TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-hwvv-438r-mhvj
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-22134
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200
Published: 2021-03-18T19:23:57Z

A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.
Vulnerability: GHSA-gppw-3h6h-v6q2
Summary: Data race in internment
Aliases: CVE-2021-28037
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-362
Published: 2021-08-25T20:52:08Z

An issue was discovered in the internment crate before 0.4.2 for Rust. There is a data race that can cause memory corruption because of the unconditional implementation of Sync for Intern<T>.
Vulnerability: GHSA-ccjp-w723-2jf2
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2015-3271
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2018-10-17T15:44:10Z

Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.
Vulnerability: GHSA-49mg-94fc-2fx6
Summary: Command Injection in npm-git-publish
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T17:32:49Z

All versions of `npm-git-publish` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `execSync` call, which may allow attackers to execute arbitrary code in the system. The `publish` function is vulnerable through the `gitRemoteUrl` variable.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-8qx4-r7fx-xc4v
Summary: Malicious Package in requst
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:08:19Z

All versions of `requst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-6354-6mhv-mvv5
Summary: Regular Expression Denial of Service in jadedown
Aliases: CVE-2016-10520
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2019-02-18T23:38:38Z

The `jadedown` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in.


### Proof of concept
```
var jadedown = require('jadedown');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=1;i<=10000000;i=i+1) {
    console.log("COUNT: " + i);
    var str = genstr(i, 'f') + genstr(i, '#') + '{';
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    jadedown(str)

    var end = process.hrtime(start);
    console.log(end);
}

```

Results demonstrating blocking for 5 seconds using only 48 characters.

```
$ node jadedown.js
COUNT: 1
LENGTH: 6
[ 0, 4014065 ]
COUNT: 4
LENGTH: 12
[ 0, 503507 ]
COUNT: 7
LENGTH: 18
[ 0, 325225 ]
COUNT: 10
LENGTH: 24
[ 0, 1632684 ]
COUNT: 13
LENGTH: 30
[ 0, 7541230 ]
COUNT: 16
LENGTH: 36
[ 0, 80889495 ]
COUNT: 19
LENGTH: 42
[ 0, 636009936 ]
COUNT: 22
LENGTH: 48
[ 5, 820586760 ]
```

# Timeline
- October 24, 2015 - Vulnerability Identified
- October 24, 2015 - Maintainers Notified
- October 25, 2015 - Response from Maintainers with intent to fix
- January 5, 2016 - Advisory Published
- January 11, 2016 - CVE Requested


## Recommendation

This package is not actively maintained, and has not seen an update since 2011. 

The package also provides unique functionality in the form of a templating language that is not available elsewhere. If this package is used to process user input, the best available mitigation is to refactor the dependent application to not make use of this module.
Vulnerability: GHSA-87mg-h5r3-hw88
Summary: Cross-Site Scripting in bootbox
Severity: MODERATE
CVSS score: 0
CWE: CWE-64, CWE-79
Published: 2019-05-30T17:23:28Z

All version of `bootbox` are vulnerable to Cross-Site Scripting. The package does not sanitize user input in the provided dialog boxes, allowing attackers to inject HTML code and execute arbitrary JavaScript.


## Recommendation

Sanitize user input being passed to `bootbox` or consider using an alternative package.
Vulnerability: GHSA-v83p-xwm9-v4g8
Summary: Injection in Apache Archiva
Aliases: CVE-2020-9495
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-74
Published: 2022-02-10T23:06:22Z

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
Vulnerability: GHSA-8gw6-w5rw-4g5c
Summary: Incorrect Default Permissions in Apache JSPWiki
Aliases: CVE-2021-44140
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-276
Published: 2021-11-29T17:59:24Z

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.
Vulnerability: GHSA-xpmx-h7xq-xffh
Summary: Potential access control security issue in apollo-adminservice
Aliases: CVE-2020-15170
Severity: HIGH
CVSS score: 7
CWE: CWE-20
Published: 2020-10-02T16:33:41Z

### Impact
If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have built-in access control. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations.

