TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-69mf-2cw2-38m8
Summary: Malicious Package in js-shc3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:04:40Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-xg75-3277-gvvj
Summary: Directory Traversal in serve
Aliases: CVE-2019-5417
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-03-25T18:04:01Z

Versions of `serve` before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files.


## Recommendation

Upgrade to version 7.1.3 or later
Vulnerability: GHSA-x7rv-cr6v-4vm4
Summary: Moderate severity vulnerability that affects loofah
Aliases: CVE-2018-8048
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-03-21T11:57:11Z

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX,
* in combination with libxml2 >= 2.9.2.

Please note: JRuby users are not affected.
Vulnerability: GHSA-9c8h-2mv3-49ww
Summary: Division by 0 in most convolution operators
Aliases: CVE-2021-37675
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:41:29Z

### Impact
Most implementations of convolution operators in TensorFlow are affected by a division by 0 vulnerability where an attacker can trigger a denial of service via a crash:

```python
import tensorflow as tf

tf.compat.v1.disable_v2_behavior()
tf.raw_ops.Conv2D(
  input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32),
  filter = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32),
  strides = [1, 1, 1, 1],
  padding = "SAME")
```

The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/framework/common_shape_fns.cc#L577) is missing several validations before doing divisions and modulo operations.

### Patches
We have patched the issue in GitHub commit [8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4](https://github.com/tensorflow/tensorflow/commit/8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-65p7-pjj8-ggmr
Summary: Member account takeover
Severity: MODERATE
CVSS score: 6.5
Published: 2021-09-23T23:18:42Z

### Impact

An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the new email address.

Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 3.18.0 and 4.15.0 with members functionality enabled.

### Patches

Fixed in 4.15.1, all 4.x sites should upgrade as soon as possible.
Fixed in 3.42.6, all 3.x sites should upgrade as soon as possible.

### Workarounds

The patch in 4.15.1 and 3.42.6 adds a new authenticated endpoint for updating member email addresses. Updating Ghost is the quickest complete solution.

As a workaround, if for any reason you cannot update your Ghost instance, you can block the `POST /members/api/send-magic-link/` endpoint, which will also disable member login and signup for your site.

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@ghost.org](mailto:security@ghost.org)
Vulnerability: GHSA-6hfq-h8hq-87mf
Summary: HTTP Request Smuggling in hyper
Aliases: CVE-2021-21299
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-444
Published: 2021-08-25T20:56:18Z

### Summary

hyper's HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smuggling" or "desync attacks".

### Vulnerability

The flaw was introduced in https://github.com/hyperium/hyper/commit/26417fc24a7d05df538e0f39239b373c5c3d61f6, released in v0.12.0.

Consider this example request:

```
POST /yolo HTTP/1.1
Transfer-Encoding: chunked
Transfer-Encoding: cow
```

This request *should* be rejected, according to RFC 7230, since it has a `Transfer-Encoding` header, but after folding, it does not end in `chunked`. hyper would notice the `chunked` in the first line, and then check the second line, and thanks to a missing boolean assignment, *not* set the error condition. hyper would treat the payload as being `chunked`. By differing from the spec, it is possible to send requests like these to endpoints that have different HTTP implementations, with different interpretations of the payload semantics, and cause "desync attacks".

There are several parts of the spec that must also be checked, and hyper correctly handles all of those. Additionally, hyper's *client* does not allow sending requests with improper headers, so the misunderstanding cannot be propagated further.

Read more about desync attacks: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

### Impact

To determine if vulnerable, all these things must be true:

- **Using hyper as an HTTP *server*.** The client is not affected.
- **Using HTTP/1.1.** HTTP/2 does not use `transfer-encoding`.
- **Using a vulnerable HTTP proxy upstream to hyper.** If an upstream proxy correctly rejects the illegal transfer-encoding headers, the desync attack cannot succeed. If there is *no* proxy upstream of hyper, hyper cannot *start* the desync attack, as the client will repair the headers before forwarding.

