TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7p99-3798-f85c
Summary: URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect
Aliases: CVE-2022-24794
Severity: HIGH
CVSS score: 7.5
CWE: CWE-601
Published: 2022-03-31T22:44:47Z

### Impact
Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route.

If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitised.

### Am I affected?
You are affected by this vulnerability if you are using the `requiresAuth` middleware on a catch all route or the default `authRequired` option and `express-openid-connect` version `<=2.7.1`.

### How to fix that?
Upgrade to version `>=2.7.2`

### Will this update impact my users?
The fix provided in the patch will not affect your users.
Vulnerability: GHSA-x9gm-qxhh-rf75
Summary: Malicious Package in cordova-plugin-china-picker
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:51:28Z

Version 1.0.910 of `cordova-plugin-china-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.910 of this module is found installed you will want to replace it with a version before or after 1.0.910. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-r3vr-prwv-86g9
Summary: High severity vulnerability that affects python-gnupg
Aliases: CVE-2014-1927
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2018-11-06T23:14:39Z

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.
Vulnerability: GHSA-j8c8-67vp-6mx7
Summary: Arbitrary memory read in `ImmutableConst`
Aliases: CVE-2021-41227
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-125
Published: 2021-11-10T18:34:49Z

### Impact
The `ImmutableConst` operation in TensorFlow can be tricked into reading arbitrary memory contents:

```python
import tensorflow as tf
  
with open('/tmp/test','wb') as f:
    f.write(b'\xe2'*128)
    data = tf.raw_ops.ImmutableConst(dtype=tf.string,shape=3,memory_region_name='/tmp/test')
  
print(data)
```
  
This is because the `tstring` TensorFlow string class has a special case for memory mapped strings but the operation itself does not offer any support for this datatype.

### Patches
We have patched the issue in GitHub commit [3712a2d3455e6ccb924daa5724a3652a86f6b585](https://github.com/tensorflow/tensorflow/commit/3712a2d3455e6ccb924daa5724a3652a86f6b585) and GitHub commit [1cb6bb6c2a6019417c9adaf9e6843ba75ee2580b](https://github.com/tensorflow/tensorflow/commit/1cb6bb6c2a6019417c9adaf9e6843ba75ee2580b).
  
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-h7mq-27r7-w972
Summary: Cross-site Scripting in GilaCMS
Aliases: CVE-2020-20696
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-09-30T17:13:02Z

A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field.
Vulnerability: GHSA-cmch-296j-wfvw
Summary: Arbitrary File Write in iobroker.js-controller
Aliases: CVE-2019-10767
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-12-02T18:06:14Z

Versions of `iobroker.controller` prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended `/adapter/<adapter-name>` folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.


## Recommendation

Upgrade to version 2.0.25 or later.
Vulnerability: GHSA-cw98-cx2m-9qqg
Summary: Denial of Service in ckb
Aliases: CVE-2021-45700
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-01-06T22:10:08Z

An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
Vulnerability: GHSA-x6gq-467r-hwcc
Summary: Malicious Package in soket.js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:14:05Z

All versions of `soket.js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-v4rr-65x6-g69f
Summary: XXE vulnerability in Jenkins Flaky Test Handler Plugin
Aliases: CVE-2022-28140
Severity: HIGH
CVSS score: 8.1
CWE: CWE-611
Published: 2022-03-30T00:00:25Z

Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-6gmv-pjp9-p8w8
Summary: Out of bounds read in Tensorflow
Aliases: CVE-2022-21728
Severity: HIGH
CVSS score: 8.1
CWE: CWE-125
Published: 2022-02-09T18:29:24Z

### Impact 
The [implementation of shape inference for `ReverseSequence`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/ops/array_ops.cc#L1636-L1671) does not fully validate the value of `batch_dim` and can result in a heap OOB read:

```python
import tensorflow as tf

@tf.function
def test():
  y = tf.raw_ops.ReverseSequence(
    input = ['aaa','bbb'],
    seq_lengths = [1,1,1],
    seq_dim = -10,
    batch_dim = -10 )
  return y
    
test()
```

There is a check to make sure the value of `batch_dim` does not go over the rank of the input, but there is no check for negative values:

```cc
  const int32_t input_rank = c->Rank(input);
  if (batch_dim >= input_rank) {
    return errors::InvalidArgument( 
        "batch_dim must be < input rank: ", batch_dim, " vs. ", input_rank);
  }
  // ...
  
  DimensionHandle batch_dim_dim = c->Dim(input, batch_dim);
``` 
    
Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then [the implementation of `Dim`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/shape_inference.h#L415-L428) would access elements before the start of an array:

```cc
  DimensionHandle Dim(ShapeHandle s, int64_t idx) {
    if (!s.Handle() || s->rank_ == kUnknownRank) {
      return UnknownDim();
    }
    return DimKnownRank(s, idx);
  } 
·
  static DimensionHandle DimKnownRank(ShapeHandle s, int64_t idx) {
    CHECK_NE(s->rank_, kUnknownRank);
    if (idx < 0) {
      return s->dims_[s->dims_.size() + idx];
    }
    return s->dims_[idx];
  }
```

### Patches
We have patched the issue in GitHub commit [37c01fb5e25c3d80213060460196406c43d31995](https://github.com/tensorflow/tensorflow/commit/37c01fb5e25c3d80213060460196406c43d31995).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-j878-43hm-8gr5
Summary: Unrestricted Upload of File with Dangerous Type in Microweber
Aliases: CVE-2022-0921
Severity: MODERATE
CVSS score: 6.7
CWE: CWE-434
Published: 2022-03-12T00:00:30Z

In Microweber prior to 1.2.12, a malicious actor may abuse the Backup/Restore feature to achieve Remote Code Execution.
Vulnerability: GHSA-p6mr-pxg4-68hx
Summary: Symlink Arbitrary File Overwrite in bower
Aliases: CVE-2019-5484
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-09-17T23:21:34Z

Versions of `bower` prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `bower` does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.



## Recommendation

Update to version 1.8.8 or later
Vulnerability: GHSA-37jj-wp7g-7wj4
Summary: Read of uninitialized memory in cdr
Aliases: CVE-2021-26305
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2021-08-25T20:53:12Z

An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.
Vulnerability: GHSA-58qp-5328-v7mh
Summary: Improper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-function
Aliases: CVE-2021-29486
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835, CWE-20
Published: 2021-05-04T17:43:36Z

### Impact

* Apps using this library on improper data may crash or go into an infinite-loop
* In the case of a nodejs server-app using this library to act on invalid non-numeric data, the nodejs server may crash.  This may affect other users of this server and/or require the server to be rebooted for proper operation.  
* In the case of a browser app using this library to act on invalid non-numeric data, that browser may crash or lock up.

A flaw enabling an infinite-loop was discovered in the code for evaluating the cumulative-distribution-function
of input data.   Although the documentation explains that numeric data is required, some users may confuse an array
of strings like ["1","2","3","4","5"] for numeric data [1,2,3,4,5] when it is in fact string data.  An infinite loop is possible when the 
cumulative-distribution-function  is evaluated for a given point when the input data is string data rather than type `number`.  

This vulnerability enables an infinite-cpu-loop denial-of-service-attack on any app using npm:cumulative-distribution-function v1.0.3 or earlier if the attacker can supply malformed data to the library.  The vulnerability could also manifest if a data source to
be analyzed changes data type from Arrays of number (proper) to Arrays of string (invalid, but undetected by earlier version of the library).

### Patches

Users should upgrade to at least v2.0.0, or the latest version.

Tests for several types of invalid data have been created, and version 2.0.0 has been tested to reject this invalid data by
throwing a `TypeError()` instead of processing it.  Developers using this library may wish to adjust their app's code slightly to better tolerate or handle this TypeError.  Apps performing proper numeric data validation before sending data to this library should be mostly unaffected by this patch.  

### Workarounds

The vulnerability can be mitigated in older versions by ensuring that only finite numeric data of type `Array[number]` or `number` is passed to `cumulative-distribution-function` and its `f(x)` function, respectively.  

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the Github repository at https://github.com/DrPaulBrewer/cumulative-distribution-function
Vulnerability: GHSA-qhm8-m2c4-9mw7
Summary: Downloads Resources over HTTP in qbs
Aliases: CVE-2016-10656
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:45:11Z

Affected versions of `qbs` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `qbs`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-4mqv-gcr3-pff9
Summary: "Cross-site scripting in phpoffice/phpspreadsheet"
Aliases: CVE-2020-7776
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2021-05-06T18:53:37Z

"This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML."
Vulnerability: GHSA-h4rc-386g-6m85
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11620
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2020-04-23T20:19:02Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
Vulnerability: GHSA-cgqv-x5cx-xvqh
Summary: Arbitrary Code Injection in pouchdb
Aliases: CVE-2016-10546
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2018-07-26T16:22:08Z

Affected versions of `pouchdb` do not properly sandbox the code execution engine which executes the map/reduce functions for temporary views and design documents. Under certain circumstances, an attacker could uses this to run arbitrary code on the server.


