TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-vr8q-g5c7-m54m
Summary: XXE in Nokogiri
Aliases: CVE-2020-26247
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-611
Published: 2020-12-30T18:35:06Z

### Severity

Nokogiri maintainers have evaluated this as [__Low Severity__ (CVSS3 2.6)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).


### Description

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by `Nokogiri::XML::Schema` are **trusted** by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks.

This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as **untrusted** by default whenever possible.

Please note that this security fix was pushed into a new minor version, 1.11.x, rather than a patch release to the 1.10.x branch, because it is a breaking change for some schemas and the risk was assessed to be "Low Severity".


### Affected Versions

Nokogiri `<= 1.10.10` as well as prereleases `1.11.0.rc1`, `1.11.0.rc2`, and `1.11.0.rc3`


### Mitigation

There are no known workarounds for affected versions. Upgrade to Nokogiri `1.11.0.rc4` or later.

If, after upgrading to `1.11.0.rc4` or later, you wish to re-enable network access for resolution of external resources (i.e., return to the previous behavior):

1. Ensure the input is trusted. Do not enable this option for untrusted input.
2. When invoking the `Nokogiri::XML::Schema` constructor, pass as the second parameter an instance of `Nokogiri::XML::ParseOptions` with the `NONET` flag turned off.

So if your previous code was:

``` ruby
# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network
# but in v1.11.0.rc4 and later, this call will disallow network access for external resources
schema = Nokogiri::XML::Schema.new(schema)

# in v1.11.0.rc4 and later, the following is equivalent to the code above
# (the second parameter is optional, and this demonstrates its default value)
schema = Nokogiri::XML::Schema.new(schema, Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)
```

Then you can add the second parameter to indicate that the input is trusted by changing it to:

``` ruby
# in v1.11.0.rc3 and earlier, this would raise an ArgumentError 
# but in v1.11.0.rc4 and later, this allows resources to be accessed over the network
schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)
```


### References

- [This issue's public advisory](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m)
- [Original Hackerone report (private)](https://hackerone.com/reports/747489)
- [OWASP description of XXE attack](https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing)
- [OWASP description of SSRF attack](https://www.owasp.org/index.php/Server_Side_Request_Forgery)


### Credit 

This vulnerability was independently reported by @eric-therond and @gucki.

The Nokogiri maintainers would like to thank [HackerOne](https://hackerone.com/nokogiri) for providing a secure, responsible mechanism for reporting, and for providing their fantastic service to us.
Vulnerability: GHSA-82hm-vh7g-hrh9
Summary: Partial read is incorrect in molecule
Severity: MODERATE
CVSS score: 0
Published: 2021-08-25T21:01:25Z

### Impact

Anyone who uses `total_size(..)` function to partial read the length of any `FixVec` will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.

### Workarounds

If you already have the whole `FixVec` `A`, you can use `A.as_slice().len()` to get the total size of the `FixVec`.

### For more information

If you have any questions or comments about this advisory:

- [Open an issue to ask use directly](https://github.com/nervosnetwork/molecule/issues/new).
Vulnerability: GHSA-5ww9-j83m-q7qx
Summary: Information exposure in FasterXML jackson-databind
Aliases: CVE-2019-12086
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2019-05-23T09:32:24Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Vulnerability: GHSA-5jpf-pj32-xx53
Summary: Authorization header is not sanitized in an error object in auth0
Aliases: CVE-2020-15125
Severity: HIGH
CVSS score: 7.7
CWE: CWE-209
Published: 2020-07-29T16:26:22Z

### Overview
Versions before and including `2.27.0` use a block list of specific keys that should be sanitized from the request object contained in the error object.  When a request to Auth0 management API fails, the key for `Authorization` header is not sanitized and the `Authorization` header value can be logged exposing a bearer token.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using `auth0` npm package
- You are using a Machine to Machine application authorized to use Auth0's management API https://auth0.com/docs/flows/concepts/client-credentials

### How to fix that?
Upgrade to version `2.27.1`

### Will this update impact my users?
The fix provided in patch will not affect your users.

### Credit
http://github.com/osdiab
Vulnerability: GHSA-6cwv-x26c-w2q4
Summary: Jupyter Notebook file bypasses sanitization, executes JavaScript
Aliases: CVE-2018-8768
Severity: HIGH
CVSS score: 7.8
Published: 2018-07-12T12:00:00Z