### Patches

We have released and backported the following patch versions:

- v0.14.3
- v0.13.10

### Workarounds

Besides upgrading hyper, you can take the following options:

- Reject requests that contain a `transfer-encoding` header.
- Ensure any upstream proxy handles `transfer-encoding` correctly.

### Credits

This issue was initially reported by ZeddYu Lu From Qi An Xin Technology Research Institute.
Vulnerability: GHSA-cgjv-rghq-qhgp
Summary: Path Traversal in algo-httpserv
Severity: HIGH
CVSS score: 8.6
CWE: CWE-22
Published: 2019-09-11T23:00:57Z

Versions of `algo-httpserv` prior to 1.1.2 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.1.2 or later.
Vulnerability: GHSA-vfvf-mqq8-rwqc
Summary: Sanitization bypass using HTML Entities in marked
Aliases: CVE-2016-10531
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-02-18T23:58:20Z

Affected versions of `marked` are susceptible to a cross-site scripting vulnerability in link components when `sanitize:true` is configured. 

## Proof of Concept

This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.

For example:

A link URI such as
```
javascript&#x58document;alert&#40;1&#41;
```
Renders a valid link that when clicked will execute `alert(1)`.


## Recommendation

Update to version 0.3.6 or later.
Vulnerability: GHSA-j3cr-j9jx-mf4p
Summary: Downloads Resources over HTTP in redis-srvr
Aliases: CVE-2016-10639
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:07Z

Affected versions of `redis-srvr` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `redis-srvr`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-vp6r-mrq9-8f4h
Summary: Data race in syncpool
Aliases: CVE-2020-36462
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:58:11Z

An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
Vulnerability: GHSA-m3jw-62m7-jjcm
Summary: Out-of-bounds read in typed-ast and cpython may allow an attacker to crash the interpreter process (handle_keywordonly_args case).
Aliases: CVE-2019-19274
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2019-12-02T18:02:02Z

typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)
Vulnerability: GHSA-q3g3-h9r4-prrc
Summary: Reference binding to nullptr and heap OOB in binary cwise ops
Aliases: CVE-2021-37659
Severity: HIGH
CVSS score: 7.3
CWE: CWE-125
Published: 2021-08-25T14:42:47Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in all binary cwise operations that don't require broadcasting (e.g., gradients of binary cwise operations):

```python
import tensorflow as tf

tf.raw_ops.SqrtGrad(y=[4, 16],dy=[])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/cwise_ops_common.h#L264) assumes that the two inputs have exactly the same number of elements but does not check that. Hence, when the eigen functor executes it triggers heap OOB reads and undefined behavior due to binding to nullptr.

### Patches
We have patched the issue in GitHub commit [93f428fd1768df147171ed674fee1fc5ab8309ec](https://github.com/tensorflow/tensorflow/commit/93f428fd1768df147171ed674fee1fc5ab8309ec).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by members of the Aivul Team from Qihoo  360.
Vulnerability: GHSA-46j3-r4pj-4835
Summary: The host name verification missing in Apache Tomcat
Aliases: CVE-2018-8034
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2018-10-17T16:32:43Z

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
Vulnerability: GHSA-jjgw-jf33-7fg9
Summary: Directory Traversal in mfrs
Aliases: CVE-2017-16193
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:22:48Z

Affected versions of `mfrs` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jcjx-c3j3-44pr
Summary: Insufficient Session Expiration in @cyyynthia/tokenize
Severity: HIGH
CVSS score: 0
CWE: CWE-613
Published: 2021-11-10T16:44:12Z

### Impact
A bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the `lastTokenReset` field.

### Patches
Version 1.1.3 contains a patch that'll invalidate these faulty tokens and make new ones behave as expected.

### Workarounds
None. Tokens do not hold the necessary information to perform invalidation anymore.

### References
PR #1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/cyyynthia/tokenize](https://github.com/cyyynthia/tokenize)
* Email us at [cynthia@cynthia.dev](mailto:cynthia@cynthia.dev)
Vulnerability: GHSA-3j78-7m59-r7gv
Summary: Private data exposure via REST API in BuddyPress
Aliases: CVE-2020-5244
Severity: HIGH
CVSS score: 8
CWE: CWE-284
Published: 2020-02-24T17:18:26Z

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.

This has been patched in version 5.1.2.
Vulnerability: GHSA-xrg9-wwrq-xmx9
Summary: Missing Authorization
Aliases: CVE-2021-21661
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2021-06-16T17:11:30Z

Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability: GHSA-gvvv-w559-2hg6
Summary: Data races in scottqueue
Aliases: CVE-2020-36453
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362
Published: 2021-08-25T20:57:17Z

An issue was discovered in the scottqueue crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for Queue<T>. This allows (1) creating data races to a `T: !Sync` and (2) sending `T: !Send` to other threads, resulting in memory corruption or other undefined behavior.
Vulnerability: GHSA-q73m-3q7r-fpf7
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0957
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:48Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability: GHSA-rv6q-p3x7-43fx
Summary: Malicious Package in bitcoimjs-lib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:37:50Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xr8h-53xr-jhcm
Summary: Path Traversal in marked-tree
Aliases: CVE-2020-7682
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-07T16:06:43Z

This affects all versions up to and including version 0.8.1 of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
Vulnerability: GHSA-h65g-jfqg-2w6m
Summary: Server-Side Request Forgery in calibreweb
Aliases: CVE-2022-0767
Severity: CRITICAL
CVSS score: 9.9
CWE: CWE-918
Published: 2022-03-08T00:00:31Z

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.
Vulnerability: GHSA-g6rj-rv7j-xwp4
Summary: Denial of service
Aliases: CVE-2021-28675
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-233, CWE-252
Published: 2021-06-08T18:49:11Z

An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
Vulnerability: GHSA-77m6-x95j-75r5
Summary: Data races in ticketed_lock
Aliases: CVE-2020-36439
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:58:58Z

An issue was discovered in the ticketed_lock crate before 0.3.0 for Rust. There are unconditional implementations of Send for ReadTicket<T> and WriteTicket<T>.
Vulnerability: GHSA-23v3-qfrj-wmgh
Summary: Moderate severity vulnerability that affects actionpack
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:54:22Z

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
Vulnerability: GHSA-7889-rm5j-hpgg
Summary: Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality
Aliases: CVE-2021-32809
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-94, CWE-79
Published: 2021-08-23T19:40:57Z

### Affected packages
The vulnerability has been discovered in [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin. All plugins with [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin dependency are affected:

* [clipboard](https://ckeditor.com/cke4/addon/clipboard)
* [pastetext](https://ckeditor.com/cke4/addon/pastetext)
* [pastetools](https://ckeditor.com/cke4/addon/pastetools)
* [widget](https://ckeditor.com/cke4/addon/widget)
* [uploadwidget](https://ckeditor.com/cke4/addon/uploadwidget)
* [autolink](https://ckeditor.com/cke4/addon/autolink)
* [tableselection](https://ckeditor.com/cke4/addon/tableselection)

### Impact
A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-8g3r-968r-c644
Summary: Malicious Package in jw-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:15:58Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-fg7r-2g4j-5cgr
Summary: Race Condition in tokio
Aliases: CVE-2021-45710
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362
Published: 2022-01-06T22:04:37Z

An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.
Vulnerability: GHSA-r854-96gq-rfg3
Summary: Python Image Library (PIL) allows symlink attacks
Aliases: CVE-2014-1933
Severity: MODERATE
CVSS score: 0
Published: 2020-05-18T17:41:19Z

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
Vulnerability: GHSA-363h-vj6q-3cmj
Summary: Rosetta-Flash JSONP Vulnerability in hapi
Aliases: CVE-2014-4671
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2020-08-31T22:45:35Z

This description taken from the pull request provided by Patrick Kettner.



Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy.





## Recommendation

- Update hapi to version 6.1.1 or later.

Alternatively, a solution previously implemented by Google, Facebook, and Github is to prepend callbacks with an empty inline comment. This will cause the flash parser to break on invalid inputs and prevent the issue, and how the issue has been resolved internally in hapi.
Vulnerability: GHSA-2c8c-84w2-j38j
Summary: Improper Restriction of XML External Entity Reference in Plone
Aliases: CVE-2020-28736
Severity: HIGH
CVSS score: 8.8
CWE: CWE-611
Published: 2021-04-07T21:14:00Z

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
Vulnerability: GHSA-wfjw-w6pv-8p7f
Summary: Observable Response Discrepancy in Flask-AppBuilder
Aliases: CVE-2022-21659
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-203
Published: 2022-02-01T00:47:53Z

### Impact
User enumeration in database authentication in Flask-AppBuilder  < 3.4.4. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.

### Patches
Upgrade to 3.4.4

### Workarounds

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Vulnerability: GHSA-9p29-94hp-8rvc
Summary: XSS in qiita-markdown
Aliases: CVE-2021-28833
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-02T17:22:07Z

Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796.
Vulnerability: GHSA-9mx2-prfp-8hqp
Summary: Prototype Pollution in simpl-schema
Aliases: CVE-2020-7742
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2021-05-10T18:38:47Z

This affects the package simpl-schema before 1.10.2. Attacker controlled input into a schema could result in remote code execution within the scope of the surrounding application.
Vulnerability: GHSA-hrpq-r399-whgw
Summary: Sandbox Breakout / Arbitrary Code Execution in safe-eval
Aliases: CVE-2020-7710
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2020-08-25T23:40:53Z

All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. 

Evaluating the payload 
```
(function (){
  var ex = new Error
  ex.__proto__ = null
  ex.stack = {
    match: x => {
      return x.constructor.constructor("throw process.env")()
    }
  }
  return ex
})()
``` 

prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-xwg3-gjxh-c8pm
Summary: Malicious Package in ngx-context-menu
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:14:32Z

Version 0.0.26 of `ngx-context-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8w26-6f25-cm9x
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36185
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:02Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
Vulnerability: GHSA-49rx-x2rw-pc6f
Summary: Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops
Aliases: CVE-2021-41205
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-11-10T19:04:25Z

### Impact
The [shape inference functions for the `QuantizeAndDequantizeV*` operations](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/array_ops.cc) can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs:

