TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4936-rj25-6wm6
Summary: High severity vulnerability that affects nori
Aliases: CVE-2013-0285
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-6xv6-jpvw-cx6q
Summary: Command injection in bestzip
Aliases: CVE-2020-7730
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-06T18:27:36Z

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
Vulnerability: GHSA-8rx6-v5q4-xw3j
Summary: XML External Entity Reference in Jenkins Coverage/Complexity Scatter Plot Plugin
Aliases: CVE-2022-28154
Severity: HIGH
CVSS score: 8.1
CWE: CWE-611
Published: 2022-03-30T00:00:23Z

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-rcj2-vvjx-87pm
Summary: Missing Encryption of Sensitive Data in arrow-kt Arrow
Aliases: CVE-2019-11404
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-311
Published: 2019-04-22T17:15:40Z

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
Vulnerability: GHSA-6hgm-866r-3cjv
Summary: Insecure Deserialization in Apache Commons Collection
Aliases: CVE-2015-6420
Severity: HIGH
CVSS score: 0
Published: 2020-06-15T20:36:20Z

Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.
Vulnerability: GHSA-r6cm-wg48-rh2r
Summary: Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
Aliases: CVE-2022-0482
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-863, CWE-359
Published: 2022-03-10T00:00:40Z

The software is a booking management system that has a public form to place bookings, and a private area for the calendar and management of services, users, settings, etc. There is a backend API that allows data manipulation, including listing the appointments for a specific time range. This happens on this endpoint: /index.php/backend_api/ajax_get_calendar_events Unfortunately, there is no authentication / permissions-check on that endpoint, the only required parameters in a POST request are "startDate", "endDate" and "csrfToken". Because the csrfToken can be obtained by any unauthenticated user just visiting the public form (and is valid for the backend as well), any attacker can query the backend API and obtain all sorts of private information about the appointment, in JSON format.
Vulnerability: GHSA-92v9-xh2q-fq9f
Summary: Prototype Pollution in @cookiex/deep
Aliases: CVE-2021-23442
Severity: HIGH
CVSS score: 8.6
CWE: CWE-1321, CWE-915
Published: 2021-09-20T20:12:38Z

The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the __proto__ object.
Vulnerability: GHSA-m884-279h-32v2
Summary: Exceptions displayed in non-debug configurations in Symfony
Aliases: CVE-2020-5274
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-209
Published: 2020-03-30T20:09:31Z

Description
-----------

When `ErrorHandler` renders an exception HTML page, it uses un-escaped properties from the related Exception class to render the stacktrace. The security issue comes from the fact that the stacktraces were also displayed in non-`debug` environments.

Resolution
----------

The `ErrorHandler` class now escapes all properties coming from the related Exception, and the stacktrace is not displayed anymore in non-`debug` environments.

The patches for this issue are available [here](https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad) and [here](https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db) for branch 4.4.

Credits
-------

I would like to thank Luka Sikic for reporting & Yonel Ceruto and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-39cx-xcwj-3rc4
Summary: Cross-Site Scripting in dojo
Aliases: CVE-2008-6681
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:25:29Z

Affected versions of `dojo` are susceptible to a cross-site scripting vulnerability in the `dijit.Editor` and `textarea` components, which execute their contents as Javascript, even when sanitized.


## Recommendation

Update to version 1.1 or later.
Vulnerability: GHSA-wrr7-33fx-rcvj
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2018-12022
Severity: HIGH
CVSS score: 0
Published: 2020-06-15T18:44:56Z

**Withdrawn:** Duplicate of GHSA-cjjf-94ff-43w7
Vulnerability: GHSA-xp6v-qx65-4pp7
Summary: Data races in gfwx
Aliases: CVE-2020-36211
Severity: HIGH
CVSS score: 7
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:50:39Z

An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
Vulnerability: GHSA-c6qr-h5vq-59jc
Summary: Untrusted users can run pending migrations in production in Rails
Aliases: CVE-2020-8185
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2020-06-24T17:40:33Z

There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed
an untrusted user to run any pending migrations on a Rails app running in
production.