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
Vulnerability: GHSA-7rpj-hg47-cx62
Summary: Improper Restriction of XML External Entity Reference in com.h2database:h2.
Aliases: CVE-2021-23463
Severity: HIGH
CVSS score: 8.1
CWE: CWE-611
Published: 2021-12-16T14:29:57Z

H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 0 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
Vulnerability: GHSA-mph4-vhrx-mv67
Summary: Deserialization of Untrusted Data in FasterXML jackson-databind
Aliases: CVE-2019-12384
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-502
Published: 2019-07-05T21:07:27Z

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
Vulnerability: GHSA-2rxh-h6h9-qrqc
Summary: Class destructors causing side-effects when being unserialized in TYPO3 CMS
Aliases: CVE-2020-11066
Severity: HIGH
CVSS score: 8.7
CWE: CWE-915
Published: 2020-05-13T23:18:38Z

Calling unserialize() on malicious user-submitted content can result in the following scenarios:
- trigger deletion of arbitrary directory in file system (if writable for web server)
- trigger message submission via email using identity of web site (mail relay)

Another insecure deserialization vulnerability is required to actually exploit mentioned aspects.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-004
Vulnerability: GHSA-64fq-9c6w-rq44
Summary: Improper Neutralization of Formula Elements in a CSV File in Kimai 2
Aliases: CVE-2021-43515
Severity: HIGH
CVSS score: 7.8
CWE: CWE-1236
Published: 2022-04-09T00:00:25Z

A CSV Injection vulnerablity exists in Kimai Kimai 2 prior to 1.14.1 via a description in a new timesheet.
Vulnerability: GHSA-m36m-x4c5-rjxj
Summary: Silently Runs Cryptocoin Miner in hooka-tools
Severity: LOW
CVSS score: 0
Published: 2020-09-01T19:01:58Z

Affected versions of `hooka-tools` were compromised and modified to silently run a cryptocoin miner in the background.

All affected versions have been unpublished from the npm registry.


## Recommendation

While this module has been unpublished, some versions may exist in mirrors or caches. Do not install this module, and remove it if found.
Vulnerability: GHSA-44qp-qhfv-c7f6
Summary: Improper Handling of Exceptional Conditions in Apache Tomcat
Aliases: CVE-2021-30639
Severity: HIGH
CVSS score: 7.5
CWE: CWE-755
Published: 2021-08-13T15:21:02Z

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
Vulnerability: GHSA-vc3x-gx6c-g99f
Summary: Denial of Service in Bytom
Aliases: CVE-2018-18206
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2022-02-15T01:57:18Z

In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.
Vulnerability: GHSA-53r4-h27g-rg3x
Summary: Out-of-bounds write
Aliases: CVE-2019-0992
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:07Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
Vulnerability: GHSA-xcgx-27q5-7634
Summary: Malicious Package in commanedr
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:41:05Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-43ch-2h55-2vj7
Summary: Server-Side Request Forgery in private-ip
Aliases: CVE-2020-28360
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-918
Published: 2021-04-13T15:18:17Z

Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.
Vulnerability: GHSA-vw83-h3mq-3qwj
Summary: Path Traversal in Spring-integration-zip
Aliases: CVE-2021-22114
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2022-03-18T17:40:44Z

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Vulnerability: GHSA-57h3-9rgr-c24m
Summary: Out of bounds write in Pillow
Aliases: CVE-2021-25289
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-03-29T16:35:16Z

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
Vulnerability: GHSA-cf3w-g86h-35x4
Summary: Code Injection vulnerability in CarrierWave::RMagick
Aliases: CVE-2021-21305
Severity: HIGH
CVSS score: 7.4
CWE: CWE-94, CWE-74
Published: 2021-02-08T19:16:39Z

### Impact
[CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb) has a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation option(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.
If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).

(But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)

### Proof of Concept
```ruby
class MyUploader < CarrierWave::Uploader::Base
  include CarrierWave::RMagick
end

MyUploader.new.manipulate!({ read: { density: "1 }; p 'Hacked'; {" }}) # => shows "Hacked"
```

### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).