### Patches
Access control for admin service was added in #3233 and was released in [v1.7.1](https://github.com/ctripcorp/apollo/releases/tag/v1.7.1).

### Workarounds
To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.

### Credits
[Lexu](https://github.com/lllllx) reported the issue and provided the required information to reproduce it.

### References
[Apollo Security Guidence](https://github.com/ctripcorp/apollo/wiki/Apollo%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97#71-%E5%AE%89%E5%85%A8%E7%9B%B8%E5%85%B3)

### For more information
If you have any questions or comments about this advisory:
* Open an [issue](https://github.com/ctripcorp/apollo/issues)
* Email to one of the active [project maintainers](https://github.com/ctripcorp/apollo/graphs/contributors)
Vulnerability: GHSA-hgmw-x865-hf9x
Summary: High severity vulnerability that affects arabic-prawn
Aliases: CVE-2014-2322
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:36Z

lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.
Vulnerability: GHSA-54qm-37qr-w5wq
Summary: Sandbox Breakout / Arbitrary Code Execution in veval
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-04T15:04:20Z

All versions of `veval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-r5hc-9xx5-97rw
Summary: Moderate severity vulnerability that affects i18n
Aliases: CVE-2013-4492
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
Vulnerability: GHSA-j858-xp5v-f8xx
Summary: Remote code execution in Dragonfly
Aliases: CVE-2021-33564
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-88, CWE-94
Published: 2021-06-02T21:42:49Z

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the verify_url option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Vulnerability: GHSA-fqgw-6qj5-8hmp
Summary: Infinite Loop in Apache James
Aliases: CVE-2021-40111
Severity: MODERATE
CVSS score: 0
CWE: CWE-835
Published: 2022-01-08T00:40:37Z

In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
Vulnerability: GHSA-jphw-p3m6-pj3c
Summary: Data races in multiqueue2
Aliases: CVE-2020-36214
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-662
Published: 2021-08-25T20:51:54Z

An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur.
Vulnerability: GHSA-q547-gmf8-8jr7
Summary: Signature Validation Bypass in goxmldsig
Aliases: CVE-2020-15216
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-347
Published: 2021-05-24T16:57:32Z

### Impact
With a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. 

### Patches
A patch is available, all users of goxmldsig should upgrade to v1.1.0.

### For more information
If you have any questions or comments about this advisory open an issue at https://github.com/russellhaering/goxmldsig
Vulnerability: GHSA-mj8x-cpr8-x39h
Summary: Remote code execution in Apache Tapestry
Aliases: CVE-2021-27850
Severity: CRITICAL
CVSS score: 0
CWE: CWE-502, CWE-922
Published: 2021-06-16T17:33:19Z

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.2, upgrade to 5.6.3 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.
Vulnerability: GHSA-77hp-pfxw-4w63
Summary: Moderate severity vulnerability that affects org.codelibs.fess:fess
Aliases: CVE-2018-1000822
Severity: CRITICAL
CVSS score: 10
CWE: CWE-611
Published: 2018-12-20T22:02:09Z

codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.
Vulnerability: GHSA-j84c-j8qm-g47r
Summary: The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password
Aliases: CVE-2016-0733
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2018-10-17T17:21:11Z

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
Vulnerability: GHSA-wph7-x527-w3h5
Summary: Missing Release of Resource after Effective Lifetime in Apache Tomcat
Aliases: CVE-2021-42340
Severity: HIGH
CVSS score: 7.5
CWE: CWE-772
Published: 2021-10-15T18:51:34Z

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
Vulnerability: GHSA-844m-cpr9-jcmh
Summary: Secure/signed cookies share secrets between sites in a multi-site application
Aliases: CVE-2021-41263
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-200, CWE-565
Published: 2021-11-15T17:54:01Z

### Impact
This vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application.

### Patches
The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.
Vulnerability: GHSA-jj6g-7j8p-7gf2
Summary: Cross-Site Scripting in bracket-template
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-05-30T21:03:24Z