This vulnerability has been assigned the CVE identifier CVE-2020-8185.

Versions Affected:  6.0.0 < rails < 6.0.3.2
Not affected:       Applications with `config.action_dispatch.show_exceptions = false` (this is not a default setting in production)
Fixed Versions:     rails >= 6.0.3.2

Impact
------

Using this issue, an attacker would be able to execute any migrations that
are pending for a Rails app running in production mode. It is important to
note that an attacker is limited to running migrations the application
developer has already defined in their application and ones that have not
already ran.

Workarounds
-----------

Until such time as the patch can be applied, application developers should
disable the ActionDispatch middleware in their production environment via
a line such as this one in their config/environment/production.rb:

`config.middleware.delete ActionDispatch::ActionableExceptions`
Vulnerability: GHSA-f794-r6xc-hf3v
Summary: Improper Access Control in passport-oauth2
Aliases: CVE-2021-41580
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-287
Published: 2021-09-29T17:18:32Z

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability.
Vulnerability: GHSA-m734-r4g6-34f9
Summary: NoSQL Injection in loopback-connector-mongodb
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2019-06-04T19:36:17Z

Versions of `loopback-connector-mongodb` before 3.6.0 are vulnerable to NoSQL injection.

MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless disabled ([instructions here](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js)).

A proof of concept malicious query:

```
GET /POST filter={"where": {"$where": "function(){sleep(5000); return this.title.contains('Hello');}"}}
```

The above makes the database sleep for 5 seconds and then returns all “Posts” with the title containing the word `Hello`.




## Recommendation

Update to version 3.6.0 or later.
Vulnerability: GHSA-rrj3-qmh8-72pf
Summary: Sensitive Data In Log Files in grunt-gh-pages
Aliases: CVE-2016-10526
Severity: MODERATE
CVSS score: 0
CWE: CWE-391
Published: 2019-02-18T23:39:11Z

Versions of `grunt-gh-pages` prior to 1.0.0 are affected by a vulnerability which may cause unencrypted github credentials to be written to a log file in certain circumstances.

In the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a github token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted.


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-x5r2-hj5c-8jx6
Summary: SSRF in adminer
Aliases: CVE-2021-21311
Severity: HIGH
CVSS score: 7.2
CWE: CWE-918
Published: 2021-02-11T20:42:59Z

### Impact
Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected.

### Patches
Patched by ccd2374b, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).

### Workarounds
* Use a single driver version (e.g. `adminer-mysql.php`).
* Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).

### References
https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf

### For more information
If you have any questions or comments about this advisory:
* Comment at ccd2374b.
Vulnerability: GHSA-533p-cp2g-99wp
Summary: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3931
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-11-15T23:19:09Z

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-rmpv-rcp6-v8wc
Summary: Cross-site scripting in Plone
Aliases: CVE-2021-33508
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-08T23:20:11Z

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.
Vulnerability: GHSA-3c5c-7235-994j
Summary: Moderate severity vulnerability that affects Pillow
Aliases: CVE-2016-2533
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-119
Published: 2018-07-24T20:15:13Z

Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.
Vulnerability: GHSA-hm6q-r2jc-cpqh
Summary: Malicious Package in lodahs
Aliases: CVE-2019-19771
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2019-12-16T19:29:33Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-g4mq-6fp5-qwcf
Summary: Exposure of Resource to Wrong Sphere and 	Insecure Temporary File in Ansible
Aliases: CVE-2020-1733
Severity: MODERATE
CVSS score: 5
CWE: CWE-362, CWE-377, CWE-668
Published: 2021-04-20T16:46:12Z

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Vulnerability: GHSA-wjf2-7f9g-86f5
Summary: Malicious Package in fast-requests
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:23:38Z