### Workarounds
Stop supplying untrusted input to `#manipulate!`'s mutation option.

### References
[Code Injection Software Attack](https://owasp.org/www-community/attacks/Code_Injection)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [CarrierWave repo](https://github.com/carrierwaveuploader/carrierwave)
* Email me at [mit.shibuya@gmail.com](mailto:mit.shibuya@gmail.com)
Vulnerability: GHSA-8rf5-92jh-3vc9
Summary: Uncaught Exception leading to Denial of Service in json-sanitizer
Aliases: CVE-2021-23900
Severity: HIGH
CVSS score: 7.5
CWE: CWE-248
Published: 2021-05-13T22:31:32Z

OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
Vulnerability: GHSA-qcgx-7p5f-hxvr
Summary: Discoverability of user password hash in Statamic CMS
Aliases: CVE-2022-24784
Severity: LOW
CVSS score: 3.7
CWE: CWE-200, CWE-326
Published: 2022-03-29T22:11:45Z

## Description

It was possible to confirm a single character of a user's password hash (just the hash, not the password) using a specially crafted regular expression filter in the users endpoint of the REST API. Many requests could eventually uncover the entire hash.

The hash would not be in the response, however the presence or absence of a result would confirm if the character was in the right position. It would take a long time since the API has throttling enabled by default.

Additionally, the REST API would need to be enabled, as well as the users endpoint. Both of which are disabled by default.

## Resolution

Filtering by password or password hash has been disabled.

## Credits

We would like to thank Thibaud Kehler for reporting the issue.
Vulnerability: GHSA-q348-f93x-9gx4
Summary: Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain
Aliases: CVE-2021-30492
Severity: CRITICAL
CVSS score: 0
CWE: CWE-20, CWE-918
Published: 2021-04-29T21:53:06Z

### Impact
Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

### Resolution
Validate the provided Zendesk subdomain to be a valid subdomain in:
* getAuthUrl
* getAccessToken
Vulnerability: GHSA-j8hw-49gg-vq3w
Summary: Malicious Package in retcodelog
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:45:41Z

All versions of `retcodelog` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6x3v-rw2q-9gx7
Summary: Improper implementation of the session fixation protection in Infinispan
Aliases: CVE-2019-10158
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-384
Published: 2020-01-21T21:18:44Z

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.
Vulnerability: GHSA-fwx5-5fqj-jv98
Summary: Cross-Site Scripting in morris.js
Aliases: CVE-2017-16022
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-09T17:46:30Z

Affected versions of `morris.js` are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.


## Recommendation

A patch for this vulnerability was created in 2014, but has still not been published to npm. In order to mitigate this issue effectively, install the library from github via:
```
npm i morrisjs/morris.js -s
```
Vulnerability: GHSA-cxf7-qrc5-9446
Summary: Remote shell execution vulnerability in image_processing
Aliases: CVE-2022-24720
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20, CWE-78
Published: 2022-03-01T22:22:26Z

### Impact

When using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

```rb
ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED
```

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

### Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

### Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

```rb
operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)
```
Vulnerability: GHSA-r3r5-jhw6-4634
Summary: Insecure temporary file usage in SWHKD
Aliases: CVE-2022-27818
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-668
Published: 2022-04-08T00:00:24Z

SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.
Vulnerability: GHSA-xf7w-r453-m56c
Summary: Arbitrary File Overwrite in fstream
Aliases: CVE-2019-13173
Severity: HIGH
CVSS score: 7.5
CWE: CWE-59
Published: 2019-05-30T17:19:34Z

Versions of `fstream` prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The `fstream.DirWriter()` function is vulnerable.


## Recommendation

Upgrade to version 1.0.12 or later.
Vulnerability: GHSA-4w88-rjj3-x7wp
Summary: Chromium Remote Code Execution in electron
Aliases: CVE-2017-16151
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2018-07-24T20:04:23Z

Affected versions of `ElectronJS` are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.



## Recommendation

Update to electron version 1.7.8 or later.
Vulnerability: GHSA-jqvv-r4w3-8f7w
Summary: Malicious Package in bictoind-rpc
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:35:00Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hg5q-rj62-c43g
Summary: Malicious Package in reqest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:29:08Z

All versions of `reqest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-3264-3fm9-fg44
Summary: Infinite Loop in Apache Tika
Aliases: CVE-2020-1951
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2021-05-07T15:54:00Z

A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23.
Vulnerability: GHSA-w6g3-v46q-5p28
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-11762
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-22
Published: 2018-10-17T15:49:58Z

In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file.
Vulnerability: GHSA-59x4-67mh-px54
Summary: Crypt_GPG does not prevent additional options in GPG calls
Aliases: CVE-2022-24953
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2022-02-18T00:00:36Z