All versions of `bracket-template` are vulnerable to stored cross-site scripting (XSS). This is exploitable when a variable passed in via a GET parameter is used in a template.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-924m-4pmx-c67h
Summary: High severity vulnerability that affects pysaml2
Aliases: CVE-2017-1000433
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287
Published: 2018-07-13T16:01:17Z

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
Vulnerability: GHSA-p8c3-7rj8-q963
Summary: ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign
Aliases: CVE-2020-14966
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2020-06-26T16:54:15Z

### Impact
Jsrsasign supports ECDSA signature validation which signature value is represented by ASN.1 DER encoding. This vulnerablity may accept a wrong ASN.1 DER encoded ECDSA signature such as:

- wrong multi-byte ASN.1 length of TLV (ex. 0x820045 even though 0x45 is correct)
- prepending zeros with ASN.1 INTEGER value (ex. 0x00000123 even though 0x0123 is correct)
- appending zeros to signature of ASN.1 TLV (ex. 0x3082....1fbc000000 even though 0x3082....1fbc, appending zeros are ignored.)

This vulnerability was fixed by strict ASN.1 DER checking. 

Here is an assessment of this vulnerability:

- If you are not use ECDSA signature validation, this vulnerability is not affected.
- Not ASN.1 format signature like just concatenation of R and S value is not affected such as Bitcoin.
- This vulnerability is affected to all ECC curve parameters.
- Risk to accept a forged or crafted message to be signed is low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.
- ECDSA signatures semantically the same to valid one may be accepted as valid. There are many malleable variants.

As discussed [here](https://crypto.stackexchange.com/questions/24862/ber-or-der-x9-62-for-ecdsa-signature), there is no standards like X9.62 which requires ASN.1 DER. So ASN.1 BER can be applied to ECDSA however most of implementations like OpenSSL do strict ASN.1 DER checking.

### Patches
Users using ECDSA signature validation should upgrade to 8.0.19.

### Workarounds
Do strict ASN.1 DER checking for ASN.1 encoded ECDSA signature value.

### References
https://nvd.nist.gov/vuln/detail/CVE-2020-14966
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14966
https://vuldb.com/?id.157123
https://github.com/kjur/jsrsasign/issues/437
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.ECDSA.html
https://kjur.github.io/jsrsasign/api/symbols/ASN1HEX.html#.checkStrictDER
https://www.itu.int/rec/T-REC-X.690
Vulnerability: GHSA-25f5-gc4h-hc22
Summary: Improper Privilege Management in devise_masquerade
Aliases: CVE-2021-28680
Severity: HIGH
CVSS score: 8.1
CWE: CWE-269
Published: 2021-12-08T19:55:30Z

The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
Vulnerability: GHSA-86p3-4gfq-38f2
Summary: Denial of Service in url-relative
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2019-06-05T14:10:34Z

All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-r38r-qp28-2m63
Summary: Critical severity vulnerability that affects rope
Aliases: CVE-2014-3539
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-07-26T16:08:49Z

base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
Vulnerability: GHSA-27fj-mc8w-j9wg
Summary: RSA signature validation vulnerability on maleable encoded message in jsrsasign
Aliases: CVE-2021-30246
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-347
Published: 2021-04-16T19:52:35Z

### Impact
Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding.
Decoded RSA signature value consists following form:
01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]
Its byte length shall be the same as RSA key length however such checking was not sufficient.

To make crafted message for practical attack is very hard.

### Patches
Users validating RSA signature should upgrade to 10.2.0 or later.

### Workarounds
There is no workaround. Not to use RSA signature validation in jsrsasign.

### ACKNOWLEDGEMENT
Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.
Vulnerability: GHSA-3q5x-7mxp-rp6j
Summary: Remote code execution via vulnerable Symphony dependecy injection
Aliases: CVE-2019-8135
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2019-11-12T22:59:32Z

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.
Vulnerability: GHSA-fcwc-p4fc-c5cc
Summary: Null pointer dereference in `MatrixDiagPartOp`
Aliases: CVE-2021-37643
Severity: HIGH
CVSS score: 7.7
CWE: CWE-476
Published: 2021-08-25T14:43:42Z

### Impact
If a user does not provide a valid padding value to `tf.raw_ops.MatrixDiagPartOp`, then the code triggers a null pointer dereference (if input is empty) or produces invalid behavior, ignoring all values after the first:

```python
import tensorflow as tf

tf.raw_ops.MatrixDiagPartV2(
  input=tf.ones(2,dtype=tf.int32),
  k=tf.ones(2,dtype=tf.int32),
  padding_value=[])
```

Although this example is given for `MatrixDiagPartV2`, all versions of the operation are affected.

