS
Aliases: CVE-2021-26599
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
Vulnerability: GHSA-xq8r-r72r-pqwm
Summary: Downloads Resources over HTTP in roslib-socketio
Aliases: CVE-2016-10681
Severity: HIGH
CVSS score: 8.1
CWE: CWE-311
Published: 2020-09-01T16:13:18Z

Affected versions of `roslib-socketio` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `roslib-socketio`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.