The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
Vulnerability: GHSA-45r8-3495-x6rm
Summary: High severity vulnerability that affects com.hubspot.jinjava:jinjava
Aliases: CVE-2018-18893
Severity: MODERATE
CVSS score: 5.3
Published: 2019-01-04T17:43:36Z

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.
Vulnerability: GHSA-h6m7-j4h3-9rf5
Summary: Remote Code Execution in SyliusResourceBundle
Aliases: CVE-2020-15146
Severity: CRITICAL
CVSS score: 9.6
CWE: CWE-917, CWE-74
Published: 2020-08-19T19:52:30Z

### Impact

Request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: `<=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3`.

### Example

```yaml
sylius_grid:
    grids:
        foo:
            fields:
                bar:
                    options:
                        baz: "expr:service('sylius.repository.product').find($id)"
```

In this case, `$id` can be prepared in a way that calls other services. 

If you visit `/route?id="~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"`, it will result in a following expression `expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"")`, which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

### Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

### Workarounds

The fix requires adding `addslashes` in `OptionsParser::parseOptionExpression` to sanitize user input before evaluating it using the expression language.

```php
- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
```

### Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-5fjj-cfh2-ghc5
Summary: Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
Aliases: CVE-2020-8128
Severity: HIGH
CVSS score: 9.8
CWE: CWE-829, CWE-918
Published: 2021-04-13T15:25:24Z

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.
Vulnerability: GHSA-95m6-mjh3-58gm
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2016-8609
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287, CWE-384
Published: 2018-10-18T16:48:41Z

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
Vulnerability: GHSA-h44f-769q-j6px
Summary: Malicious Package in requet
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:33:14Z

All versions of `requet` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-6vwp-35w3-xph8
Summary: Insecure Deserialization in Apache XML-RPC
Aliases: CVE-2019-17570
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-06-10T20:02:39Z

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code.

Apache XML-RPC is no longer maintained and this issue will not be fixed.
Vulnerability: GHSA-5rcc-6cmj-7728
Summary: Cross-site Scripting in BookStack
Aliases: CVE-2022-0877
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-09T00:00:44Z

Iframe tags don't have a sandbox attribute, this makes an attacker able to execute malicious javascript via an iframe and perform phishing attacks. The sandbox attribute will block script execution and prevents the content to navigate its top-level browsing context which will stop this type of attack.
Vulnerability: GHSA-qgm9-232x-hwpx
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-1000500
Severity: MODERATE
CVSS score: 0
Published: 2018-10-18T16:48:15Z

Withdrawn: Duplicate of CVE-2017-12161 / GHSA-959q-32g8-vvp7
Vulnerability: GHSA-5947-m4fg-xhqg
Summary: Prototype Pollution in lodash.mergewith
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T18:08:10Z

Versions of `lodash.mergewith` before 4.6.1 are vulnerable to Prototype Pollution. The function 'mergeWith' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-qj26-7grj-whg3
Summary: Privilege Escalation in fscrypt
Aliases: CVE-2018-6558
Severity: MODERATE
CVSS score: 6.5
Published: 2021-06-23T17:18:49Z

The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
Vulnerability: GHSA-9p64-h5q4-phpm
Summary: Remote Code Execution in office-converter
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2020-09-02T15:44:58Z

All versions of `office-converter` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-vpq7-m4qm-p2gp
Summary: Business Logic Errors in microweber
Aliases: CVE-2022-0596
Severity: MODERATE
CVSS score: 4.3
Published: 2022-02-16T00:01:45Z

Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-3pqh-p72c-fj85
Summary: Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki
Aliases: CVE-2021-3978
Severity: MODERATE
CVSS score: 0
CWE: CWE-281
Published: 2021-11-19T19:34:26Z

### Impact

When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root (https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation.  

## For more information

If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-87p2-cvhq-q4mv
Summary: Authentication bypass in Apache Zeppelin
Aliases: CVE-2020-13929
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2021-09-07T22:56:56Z

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Vulnerability: GHSA-fpcp-9h7m-ffpx
Summary: Null pointer dereference in TensorFlow 
Aliases: CVE-2022-23595
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-476
Published: 2022-02-09T23:33:17Z

### Impact
When [building an XLA compilation cache](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/jit/xla_platform_info.cc#L43-L104), if default settings are used, TensorFlow triggers a null pointer dereference:

```cc 
  string allowed_gpus =
      flr->config_proto()->gpu_options().visible_device_list();
``` 
    
In the default scenario, all devices are allowed, so `flr->config_proto` is `nullptr`.
    