## Recommendation

Update to version 6.0.5 or later.
Vulnerability: GHSA-7fvx-3jfc-2cpc
Summary: Heap OOB in `ResourceScatterUpdate`
Aliases: CVE-2021-37655
Severity: HIGH
CVSS score: 7.3
CWE: CWE-125
Published: 2021-08-25T14:42:58Z

### Impact
An attacker can trigger a read from outside of bounds of heap allocated data by sending invalid arguments to `tf.raw_ops.ResourceScatterUpdate`:

```python
import tensorflow as tf

v = tf.Variable([b'vvv'])
tf.raw_ops.ResourceScatterUpdate(
  resource=v.handle,
  indices=[0],
  updates=['1', '2', '3', '4', '5'])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L919-L923) has an incomplete validation of the relationship between the shapes of `indices` and `updates`: instead of checking that the shape of `indices` is a prefix of the shape of `updates` (so that broadcasting can happen), code only checks that the number of elements in these two tensors are in a divisibility relationship.

### Patches 
We have patched the issue in GitHub commit [01cff3f986259d661103412a20745928c727326f](https://github.com/tensorflow/tensorflow/commit/01cff3f986259d661103412a20745928c727326f).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
    
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-8j9v-h2vp-2hhv
Summary: XSS in HtmlSanitizer
Aliases: CVE-2020-26293
Severity: LOW
CVSS score: 6.1
CWE: CWE-74, CWE-79
Published: 2021-01-04T18:22:11Z

### Impact

If you have explicitly allowed the `<style>` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag.

### Patches

The problem has been fixed in version 5.0.372.

### Workarounds

Remove the `<style>` tag from the set of allowed tags.

### For more information

If you have any questions or comments about this advisory open an issue in https://github.com/mganss/HtmlSanitizer

### Credits

This issue was discovered by Michal Bentkowski of Securitum.
Vulnerability: GHSA-jjvm-3mfq-7gc7
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0506
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-09T00:00:31Z

microweber version 1.2.10 and prior is vulnerable to cross-site scripting.
Vulnerability: GHSA-xp7p-3gx7-j6wx
Summary: calibre-web is vulnerable to Business Logic Errors
Aliases: CVE-2021-4171
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-01-21T23:44:15Z

calibre-web is vulnerable to Business Logic Errors
Vulnerability: GHSA-ff6r-5jwm-8292
Summary: Regular Expression Denial of Service in no-case
Aliases: CVE-2017-16099
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T19:51:16Z

Affected versions of `no-case` are vulnerable to a regular expression denial of service when parsing untrusted user input.


## Recommendation

Update to version 2.3.2 or later.
Vulnerability: GHSA-grv5-w5vr-8h98
Summary: Path Traversal in droppy
Aliases: CVE-2020-7757
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2021-05-10T18:47:29Z

This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.
Vulnerability: GHSA-83mx-573x-5rw9
Summary: Null pointer deference in openssl-src
Aliases: CVE-2021-3449
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-476
Published: 2021-08-25T20:54:02Z

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
Vulnerability: GHSA-qx3w-4864-94ch
Summary: Cleartext storage of session identifier
Aliases: CVE-2021-21339
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-312
Published: 2021-03-23T01:53:42Z


### Problem
User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system.

### Solution
Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-006](https://typo3.org/security/advisory/typo3-core-sa-2021-006)
Vulnerability: GHSA-4r4m-hjwj-43p8
Summary: Insecure Defaults Allow MITM Over TLS in engine.io-client
Aliases: CVE-2016-10536
Severity: MODERATE
CVSS score: 0
CWE: CWE-300
Published: 2019-02-18T23:39:50Z

Affected versions of `engine.io-client` do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks.

The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, such as undefined or null, certificate verification will be disabled. 



## Recommendation

Update to version 1.6.9 or later.

If you are unable to upgrade, ensure all calls to socket.io to have a `rejectedUnauthorized: true` flag.
Vulnerability: GHSA-836c-xg97-8p4h
Summary: Server-Side Request Forgery in libtaxii
Aliases: CVE-2020-27197
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-918
Published: 2021-04-30T17:34:48Z

"TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library" and that this may be an issue to "raise ... to the lxml group.""
Vulnerability: GHSA-7jvx-f994-rfw2
Summary: materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input
Aliases: CVE-2022-25349
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-05-03T00:00:45Z