All versions of `fast-requests` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-xmxh-g7wj-8m4m
Summary: OS Command Injection in curling
Aliases: CVE-2019-10789
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:32:26Z

npm package `curling` before version 1.1.0 is vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.
Vulnerability: GHSA-xxfr-jrgh-x392
Summary: Remote code execution in ChakraCore
Aliases: CVE-2020-1172
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-08-02T17:29:01Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1057, CVE-2020-1180.
Vulnerability: GHSA-p4x4-rw2p-8j8m
Summary: Cross-site Scripting in Sanitize 
Aliases: CVE-2020-4054
Severity: HIGH
CVSS score: 7.3
CWE: CWE-79
Published: 2020-06-16T22:08:06Z

When HTML is sanitized using Sanitize's "relaxed" config or a custom config that allows certain elements, some content in a `<math>` or `<svg>` element may not be sanitized correctly even if `math` and `svg` are not in the allowlist.

You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:

- `iframe`
- `math`
- `noembed`
- `noframes`
- `noscript`
- `plaintext`
- `script`
- `style`
- `svg`
- `xmp`

### Impact

Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.

### Releases

This problem has been fixed in Sanitize 5.2.1.

### Workarounds

If upgrading is not possible, a workaround is to override the default value of Sanitize's `:remove_contents` config option with the following value, which ensures that the contents of `math` and `svg` elements (among others) are removed entirely when those elements are not in the allowlist:

```ruby
%w[iframe math noembed noframes noscript plaintext script style svg xmp]
```

For example, if you currently use Sanitize's relaxed config, you can create a custom config object that overrides the default value of `:remove_contents` like this:

```ruby
custom_config = Sanitize::Config.merge(
  Sanitize::Config::RELAXED,
  :remove_contents => %w[iframe math noembed noframes noscript plaintext script style svg xmp]
)
```

You would then pass this custom config to Sanitize when sanitizing HTML.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in the [Sanitize repo](https://github.com/rgrove/sanitize).
- See Sanitize's [security policy](https://github.com/rgrove/sanitize/security/policy).

### Credits

Many thanks to Michal Bentkowski of Securitum for reporting this bug and helping to verify the fix.

### References

- [GHSA-p4x4-rw2p-8j8m](https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m)
- [CVE-2020-4054](https://nvd.nist.gov/vuln/detail/CVE-2020-4054)
- https://github.com/rgrove/sanitize/releases/tag/v5.2.1
Vulnerability: GHSA-wc4x-4gm2-74j8
Summary: Improper Certificate Validation in Apache Geode
Aliases: CVE-2019-10091
Severity: MODERATE
CVSS score: 7.4
CWE: CWE-295
Published: 2022-02-10T20:51:04Z

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.
Vulnerability: GHSA-32xf-jwmv-9hf3
Summary: Directory traversal attack in Spring Cloud Config
Aliases: CVE-2020-5410
Severity: MODERATE
CVSS score: 0
CWE: CWE-23
Published: 2020-06-05T16:13:20Z

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Vulnerability: GHSA-g2pf-qjgf-6fw3
Summary: Downloads Resources over HTTP in openframe-glslviewer
Aliases: CVE-2016-10607
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:33:42Z

Affected versions of `openframe-glslviewer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `openframe-glslviewer`.


## Recommendation

No patch is currently available for this vulnerability, and the package hasn't been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-6rmq-x2hv-vxpp
Summary: Vulnerable third party libraries in certain configurations of Symfony
Aliases: CVE-2019-6338
Severity: HIGH
CVSS score: 8
CWE: CWE-502
Published: 2019-12-02T18:11:25Z

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
Vulnerability: GHSA-gggp-gh2p-996x
Summary: Path Traversal in LemMinX
Aliases: CVE-2022-0673
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2022-02-19T00:01:27Z

A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files is possible due to directory traversal.
Vulnerability: GHSA-6rhx-hqxm-8p36
Summary: Double free in http
Aliases: CVE-2019-25009
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:46:44Z

An issue was discovered in the http crate before 0.1.20 for Rust. The HeaderMap::Drain API can use a raw pointer, defeating soundness.
Vulnerability: GHSA-xg6r-5gx4-qxjm
Summary: invoiceninja is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3977
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-06T21:58:34Z

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-769c-qphh-g3wm
Summary: Downloads Resources over HTTP in macaca-chromedriver
Aliases: CVE-2016-10586
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:51:09Z

Affected versions of `macaca-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `macaca-chromedriver`.