```python
import tensorflow as tf

@tf.function
def test():
  data=tf.raw_ops.QuantizeAndDequantizeV4Grad(
    gradients=[1.0,1.0],
    input=[1.0,1.0],
    input_min=[1.0,10.0],
    input_max=[1.0,10.0],
    axis=-100)
  return data

test()
```

```python
import tensorflow as tf

@tf.function
def test():
  data=tf.raw_ops.QuantizeAndDequantizeV4(
    input=[1.0,1.0],
    input_min=[1.0,10.0],
    input_max=[1.0,10.0],
    signed_input=False,
    num_bits=10,
    range_given=False,
    round_mode='HALF_TO_EVEN',
    narrow_range=False,
    axis=-100)
  return data

test()
```

```python
import tensorflow as tf

@tf.function
def test():
  data=tf.raw_ops.QuantizeAndDequantizeV3(
    input=[1.0,1.0],
    input_min=[1.0,10.0],
    input_max=[1.0,10.0],
    signed_input=False,
    num_bits=10,
    range_given=False,
    narrow_range=False,
    axis=-100)
  return data

test()
```

```python
import tensorflow as tf

@tf.function
def test():
  data=tf.raw_ops.QuantizeAndDequantizeV2(
    input=[1.0,1.0],
    input_min=[1.0,10.0],
    input_max=[1.0,10.0],
    signed_input=False,
    num_bits=10,
    range_given=False,
    round_mode='HALF_TO_EVEN',
    narrow_range=False,
    axis=-100)
  return data

test()
```

In all of these cases, `axis` is a negative value different than the special value used for optional/unknown dimensions (i.e., -1). However, the code ignores the occurences of these values:

```cc
...
if (axis != -1) {
  ...
  c->Dim(input, axis);
  ...
}
```

### Patches
We have patched the issue in GitHub commit [7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d](https://github.com/tensorflow/tensorflow/commit/7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-5xwc-mrhx-5g3m
Summary: Reference binding to nullptr in `MatrixDiagV*` ops
Aliases: CVE-2021-37657
Severity: HIGH
CVSS score: 7.1
CWE: CWE-824
Published: 2021-08-25T14:42:52Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixDiagV*`:

```python
import tensorflow as tf

tf.raw_ops.MatrixDiagV3(
  diagonal=[1,0],
  k=[],
  num_rows=[1,2,3],
  num_cols=[4,5],
  padding_value=[],
  align='RIGHT_RIGHT')
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong:

```cc
  auto& diag_index = context->input(1);
  ...
  lower_diag_index = diag_index.flat<int32>()(0);
```

### Patches
We have patched the issue in GitHub commit [f2a673bd34f0d64b8e40a551ac78989d16daad09](https://github.com/tensorflow/tensorflow/commit/f2a673bd34f0d64b8e40a551ac78989d16daad09).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-p7w9-8mxw-p3g7
Summary: Improper Certificate Validation in Hutool
Aliases: CVE-2022-22885
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-295
Published: 2022-02-17T00:00:26Z

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
Vulnerability: GHSA-hrf4-hcpc-3345
Summary: Denial of service in microweber
Aliases: CVE-2022-0961
Severity: HIGH
CVSS score: 7.1
CWE: CWE-190
Published: 2022-03-16T00:00:48Z

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The post title input can be limited to 500 characters or max 1000 characters as a workaround.
Vulnerability: GHSA-84px-q68r-2fc9
Summary: Privilege escalation in the Sulu Admin panel
Aliases: CVE-2021-43835
Severity: HIGH
CVSS score: 7.2
CWE: CWE-269
Published: 2021-12-15T22:55:16Z

### Impact

Impacted are only users which already have access to the admin UI. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction.

### Patches

The versions have been patched in 2.2.18, 2.3.8 and 2.4.0.

### Workarounds

Patching the ProfileController of affected sulu versions yourself by overwriting it.

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [sulu/sulu repo](https://github.com/sulu/sulu/issues)
* Email us at [security@sulu.io](mailto:security@sulu.io)
Vulnerability: GHSA-5684-g483-2249
Summary: Signature Validation Bypass
Severity: CRITICAL
CVSS score: 0
CWE: CWE-347
Published: 2021-05-24T16:59:47Z

### Impact
Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one.

This enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the identity provider, or full authentication bypass if an external attacker can obtain an expired, signed SAML Response.

### Patches
A patch is available, users of gosaml2 should upgrade to v0.5.0 or higher.

### References
See the [underlying advisory on goxmldsig](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7) for more details.
Vulnerability: GHSA-97pv-4338-r5vp
Summary: Cross-site Scripting in file-upload-with-preview
Aliases: CVE-2021-23439
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-79
Published: 2021-09-07T23:08:54Z

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
Vulnerability: GHSA-cqh2-vc2f-q4fh
Summary: Arbitrary filepath traversal via URI injection 
Aliases: CVE-2021-3907
Severity: HIGH
CVSS score: 7.4
CWE: CWE-20, CWE-22
Published: 2021-11-10T20:08:29Z

OctoRPKI does not escape a URI with a filename containing "..", this allows a repository to create a file, (ex.  `rsync://example.org/repo/../../etc/cron.daily/evil.roa`), which would then be written to disk outside the base cache folder. This could allow for remote code execution on the host machine OctoRPKI is running on. 

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-mj4x-wcxf-hm8x
Summary: Json-jwt (RubyGems) did not verify, or incorrectly verifies, the cryptographic signature for data
Aliases: CVE-2018-1000539
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-347
Published: 2018-07-31T18:13:51Z

The json-jwt rubygem version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 1.9.4 and later.
Vulnerability: GHSA-qpwf-4fx5-crqq
Summary: Directory Traversal in earlybird
Aliases: CVE-2017-16154
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:19:36Z

Affected versions of `earlybird` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-w3f3-4j22-2v3p
Summary: Malicious Package in destroyer-of-worlds
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:27:02Z

The package `destroyer-of-worlds` contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop. The script targeted UNIX systems.