All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as &lt;not-a-tag /&gt;) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
Vulnerability: GHSA-64xx-cq4q-mf44
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39139
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502
Published: 2021-08-25T14:48:47Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below.  However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39139](https://x-stream.github.io/CVE-2021-39139.html).

### Credits
Lai Han of nsfocus security team found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-hp5r-mhgp-56c9
Summary: Cross-site Scriptin in JSPWiki
Aliases: CVE-2019-10078
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-06-06T15:29:29Z

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
Vulnerability: GHSA-84q7-p226-4x5w
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2017-7656
Severity: HIGH
CVSS score: 7.5
CWE: CWE-444
Published: 2018-10-19T16:16:27Z

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Vulnerability: GHSA-vpwq-6cp4-ffqc
Summary: Stored Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0945
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:49Z

ShowDoc prior to version 2.10.4 is vulnerable to stored cross-site scripting viva `axd` and `cshtml` file upload.
Vulnerability: GHSA-w3v3-cxq5-9vr4
Summary: Incorrect Default Permissions and Improper Access Control in snipe-it
Aliases: CVE-2022-0179
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-284, CWE-276
Published: 2022-01-21T23:58:07Z

snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions.
Vulnerability: GHSA-hmv2-79q8-fv6g
Summary: Uncontrolled Resource Consumption in urllib3
Aliases: CVE-2020-7212
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-30T17:31:43Z

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
Vulnerability: GHSA-9vh5-r4qw-v3vv
Summary: Improper Resource Shutdown or Release in HashiCorp Vault
Aliases: CVE-2020-7220
Severity: HIGH
CVSS score: 7.5
CWE: CWE-404
Published: 2021-07-28T17:57:46Z

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.
Vulnerability: GHSA-852q-xxj4-x2rx
Summary: SQL Injection in SimpleSAMLphp
Aliases: CVE-2019-15537
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-11-08T20:05:45Z

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
Vulnerability: GHSA-gg9m-x3cg-69vh
Summary: Access key stored in plain text by Jenkins Metrics Plugin
Aliases: CVE-2022-20621
Severity: MODERATE
CVSS score: 0
CWE: CWE-522
Published: 2022-01-13T00:00:57Z

Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Vulnerability: GHSA-7vx9-xjhr-rw6h
Summary: Cross-site Scripting in Eclipse Jetty
Aliases: CVE-2019-10241
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-23T16:06:02Z

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Vulnerability: GHSA-fg47-3c2x-m2wr
Summary: TimelockController vulnerability in OpenZeppelin Contracts 
Aliases: CVE-2021-39167
Severity: CRITICAL
CVSS score: 10
CWE: CWE-269
Published: 2021-08-30T16:12:38Z

### Impact

A vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.

### Patches

A fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`:
- 4.3.1
- 3.4.2
- 3.4.2-solc-0.7

Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.

### Workarounds

Revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

### References

[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).

### Credits

The issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-73rf-6mrf-759q
Summary: Moderate severity vulnerability that affects devise
Aliases: CVE-2019-5421
Severity: MODERATE
CVSS score: 0
CWE: CWE-367
Published: 2019-03-19T18:03:25Z

Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.
Vulnerability: GHSA-jf85-cpcp-j695
Summary: Prototype Pollution in lodash
Aliases: CVE-2019-10744
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-20
Published: 2019-07-10T19:45:23Z

Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution.  The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.12 or later.
Vulnerability: GHSA-gg6x-xx78-448c
Summary: Reflected XSS when importing CSV in OctoberCMS
Aliases: CVE-2020-5298
Severity: MODERATE
CVSS score: 4
CWE: CWE-87
Published: 2020-06-03T21:58:32Z

### Impact
A user with the ability to use the import functionality of the `ImportExportController` behavior could be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png">
Vulnerability: GHSA-8gv3-57p6-g35r
Summary: Heap buffer overflow in `RaggedTensorToTensor`
Aliases: CVE-2021-29560
Severity: LOW
CVSS score: 2.5
CWE: CWE-787, CWE-125
Published: 2021-05-21T14:24:57Z

### Impact
An attacker can cause a heap buffer overflow in `tf.raw_ops.RaggedTensorToTensor`:

```python
import tensorflow as tf

shape = tf.constant([10, 10], shape=[2], dtype=tf.int64)
values = tf.constant(0, shape=[1], dtype=tf.int64)
default_value = tf.constant(0, dtype=tf.int64)
l = [849, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
row = tf.constant(l, shape=[5, 43], dtype=tf.int64)
rows = [row]
types = ['ROW_SPLITS']

tf.raw_ops.RaggedTensorToTensor(
    shape=shape, values=values, default_value=default_value,
    row_partition_tensors=rows, row_partition_types=types) 
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/d94227d43aa125ad8b54115c03cece54f6a1977b/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L219-L222) uses the same index to access two arrays in parallel:

```cc
for (INDEX_TYPE i = 0; i < row_split_size - 1; ++i) {
  INDEX_TYPE row_length = row_split(i + 1) - row_split(i);
  INDEX_TYPE real_length = std::min(output_size, row_length);
  INDEX_TYPE parent_output_index_current = parent_output_index[i];
  ...
}
```

Since the user controls the shape of the input arguments, an attacker could trigger a heap OOB access when `parent_output_index` is shorter than `row_split`.

### Patches
We have patched the issue in GitHub commit [a84358aa12f0b1518e606095ab9cfddbf597c121](https://github.com/tensorflow/tensorflow/commit/a84358aa12f0b1518e606095ab9cfddbf597c121).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-j2x6-9323-fp7h
Summary: Integer bounds error in Vyper
Aliases: CVE-2022-24845
Severity: HIGH
CVSS score: 8.8
CWE: CWE-190
Published: 2022-04-22T20:24:13Z

### Impact
in the following code, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. as of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions.
```vyper
interface iface:
    def returns_int128() -> int128: view
    def returns_Bytes33() -> Bytes[33]: view

x: iface
 
@external
def call_out():
    x: int128 = self.x.returns_int128()  # affected, <0.3.0
    y: uint256 = convert(self.x.returns_int128(), uint256)  # affected, <0.3.2
    z: Bytes[33] = concat(self.x.returns_Bytes33(), b"")  # affected >= 0.3.0, <0.3.2
```

### Patches
0.3.2 (as of https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b)

### Workarounds
Break up operations involving external calls into multiple statements. For instance, instead of the example above, use
```
x: int128 = self.x.returns_int128()
y: uint256 = convert(x, uint256)
```
Vulnerability: GHSA-6gvc-4jvj-pwq4
Summary: Use after free in libpulse-binding
Aliases: CVE-2018-25001
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-416
Published: 2021-08-30T16:22:34Z

An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free.
Vulnerability: GHSA-f2c9-5jqw-3xh3
Summary: Cross-Site Scripting in Qiita::Markdown
Aliases: CVE-2021-28796
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-08-02T17:23:39Z

Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.
Vulnerability: GHSA-q5pq-pgrv-fh89
Summary: Critical severity vulnerability that affects dns-sync
Aliases: CVE-2014-9682
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2017-10-24T18:33:36Z

The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.
Vulnerability: GHSA-v4cp-h94r-m7xf
Summary: Use after free passing `externref`s to Wasm in Wasmtime
Aliases: CVE-2021-39216
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-416
Published: 2021-09-20T19:54:05Z

### Impact

There was a use-after-free bug when passing `externref`s from the host to guest Wasm content.

To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by

* passing multiple `externref`s as arguments from host code to a Wasm function,
* or returning multiple `externref`s to Wasm from a multi-value return function defined in the host.
 
If you do not have host code that matches one of these shapes, then you are not impacted.

If Wasmtime's [`VMExternRefActivationsTable`](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/crates/runtime/src/externref.rs#L493) became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed.

We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare.

### Patches

The bug has been fixed, and users should upgrade to Wasmtime 0.30.0.

Additionally, we have updated [our primary `externref` fuzz target](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/fuzz/fuzz_targets/table_ops.rs) such that it better exercises these code paths and we can have greater confidence in their correctness going forward.

### Workarounds

If you cannot upgrade Wasmtime yet, you can avoid the bug by disabling reference types support in Wasmtime by passing `false` to [`wasmtime::Config::wasm_reference_types`](https://docs.rs/wasmtime/0.29.0/wasmtime/struct.Config.html#method.wasm_reference_types).

### References

* [The reference types Wasm proposal, which introduces `externref`](https://github.com/WebAssembly/reference-types/)

### For more information

If you have any questions or comments about this advisory:

* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)
* Open an issue in [the `bytecodealliance/wasmtime` repository](https://github.com/bytecodealliance/wasmtime/)
Vulnerability: GHSA-c3g4-w6cv-6v7h
Summary: Non-empty default inheritable capabilities for linux container in Buildah
Aliases: CVE-2022-27651
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-276
Published: 2022-04-01T13:56:42Z

A bug was found in Buildah where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Vulnerability: GHSA-chxf-fjcf-7fwp
Summary: Possible filesystem space exhaustion by local users
Severity: MODERATE
CVSS score: 0
Published: 2022-03-01T21:04:07Z

`fscrypt` through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to `fscrypt` v0.3.3 or above and adjusting the permissions on existing `fscrypt` metadata directories where applicable.