### Patches
We have patched the issue in GitHub commit [e21af685e1828f7ca65038307df5cc06de4479e8](https://github.com/tensorflow/tensorflow/commit/e21af685e1828f7ca65038307df5cc06de4479e8).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-27xj-rqx5-2255
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11619
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2020-05-15T18:58:44Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
Vulnerability: GHSA-qgwf-r2jj-2ccv
Summary: Use after free in heapless
Aliases: CVE-2020-36464
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2021-08-25T20:56:09Z

An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.
Vulnerability: GHSA-599h-8wpj-75xj
Summary: Authentication Bypass in tyk-identity-broker
Aliases: CVE-2021-23365
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-287
Published: 2021-06-23T17:23:30Z

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).
Vulnerability: GHSA-9699-gm7f-cmjv
Summary: Unsynchronized Access to Shared Data in a Multithreaded Context in RESTEasy
Aliases: CVE-2020-25724
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-567
Published: 2021-06-08T22:29:46Z

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
Vulnerability: GHSA-jc7r-v6fg-2gpf
Summary: High severity vulnerability that affects org.apache.cxf:apache-cxf, org.apache.cxf:apache-cxf , and org.apache.cxf:cxf
Aliases: CVE-2018-8039
Severity: HIGH
CVSS score: 0
Published: 2018-10-19T16:40:01Z

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.
Vulnerability: GHSA-9jm3-5835-537m
Summary: Command Injection in apex-publish-static-files
Aliases: CVE-2018-16462
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2018-11-01T14:48:50Z

Versions of `apex-publish-static-files` before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the `connectString` option in the `publish` method.


## Recommendation

Update to version 2.0.1 or later.
Vulnerability: GHSA-c9x9-xv66-xp3v
Summary: Improper privilege management in Keycloak
Aliases: CVE-2020-14389
Severity: HIGH
CVSS score: 8.1
CWE: CWE-916, CWE-269
Published: 2021-11-10T15:30:36Z

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission.
Vulnerability: GHSA-xqp8-w826-hh6x
Summary: Crash server with query parameter
Aliases: CVE-2021-39187
Severity: HIGH
CVSS score: 7.5
CWE: CWE-74, CWE-20, CWE-755
Published: 2021-09-02T16:51:14Z

### Impact
Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.

### Patches
Upgrade to Parse Server 4.10.3
Vulnerability: GHSA-6qgm-fv6v-rfpv
Summary: Overflow/denial of service in `tf.raw_ops.ReverseSequence`
Aliases: CVE-2021-29575
Severity: LOW
CVSS score: 2.5
CWE: CWE-119, CWE-120
Published: 2021-05-21T14:26:13Z