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L89) reads the first value from a tensor buffer without first checking that the tensor has values to read from.

### Patches
We have patched the issue in GitHub commit [482da92095c4d48f8784b1f00dda4f81c28d2988](https://github.com/tensorflow/tensorflow/commit/482da92095c4d48f8784b1f00dda4f81c28d2988).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-77gc-fj98-665h
Summary: Signature Validation Bypass
Aliases: CVE-2016-9122
Severity: HIGH
CVSS score: 7.5
CWE: CWE-284
Published: 2021-05-18T19:15:09Z

Go JOSE before 1.1.0 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
Vulnerability: GHSA-6w62-hx7r-mw68
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39154
Severity: HIGH
CVSS score: 8.5
CWE: CWE-434, CWE-502
Published: 2021-08-25T14:46:38Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39154](https://x-stream.github.io/CVE-2021-39154.html).

### Credits
ka1n4t found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-jh2g-xhqq-x4w9
Summary: Send/Sync bound needed on T  for Send/Sync impl of RcuCell<T>
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:07Z

Affected versions of this crate unconditionally implement Send/Sync for `RcuCell<T>`.
This allows users to send `T: !Send` to other threads (while `T` enclosed within `RcuCell<T>`), and allows users to concurrently access `T: !Sync` by using the APIs of `RcuCell<T>` that provide access to `&T`.

This can result in memory corruption caused by data races.
Vulnerability: GHSA-5v3f-73gv-x7x5
Summary: cairo is vulnerable to denial of service due to a null pointer dereference
Aliases: CVE-2017-7475
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-476
Published: 2017-11-15T20:41:14Z

Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
Vulnerability: GHSA-gj26-g5qf-jrh7
Summary: Cross-site Scripting in librenms
Aliases: CVE-2022-0589
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-16T00:01:51Z

Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
Vulnerability: GHSA-q6j2-g8qf-wvf7
Summary: Verification check bypass in Gate One
Aliases: CVE-2020-19003
Severity: MODERATE
CVSS score: 0
Published: 2021-10-12T22:34:28Z

An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.
Vulnerability: GHSA-ffhg-7mh4-33c4
Summary: Improper Verification of Cryptographic Signature in golang.org/x/crypto
Aliases: CVE-2020-9283
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-347
Published: 2021-05-18T15:29:31Z

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.
Vulnerability: GHSA-4jf5-jggp-g56j
Summary: Cross-Site Request Forgery in com.softwaremill.akka-http-session:core_2.12
Aliases: CVE-2020-28452
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-01-06T20:23:05Z

This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value, as the check in randomTokenCsrfProtection only checks that the two values are equal and non-empty.
Vulnerability: GHSA-962m-m8jw-8wrr
Summary: Path Traversal in Zope
Aliases: CVE-2021-32633
Severity: HIGH
CVSS score: 8.8
CWE: CWE-22
Published: 2021-06-15T16:10:49Z

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.
Vulnerability: GHSA-gvcp-948f-8f2p
Summary: Use of Uninitialized Resource in libp2p-deflate
Aliases: CVE-2020-36443
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2021-08-25T20:59:04Z

An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.
Vulnerability: GHSA-3v5x-qjrp-q2hq
Summary: Unrestricted Upload of File with Dangerous Type in ButterCMS
Aliases: CVE-2022-27260
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2022-04-13T00:00:24Z

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
Vulnerability: GHSA-hm2h-f456-6j88
Summary: Cross-site scripting in Plone
Aliases: CVE-2021-33512
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-08T23:20:04Z

Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.
Vulnerability: GHSA-94qw-r73x-j7hg
Summary: Users with ROLE_COURSE_ADMIN can create new users in Opencast
Aliases: CVE-2020-5231
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-285
Published: 2020-01-30T21:21:37Z

### Impact

Users with the role `ROLE_COURSE_ADMIN` can use the user-utils endpoint to create new users not including the role `ROLE_ADMIN`. For example:

```bash
# Use the admin to create a new user with ROLE_COURSE_ADMIN using the admin user.
# We expect this to work.
% curl -i -u admin:opencast 'https://example.opencast.org/user-utils/xy.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201

# Use the new user to create more new users.
# We don't expüect a user with just role ROLE_COURSE_ADMIN to succeed.
# But it does work
% curl -i -u xy:f 'https://example.opencast.org/user-utils/ab.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201
```
`ROLE_COURSE_ADMIN` is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation.

### Patches

This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.

### Workarounds

You can fix this issue by removing all instances of `ROLE_COURSE_ADMIN` in your organization's security configuration (`etc/security/mh_default_org.xml` by default).

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-g4h2-4wvh-grc5
Summary: Uncontrolled Resource Consumption in simple_asn1
Aliases: CVE-2021-45711
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-01-06T22:05:05Z

An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
Vulnerability: GHSA-vq36-27g6-p492
Summary: Out of bounds read in Tensorflow
Aliases: CVE-2022-23592
Severity: HIGH
CVSS score: 8.1
CWE: CWE-125
Published: 2022-02-09T23:31:48Z

### Impact
TensorFlow's [type inference](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/graph/graph.cc#L223-L229) can cause a heap OOB read as the bounds checking is done in a `DCHECK` (which is a no-op during production):

```cc
if (node_t.type_id() != TFT_UNSET) {
  int ix = input_idx[i];
  DCHECK(ix < node_t.args_size())
      << "input " << i << " should have an output " << ix
      << " but instead only has " << node_t.args_size()
      << " outputs: " << node_t.DebugString();
  input_types.emplace_back(node_t.args(ix));
  // ...
}       
```   
      
An attacker can control `input_idx` such that `ix` would be larger than the number of values in `node_t.args`.
        
### Patches
We have patched the issue in GitHub commit [c99d98cd189839dcf51aee94e7437b54b31f8abd](https://github.com/tensorflow/tensorflow/commit/c99d98cd189839dcf51aee94e7437b54b31f8abd).
  
The fix will be included in TensorFlow 2.8.0. This is the only affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-jh63-28gx-7p26
Summary: Command Injection in CasaOS
Aliases: CVE-2022-24193
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-03-11T00:02:17Z

CasaOS before v0.2.7 was discovered to contain a command injection vulnerability via the component leave or join zerotier api.
Vulnerability: GHSA-82xf-8h9p-c6qj
Summary: Cross-Site Request Forgery in forkcms
Aliases: CVE-2020-23264
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-06-22T15:23:45Z

Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
Vulnerability: GHSA-q2q7-5pp4-w6pg
Summary: Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
Aliases: CVE-2021-33503
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-01T21:19:32Z

### Impact

When provided with a URL containing many `@` characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.


### Patches

The issue has been fixed in urllib3 v1.26.5.

### References

- [CVE-2021-33503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503)
- [JVNVU#92413403 (English)](https://jvn.jp/en/vu/JVNVU92413403/)
- [JVNVU#92413403 (Japanese)](https://jvn.jp/vu/JVNVU92413403/)
- [urllib3 v1.26.5](https://github.com/urllib3/urllib3/releases/tag/1.26.5)

### For more information
If you have any questions or comments about this advisory:
* Ask in our [community Discord](https://discord.gg/urllib3)
* Email [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)
Vulnerability: GHSA-cfjh-p3g4-3q2f
Summary: VBScript Content Injection in marked
Aliases: CVE-2015-1370
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Versions 0.3.2 and earlier of `marked` are affected by a cross-site scripting vulnerability even when `sanitize:true` is set. 