For more details, see [CVE-2022-25326](https://www.cve.org/CVERecord?id=CVE-2022-25326) and https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem.
Vulnerability: GHSA-7g47-xxff-9p85
Summary: Remote unauthenticated attackers able to upload files in Onionshare
Aliases: CVE-2021-41868
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-11-19T20:39:44Z

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.
Vulnerability: GHSA-hj2j-77xm-mc5v
Summary: High severity vulnerability that affects Jinja2
Aliases: CVE-2016-10745
Severity: HIGH
CVSS score: 8.6
CWE: CWE-134
Published: 2019-04-10T14:30:13Z

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Vulnerability: GHSA-5fm9-jmv7-fcx5
Summary: Malicious Package in asynnc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:35:26Z

All versions of `asynnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-hf6p-4rv2-9qrp
Summary: Path Traversal in bikshed
Aliases: CVE-2021-23423
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-22
Published: 2021-08-30T16:25:42Z

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output.
Vulnerability: GHSA-87qw-7v97-w34r
Summary: Malicious Package in asinc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:33:18Z

All versions of `asinc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-5whq-j5qg-wjvp
Summary: Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke
Aliases: CVE-2019-12562
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-18T17:16:06Z

Cross-site scripting (XSS) is possible in DNN (formerly DotNetNuke) before 9.4.0 by remote authenticated users via the Display Name field in the admin notification function.
Vulnerability: GHSA-h6hq-c896-w882
Summary: Low severity vulnerability that affects Plone
Aliases: CVE-2011-1949
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2018-07-23T21:01:10Z

Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.
Vulnerability: GHSA-878x-85hc-gc4g
Summary: SQL Injection in LibreNMS
Aliases: CVE-2019-12465
Severity: HIGH
CVSS score: 8.1
CWE: CWE-89
Published: 2019-10-11T18:43:29Z

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajax_rulesuggest.php?debug=1&term= request.
Vulnerability: GHSA-q897-9jxf-jg9r
Summary: Security check skip in Apache Dubbo
Aliases: CVE-2021-37579
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-09-10T17:56:23Z

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
Vulnerability: GHSA-f7wm-x4gw-6m23
Summary: Insert tag injection in forms
Aliases: CVE-2020-25768
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-74, CWE-20
Published: 2020-09-24T16:23:54Z

### Impact

It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

### Patches

Update to Contao 4.4.52, 4.9.6 or 4.10.1.

### Workarounds

Disable the front end login form and do not use form fields with array keys such as `fieldname[]`.

### References

https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-7cqg-8449-rmfv
Summary: Observable Discrepancy in libsecp256k1-rs
Aliases: CVE-2019-20399
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362, CWE-203
Published: 2021-08-25T21:01:27Z

A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
Vulnerability: GHSA-ffjp-66mx-3qpj
Summary: Privilege escalation in beego
Aliases: CVE-2021-27116
Severity: HIGH
CVSS score: 7.8
CWE: CWE-59
Published: 2022-04-06T00:01:30Z

An issue was discovered in file profile.go. The MemProf and GetCPUProfile functions do not correctly check whether the created file exists. As a result attackers can launch attacks symlink attacks locally. Attackers can use this vulnerability to escalate privileges.
Vulnerability: GHSA-923p-fr2c-g5m2
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Ansible
Aliases: CVE-2020-1739
Severity: LOW
CVSS score: 3.9
CWE: CWE-200
Published: 2021-04-07T20:30:44Z

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.
Vulnerability: GHSA-rxmr-c9jm-7mm8
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2018-1284
Severity: LOW
CVSS score: 3.7
CWE: CWE-200
Published: 2018-11-21T22:24:22Z

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if hive.server2.enable.doAs=false.
Vulnerability: GHSA-46m8-42hm-wvvw
Summary: Cross-Site Scripting in emojione
Aliases: CVE-2016-1000231
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:34:16Z

Affected versions of `emojione` are vulnerable to cross-site scripting when user input is passed into the `toShort()`, `shortnameToImage()`, `unicodeToImage()`, and `toImage()` functions.



## Recommendation

Update to version 1.3.1 or later.