### Impact
The implementation of `tf.raw_ops.ReverseSequence` allows for stack overflow and/or `CHECK`-fail based denial of service.

```python
import tensorflow as tf

input = tf.zeros([1, 1, 1], dtype=tf.int32)
seq_lengths = tf.constant([0], shape=[1], dtype=tf.int32)

tf.raw_ops.ReverseSequence(
    input=input, seq_lengths=seq_lengths, seq_dim=-2, batch_dim=0)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/5b3b071975e01f0d250c928b2a8f901cd53b90a7/tensorflow/core/kernels/reverse_sequence_op.cc#L114-L118) fails to validate that `seq_dim` and `batch_dim` arguments are valid.
  
Negative values for `seq_dim` can result in stack overflow or `CHECK`-failure, depending on the version of Eigen code used to implement the operation. Similar behavior can be exhibited by invalid values of `batch_dim`.
  
### Patches
We have patched the issue in GitHub commit [ecf768cbe50cedc0a45ce1ee223146a3d3d26d23](https://github.com/tensorflow/tensorflow/commit/ecf768cbe50cedc0a45ce1ee223146a3d3d26d23).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-m6gg-86c6-gfr9
Summary: Cross-site Scripting in elasticsearch
Aliases: CVE-2022-23710
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-04T00:00:15Z

A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim’s browser.
Vulnerability: GHSA-vqj2-4v8m-8vrq
Summary: Insecure Temporary File in mlflow
Aliases: CVE-2022-0736
Severity: HIGH
CVSS score: 8.2
CWE: CWE-668, CWE-377
Published: 2022-02-24T00:00:54Z

mlflow prior to 1.23.1 contains an insecure temporary file. The insecure function `tempfile.mktemp()` is deprecated and `mkstemp()` should be used instead.
Vulnerability: GHSA-8vwm-8vj8-rqjf
Summary: User login denial of service in github.com/google/fscrypt
Aliases: CVE-2022-25327
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-276
Published: 2022-02-26T00:00:44Z

The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
Vulnerability: GHSA-x76r-966h-5qv9
Summary: Out-of-bounds Write in vec-const
Aliases: CVE-2021-45680
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2022-01-06T22:15:56Z

An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
Vulnerability: GHSA-cqxw-3p7v-p9gr
Summary: Phusion Passenger uses a known /tmp filename
Aliases: CVE-2016-10345
Severity: HIGH
CVSS score: 7.8
Published: 2018-08-21T17:08:03Z

In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user
Vulnerability: GHSA-236h-rqv8-8q73
Summary: GraphQL: Security breach on Viewer query
Aliases: CVE-2020-15126
Severity: HIGH
CVSS score: 6.5
CWE: CWE-863
Published: 2020-07-22T23:06:47Z

### Impact
An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.

### Patches
This vulnerability has been patched in Parse Server 4.3.0.

### Workarounds
No

### References
See [commit 78239ac](https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa) for details.
Vulnerability: GHSA-232r-66cg-79px
Summary: Paramiko not properly checking authention before processing other requests
Aliases: CVE-2018-7750
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2018-07-12T20:29:30Z

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Vulnerability: GHSA-h7f9-cvh5-qw7f
Summary: Path traversal in pimcore/pimcore
Aliases: CVE-2021-23340
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2021-02-25T16:32:46Z

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Vulnerability: GHSA-25xc-jwfq-39jw
Summary: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Aliases: CVE-2021-31407
Severity: HIGH
CVSS score: 8.6
CWE: CWE-402, CWE-668
Published: 2021-04-19T14:50:49Z

Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

- https://vaadin.com/security/cve-2021-31407
Vulnerability: GHSA-8462-q7x7-g2x4
Summary: High severity vulnerability that affects bson
Aliases: CVE-2018-13863
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-185
Published: 2018-09-17T20:44:58Z

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
Vulnerability: GHSA-7h8x-wmq2-7mff
Summary: Command injection in launchpad
Aliases: CVE-2021-23330
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-04-13T15:20:20Z

All versions of package launchpad are vulnerable to Command Injection via stop.
Vulnerability: GHSA-mj9p-v2r8-wf8w
Summary: Cross-site scripting in SimpleSAMLphp
Aliases: CVE-2020-5226
Severity: LOW
CVSS score: 4.4
CWE: CWE-79
Published: 2020-01-24T21:26:54Z

### Background

SimpleSAMLphp allows users to report errors and failures to the system administrators via a web form. This web form gathers some contextual information automatically, but it also allows the user to provide their email address for follow-ups and a free-text explanation of what happened. Once submitted, the report is sent as an email to the administrative email address configured in the software.

### Description

The `www/erroreport.php` script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp  1.18.0, a new `SimpleSAML\Utils\EMail` class was introduced to handle sending emails, implemented as a wrapper of an external dependency.

This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in `www/errorreport.php` was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field.

### Affected versions

SimpleSAMLphp versions 1.18.0 to 1.18.3, both inclusive.

### Impact

An attacker may take advantage of this issue to manually craft a modified email sent via the error reporting mechanism, such as this email might trick a system administrator into performing an action, such as introducing their credentials into a phishing web site that resembles the original.

Remote execution of javascript code is considered unfeasible since email clients do not run javascript present in emails, although there might be email clients which don't follow this rule, making the attack surface grow.

### Resolution

Upgrade the SimpleSAMLphp installation to version 1.18.4.

### Credit

This vulnerability was discovered and reported by Frederic Vleminckx.
Vulnerability: GHSA-q48g-p5cx-c7c7
Summary: Directory Traversal in yzt
Aliases: CVE-2017-16221
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:36:42Z

Affected versions of `yzt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-c4qh-4vgv-qc6g
Summary: Uncontrolled Resource Consumption in Django
Aliases: CVE-2019-14232
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2019-08-06T01:43:29Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.