## Recommendation

Update to version 1.0.29 or later.
Vulnerability: GHSA-6p48-xfj3-jw67
Summary: Downloads Resources over HTTP in fibjs
Aliases: CVE-2016-10621
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:56:54Z

Affected versions of `fibjs` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fibjs`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-f94m-mqhr-mc29
Summary: Moderate severity vulnerability that affects io.spray:spray-json_2.10, io.spray:spray-json_2.11, and io.spray:spray-json_2.12
Aliases: CVE-2018-18853
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-11-09T17:42:26Z

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.
Vulnerability: GHSA-5q6m-3h65-w53x
Summary: Improper Neutralization of Special Elements used in an OS Command.
Aliases: CVE-2021-24033
Severity: MODERATE
CVSS score: 0
CWE: CWE-78
Published: 2021-03-11T22:26:09Z

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
Vulnerability: GHSA-rprj-g6xc-p5gq
Summary: Moderate severity vulnerability that affects wicked
Aliases: CVE-2013-4413
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:37Z

Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers to read arbitrary files via a %2E%2E%2F (encoded dot dot slash) in the step.
Vulnerability: GHSA-64x2-gq24-75pv
Summary: Cross-site scripting in Apache CXF
Aliases: CVE-2020-13954
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-22T16:15:23Z

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Vulnerability: GHSA-m72m-mhq2-9p6c
Summary: Uncaught Exception in jsoup
Aliases: CVE-2021-37714
Severity: HIGH
CVSS score: 7.5
CWE: CWE-248, CWE-835
Published: 2021-08-23T19:42:38Z

### Impact
_What kind of vulnerability is it? Who is impacted?_
Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to jsoup 1.14.2

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Users may rate limit input parsing. Users should limit the size of inputs based on system resources. Users should implement thread watchdogs to cap and timeout parse runtimes.
Vulnerability: GHSA-p32g-242c-76h3
Summary: Malicious Package in geoheat
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:14:49Z

Version 1.3.2 of `geoheat` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-458f-26r3-x2c3
Summary: Cross-site Scripting in github.com/schollz/rwtxt
Aliases: CVE-2021-20848
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-11-29T18:00:21Z

Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Vulnerability: GHSA-qwj8-p662-3m7x
Summary: Path Traversal in localhost-now
Aliases: CVE-2019-5416
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-03-25T16:17:05Z

All versions of `localhost-now` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7jfh-2xc9-ccv7
Summary: Cross-Site Scripting in public
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2019-05-31T23:46:40Z

All versions of `public` are vulnerable to stored cross-site scripting (XSS). 


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-cfw5-v7cw-69cw
Summary: Critical severity vulnerability that affects org.apache.directory.api:apache-ldap-api
Aliases: CVE-2018-1337
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-200
Published: 2018-11-09T17:49:49Z

In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Vulnerability: GHSA-xg5r-8j97-2wrj
Summary: Directory Traversal in restafary
Aliases: CVE-2016-10528
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2019-02-18T23:39:22Z

Affected versions of `restafary` are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.