## Proof of Concept ( IE10 Compatibility Mode Only )

`[xss link](vbscript:alert(1&#41;)`

will get a link

`<a href="vbscript:alert(1)">xss link</a>`


## Recommendation

Update to version 0.3.3 or later.
Vulnerability: GHSA-4vpc-5jx4-cfqg
Summary: User enumeration leak using switch user functionality in Symfony
Aliases: CVE-2019-18886
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-203
Published: 2019-12-02T18:09:21Z

An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.
Vulnerability: GHSA-vf4w-fg7r-5v94
Summary: Improper Certificate Validation in phpseclib
Aliases: CVE-2021-30130
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347, CWE-295
Published: 2021-04-07T20:56:55Z

phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.
Vulnerability: GHSA-pfj3-56hm-jwq5
Summary: Template injection in cron-utils
Aliases: CVE-2020-26238
Severity: CRITICAL
CVSS score: 7.9
CWE: CWE-74
Published: 2020-11-24T23:48:38Z

### Impact
A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

### Patches
The issue was patched and a new version released. Please upgrade to version 9.1.3.

### Workarounds
There are no known workarounds up to this moment.

### References
A description of the issue is provided in [issue 461](https://github.com/jmrozanec/cron-utils/issues/461)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [cron-utils Github repository](https://github.com/jmrozanec/cron-utils)
Vulnerability: GHSA-hf6f-jq25-8gq9
Summary: Remote Code Execution (RCE)
Aliases: CVE-2018-18926
Severity: CRITICAL
CVSS score: 8.1
CWE: CWE-94
Published: 2022-02-15T01:57:18Z

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
Vulnerability: GHSA-rhcw-wjcm-9h6g
Summary: Denial of service in Undertow
Aliases: CVE-2020-27782
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-09T00:54:12Z

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
Vulnerability: GHSA-9h6g-gp95-x3q5
Summary: actionpack is vulnerable to denial of service because of a wildcard controller route
Aliases: CVE-2015-7581
Severity: HIGH
CVSS score: 7.5
Published: 2017-10-24T18:33:36Z

actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.
Vulnerability: GHSA-3c7p-vv5r-cmr5
Summary: Incorrect Authorization in Apache Solr
Aliases: CVE-2020-13957
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-863
Published: 2022-02-10T00:31:27Z

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
Vulnerability: GHSA-gqq4-937c-2282
Summary: Malicious Package in juffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:49:42Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-wfrj-qqc2-83cm
Summary: Remote command injection when using sendmail email transport
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-88
Published: 2021-09-20T19:52:41Z

### Impact

Sites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a [vulnerability](https://github.com/advisories/GHSA-48ww-j4fc-435p) in the `nodemailer` dependency.

Ghost defaults to the `direct` transport so this is only exploitable if the `sendmail` transport is explicitly used.

### Patches

Fixed in 4.15.0, all sites should upgrade as soon as possible.

### Workarounds

* Use an alternative email transport as described in the [docs](https://ghost.org/docs/config/#mail). 

### For more information

If you have any questions or comments about this advisory:

* email us at security@ghost.org
Vulnerability: GHSA-7vvq-7r29-5vg3
Summary: Cross site scripting in three.js
Aliases: CVE-2022-0177
Severity: HIGH
CVSS score: 7.1
CWE: CWE-79
Published: 2022-01-27T16:00:48Z

# CVE has been withdrawn

Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.
Vulnerability: GHSA-7752-f4gf-94gc
Summary: Cross-Site Scripting in materialize-css
Aliases: CVE-2019-11003
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-09T19:44:38Z

All versions of `materialize-css` are vulnerable to Cross-Site Scripting. The `autocomplete` component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-5fxv-xx5p-g2fv
Summary: Integer Overflow in microweber
Aliases: CVE-2022-0968
Severity: HIGH
CVSS score: 7.2
CWE: CWE-190
Published: 2022-03-16T00:00:46Z

Microweber is a new generation CMS with drag and drop. The microweber application allows large characters to insert in the input field "first & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The first name & last name input should be limited to 50 characters or max 100 characters
Vulnerability: GHSA-4rv9-5vc4-88cg
Summary: Command injection in node-ps
Aliases: CVE-2020-7785
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-03-19T21:21:06Z

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.
Vulnerability: GHSA-7hfm-57qf-j43q
Summary: Excessive Iteration in Compress
Aliases: CVE-2021-35515
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835, CWE-834
Published: 2021-08-02T16:55:07Z

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Vulnerability: GHSA-jxhc-q857-3j6g
Summary: Regular Expression Denial of Service in Addressable templates
Aliases: CVE-2021-32740
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-07-12T16:58:33Z

### Impact

Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected.