## Recommendation

Remove the package from your environment and perform additional incident response on your system's files and processes.
Vulnerability: GHSA-3944-787c-f852
Summary: Persistent Cross-Site scripting in Nexus Repository Manager
Aliases: CVE-2020-10203
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2020-04-14T15:27:21Z

Sonatype Nexus Repository before 3.21.2 allows XSS.
Vulnerability: GHSA-vw2g-5827-m9fp
Summary: Out-of-bounds write
Aliases: CVE-2019-1308
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:55:52Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1307, CVE-2019-1335, CVE-2019-1366.
Vulnerability: GHSA-vc29-rj92-gc7j
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2017-12606
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-10-12T22:02:12Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reading an image file by using cv::imread.
Vulnerability: GHSA-2h3x-95c6-885r
Summary: Malicious Package in river-mock
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:46:46Z

All versions of `river-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3269-x4pw-vffg
Summary: OS Command Injection in diskusage-ng
Aliases: CVE-2020-7631
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-01-07T00:21:08Z

diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.
Vulnerability: GHSA-68vr-8f46-vc9f
Summary: Username spoofing in OnionShare
Aliases: CVE-2022-21696
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20
Published: 2022-01-21T23:20:14Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-005
- Vulnerability type: Improper Input Sanitization
- Threat level: Low

## Description:

It is possible to change the username to that of another chat participant with an additional space character at the end of the name string.

## Technical description:

Assumed users in Chat:

- Alice
- Bob
- Mallory

1. Mallory renames to `Alice `.
2. Mallory sends message as `Alice `.
3. Alice and Bob receive a message from Mallory disguised as `Alice `, which is hard to distinguish from the `Alice`
in the web interface.

![otf-005-a](https://user-images.githubusercontent.com/156128/140666112-8febd4d8-6761-41aa-955c-48be76f3c657.png)
![otf-005-b](https://user-images.githubusercontent.com/156128/140666113-1713ddf7-cef6-4dac-b718-9af1dc4ffdcd.png)

Other (invisible) whitespace characters were found to be working as well.

## Impact:

An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.

## Recommendation:

- Remove non-visible characters from the username
Vulnerability: GHSA-vcr5-xr9h-mvc5
Summary: Moderate severity vulnerability that affects python-gnupg
Aliases: CVE-2014-1929
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2018-11-06T23:12:48Z

python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Vulnerability: GHSA-2ggq-vfcp-gwhj
Summary: Cross-Site Scripting in @hapi/boom
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2020-09-04T17:33:53Z

Versions of `@hapi/boom` prior t 0.3.8 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.3.8 or later.
Vulnerability: GHSA-6m53-c78q-7qmg
Summary: Mitmweb in mitmproxy allows DNS Rebinding attacks
Aliases: CVE-2018-14505
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2018-07-31T18:18:19Z

mitmweb in mitmproxy before v4.0.4 allows DNS Rebinding attacks, related to tools/web/app.py.
Vulnerability: GHSA-5q88-cjfq-g2mh
Summary: codecov NPM module allows remote attackers to execute arbitrary commands
Aliases: CVE-2020-7597
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2020-02-19T17:29:39Z

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
Vulnerability: GHSA-9qvw-46gf-4fv8
Summary: Use After Free in tremor-script
Aliases: CVE-2021-45702
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:09:07Z

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free.
Vulnerability: GHSA-75c5-f4gw-38r9
Summary: Multiple vulnerabilities through filename manipulation in Archive_Tar
Aliases: CVE-2020-28949
Severity: HIGH
CVSS score: 7.8
CWE: CWE-74
Published: 2021-04-22T16:20:59Z

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33
Vulnerability: GHSA-vcgf-vmpc-ph79
Summary: Improper Access Control in microweber
Aliases: CVE-2022-0277
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-284, CWE-269
Published: 2022-01-21T18:06:16Z

Improper Access Control in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-wg37-7mrv-cfwm
Summary: Low severity vulnerability that affects org.apache.jmeter:ApacheJMeter
Aliases: CVE-2019-0187
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-327, CWE-502
Published: 2019-03-07T18:47:57Z

Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.
Vulnerability: GHSA-2cjf-w7c4-fhf6
Summary: Cross-site Scripting in Beanstalk console
Aliases: CVE-2022-0539
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2022-02-10T00:00:30Z

Beanstalk console (ptrofimov/beanstalk_console) prior to 1.7.14 is vulnerable to cross-site scripting.
Vulnerability: GHSA-gh8h-7j2j-qv4f
Summary: Incomplete validation in `tf.summary.create_file_writer`
Aliases: CVE-2021-41200
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-617
Published: 2021-11-10T19:31:16Z

### Impact
If `tf.summary.create_file_writer` is called with non-scalar arguments code crashes due to a `CHECK`-fail.

```python
import tensorflow as tf
import numpy as np
tf.summary.create_file_writer(logdir='', flush_millis=np.ones((1,2)))
```

### Patches
We have patched the issue in GitHub commit [874bda09e6702cd50bac90b453b50bcc65b2769e](https://github.com/tensorflow/tensorflow/commit/874bda09e6702cd50bac90b453b50bcc65b2769e) (merging [#51715](https://github.com/tensorflow/tensorflow/pull/51715)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46909).
Vulnerability: GHSA-98mf-8f57-64qf
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-3463
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.
Vulnerability: GHSA-g753-jx37-7xwh
Summary: ECDSA signature vulnerability of Minerva timing attack in jsrsasign
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2020-06-30T16:05:08Z

### Impact
ECDSA side-channel attack named [Minerava](https://minerva.crocs.fi.muni.cz/) have been found and it was found that it affects to jsrsasign.

Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits of scalar. In jsrsasign 8.0.13 or later, execution time of EC point and scalar multiplication is almost constant and fixed for the issue.

- Minerva is one of timing attack or side channel attack for EC.
- If you don't use ECDSA class, you are not affected the vulnerability.
- The vulnerability is that attacker may guess private key by checking processing time of EC key generation or ECDSA signing.
- The cause issue is that point multiplication processing time in ECDSA signing is depends on private key value.
- After 8.0.13, processing time of point multiplication in ECDSA signing have become constant for key value in theory.

### Patches
Users using ECDSA signature generation should upgrade to 8.0.13 or later.

### Workarounds
There is no workarounds in jsrsasign. Update jsrsasign or use other ECDSA library.

### ACKNOWLEDGEMENT
Thanks to Jan Jancar @J08nY, Petr Svenda and Vladimir Sedlacek of Masaryk University in Czech Republic to find and report this vulnerability.

### References
https://minerva.crocs.fi.muni.cz/
https://www.npmjs.com/advisories/1505
https://github.com/kjur/jsrsasign/issues/411
Vulnerability: GHSA-x3rq-r3cm-5vc4
Summary: Business Logic Errors in Publify
Aliases: CVE-2022-0524
Severity: HIGH
CVSS score: 7.5
Published: 2022-02-09T00:00:27Z

Publify (formerly known as Typo) prior to version 9.2.7 is vulnerable to business logic errors.
Vulnerability: GHSA-rvg5-f5fj-mxvg
Summary: Cross-site Scripting in Jenkins Credentials Plugin
Aliases: CVE-2022-29036
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-13T00:00:18Z

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-7cv6-gvx3-m54m
Summary: Cross-Site Scripting in keystone
Aliases: CVE-2017-15881
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2017-11-16T01:47:02Z

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having access to an admin account.


## Recommendation

Update to version 4.0.0 or later.
Vulnerability: GHSA-2m8v-572m-ff2v
Summary: Command Injection Vulnerability
Aliases: CVE-2021-21315
Severity: MODERATE
CVSS score: 0
CWE: CWE-78
Published: 2021-02-16T16:51:04Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.3.1

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Vulnerability: GHSA-4wch-fwmx-cf47
Summary: Directory Traversal in augustine
Aliases: CVE-2017-0930
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-09-18T13:50:25Z

Affected versions of `augustine` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

## Proof of Concept
```
GET //etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No direct patch is available at this time. 

Currently, the best mitigation for this flaw is to use a different, functionally equivalent static file server package.