Proof of Concept

```
curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'
```


## Recommendation

Update to version 1.6.1 or later.
Vulnerability: GHSA-v5rv-hpxg-8x49
Summary: Signature validation bypass in ServiceStack
Aliases: CVE-2020-28042
Severity: MODERATE
CVSS score: 0
CWE: CWE-347
Published: 2021-01-13T19:13:11Z

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
Vulnerability: GHSA-rmp7-f2vp-3rq4
Summary: Cross-site scripting in SiCKRAGE
Aliases: CVE-2021-25925
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-04-20T16:31:54Z

in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information.
Vulnerability: GHSA-vf77-8h7g-gghp
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
Aliases: CVE-2020-13934
Severity: HIGH
CVSS score: 7.5
CWE: CWE-119, CWE-476
Published: 2022-02-08T22:05:00Z

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Vulnerability: GHSA-52vv-3vf7-f7wh
Summary: Server-Side Request Forgery and Uncontrolled Resource Consumption in LemMinX
Aliases: CVE-2022-0671
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-400, CWE-918
Published: 2022-02-19T00:01:28Z

A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.
Vulnerability: GHSA-7xj5-fwqr-5378
Summary: Cross-site Scripting in craftcms/cms
Aliases: CVE-2022-28378
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-04T00:00:54Z

Craft CMS before 3.7.29 allows cross-site scripting.
Vulnerability: GHSA-79mx-88w7-8f7q
Summary: XSS Filter Bypass via Encoded URL in validator
Aliases: CVE-2014-9772
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-06T23:12:49Z

Versions of `validator` prior to 2.0.0 contained an xss filter method that is affected by several filter bypasses. This may result in a cross-site scripting vulnerability.


## Proof of Concept
The xss() function removes the word "javascript" when contained inside an attribute.

However, it does not properly handle cases where characters have been hex-encoded. 

As a result, it is possible to build an input that bypasses the filter but which the browser will accept as valid JavaScript.

For example:
```<a href="jav&#x61;script:...">abc</a>```
will render as:
```<a href="javascript:...">abc</a>```


## Recommendation

The package author has decided to remove the xss filter functionality in the latest version of this module. If this feature is not currently being used, you are not affected by the vulnerability. If it is being used, updating to the latest version of the module will break your application.

In order for affected users to mitigate this vulnerability, it is necessary to use an [alternative package](https://www.npmjs.com/search?q=xss%20filter&page=1&ranking=optimal) that provides similar functionality.
Vulnerability: GHSA-mw75-qvfr-hpmr
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0938
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-15T00:01:01Z

ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-mpq4-rjj8-fjph
Summary: Uncontrolled Resource Consumption in github.com/google/fscrypt
Aliases: CVE-2022-25326
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400
Published: 2022-02-26T00:00:44Z

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.
Vulnerability: GHSA-wg9m-gw3h-hg83
Summary: Injection in field_test
Aliases: CVE-2019-13146
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-74
Published: 2019-07-16T00:42:27Z

The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).
Vulnerability: GHSA-v2p6-4mp7-3r9v
Summary: Regular Expression Denial of Service in underscore.string
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-06-14T16:26:22Z

Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS).

The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.


## Recommendation

Upgrade to version 3.3.5 or higher.
Vulnerability: GHSA-ph32-23p8-9rw5
Summary: Improper Input Validation in network-manager
Aliases: CVE-2019-10786
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20, CWE-78
Published: 2021-04-13T15:17:45Z

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.
Vulnerability: GHSA-3p9j-442x-hjp7
Summary: Business Logic Errors in microweber
Aliases: CVE-2022-0689
Severity: MODERATE
CVSS score: 5.3
Published: 2022-02-20T00:00:31Z

microweber prior to 1.2.11 allows multiple uses of a single-use coupon.
Vulnerability: GHSA-6pc9-xqrg-wfqw
Summary: Exposure of Sensitive information in httpie
Aliases: CVE-2022-0430
Severity: LOW
CVSS score: 2.4
CWE: CWE-200
Published: 2022-03-16T00:00:47Z

httpie is a modern, user-friendly command-line HTTP client for the API era. Prior to version 3.1.0, all cookies saved to session storage are supercookies. At this time, there is no known workaround. Users are recommended to update to version 3.1.0.
Vulnerability: GHSA-xpwj-7v8q-mcgj
Summary: Static imports inside dynamically imported modules do not adhere to permission checks
Aliases: CVE-2021-32619
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-285
Published: 2021-09-23T23:18:03Z

### Impact

Modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing (especially transitively) untrusted code are affected. In Deno 1.7.x all programs importing (especially transitively) untrusted code are affected.