### Patches

The vulnerability was introduced in version 2.3.0 (previously yanked) and has been present in all subsequent versions up to, and including, 2.7.0. It is fixed in version 2.8.0.

### Workarounds

The vulnerability can be avoided by only creating Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

### References

- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
- https://cwe.mitre.org/data/definitions/1333.html
- https://www.regular-expressions.info/catastrophic.html

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/sporkmonger/addressable/issues)
Vulnerability: GHSA-5pm8-492c-92p5
Summary: Prototype Pollution in chartkick
Aliases: CVE-2019-18841
Severity: HIGH
CVSS score: 0
Published: 2019-12-02T18:04:11Z

Affected versions of `@polymer/polymer` are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as `{"__proto__": {"polluted": true}}`. It is possible to achieve the same results if a chart loads data from a malicious server.


## Recommendation

Upgrade to version 3.2.0 or later.
Vulnerability: GHSA-ww6v-677g-p656
Summary: Sandbox Breakout in safe-eval
Aliases: CVE-2017-16088
Severity: CRITICAL
CVSS score: 0
CWE: CWE-610
Published: 2018-07-18T18:28:10Z

Affected versions of `safe-eval` are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox. 

## Proof of Concept:
This code accesses the process object and calls `.exit()`
```
var safeEval = require('safe-eval');
safeEval("this.constructor.constructor('return process')().exit()");
```


## Recommendation

Update to version 0.4.0 or later
Vulnerability: GHSA-9j8q-m9x5-9g6j
Summary: Data races in async-coap
Aliases: CVE-2020-36444
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:11Z

An issue was discovered in the async-coap crate through 2020-12-08 for Rust. 
Affected versions of this crate implement Send/Sync for `ArcGuard<RC, T>` with no trait bounds on `RC`. This allows users to send `RC: !Send` to other threads and also allows users to concurrently access `Rc: !Sync` from multiple threads.

This can result in memory corruption from data race or other undefined behavior caused by sending `T: !Send` to other threads (e.g. dropping `MutexGuard<T>` in another thread that didn't lock its mutex).
Vulnerability: GHSA-hxhm-96pp-2m43
Summary: Remote Code Execution in Angular Expressions
Aliases: CVE-2020-5219
Severity: HIGH
CVSS score: 8.7
CWE: CWE-74
Published: 2020-01-24T15:27:25Z

### Impact

The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.

* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).
* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

### Patches

Users should upgrade to version 1.0.1 of angular-expressions

### Workarounds

A temporary workaround might be either to : 

* disable user-controlled input that will be fed into angular-expressions in your application

OR

* allow only following characters in the userControlledInput : 

```js
if (/^[|a-zA-Z.0-9 :"'+-?]+$/.test(userControlledInput)) {
      var result = expressions.compile(userControlledInput);
}
else {
     result = undefined;
}
```

### References

[Removal of angular-expression sandbox](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [angular-expressions](https://github.com/peerigon/angular-expressions/issues)
* [Email us](mailto:contact@javascript-ninja.fr)

### Credits 

The issue was reported by Maxime Nadeau from GoSecure, Inc.
Vulnerability: GHSA-96v6-hrwg-p378
Summary: Weak Password Requirements in Daybyday CRM
Aliases: CVE-2022-22110
Severity: HIGH
CVSS score: 7.5
CWE: CWE-521
Published: 2022-01-08T00:31:51Z

In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
Vulnerability: GHSA-gprh-7767-cw39
Summary: Code Injection in Bolt CMS
Aliases: CVE-2021-40219
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94
Published: 2022-04-12T00:00:34Z

Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.