In effect an attacker in control of a (possibly remote) module in a programs module graph has been able to, **irrespective of permissions**:
1. initiate GET requests to arbitrary URLs on the internet (including LAN) and possibly read (parts of) the contents of these resources.
2. check for existence of arbitrary paths on the file system, and possibly read (parts of) the contents of these files.

In Deno 1.5.x (October 27th, 2020) and Deno 1.6.x (December 8th, 2020) the attacker module had to have been granted permissions to load dynamically through the network / fs read permission. Since Deno 1.7.x (January 19th, 2021) this vulnerability was able to be exploited in a fully sandboxed isolate (without any permissions). This vulnerability was not present in releases prior to 1.5.0.

Arbitrary non-GET requests, control over request headers, or file system writes are not possible through this vulnerability. Users of the `deno_core`, `deno_runtime`, or other `deno_*` crates are not affected. This is a Deno CLI only vulnerability.

We are relatively confident this was not abused in the wild, as by default Deno prints out a green "Download" message when remote imports are downloaded, and this would have caused suspicion if it occurred in the middle of a programs execution. This message can be silenced with the `--quiet` flag.  

### Patches

The vulnerability has been patched in Deno release 1.10.2. You can upgrade to the latest Deno version by running the `deno upgrade` command. The release is available through all official download channels. 

### Workarounds

There is no workaround for this issue.

### For more information

If you have any questions or comments about this advisory:
* Open an issue on [the issue tracker](https://github.com/denoland/deno)
* Discuss on [Discord](https://discord.gg/deno)
Vulnerability: GHSA-vw5m-qw2r-m923
Summary: Use of Uninitialized Resource in messagepack-rs.
Aliases: CVE-2021-45690
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:11:46Z

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
Vulnerability: GHSA-7c9w-qmrq-ff8r
Summary: Path Traversal in http-live-simulator
Aliases: CVE-2018-16479
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-02-07T18:14:21Z

Versions of `http-live-simulator` prior to 1.0.7 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: `curl --path-as-is http://localhost:8080//../../../../etc/passwd`.


## Recommendation

Upgrade to version 1.0.7
Vulnerability: GHSA-q4hg-rmq2-52q9
Summary: Improper Locking in Apache Tomcat
Aliases: CVE-2019-10072
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-667
Published: 2019-06-26T01:09:40Z

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Vulnerability: GHSA-7phr-5m9x-rw9q
Summary: Directory traversal in fast-http
Aliases: CVE-2020-7687
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2020-07-27T16:02:57Z

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.
Vulnerability: GHSA-qphc-hf5q-v8fc
Summary: Open Redirect in actionpack
Aliases: CVE-2021-44528
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-12-14T21:19:08Z

Specially crafted "X-Forwarded-Host" headers in combination with certain
"allowed host" formats can cause the Host Authorization middleware in Action
Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot. For example,
configuration files that look like this:

```
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted Host header
can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.

Releases
--------
The fixed releases are available at the normal locations.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series
* 6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series
* 7-0-host-authorzation-open-redirect.patch - Patch for 7.0 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.
Vulnerability: GHSA-2v7q-2xqx-f4q5
Summary: Potential SQL Injection in sequelize
Aliases: CVE-2016-10553
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2019-02-18T23:54:32Z

Affected versions of `sequelize` are vulnerable to SQL Injection when user input is passed into `findOne` or into a statement such as `where: "user input"`.



## Recommendation

Update to version 3.0.0 or later.

Version 3.0.0 will introduce a number of breaking changes.
Thankfully, the project authors have provided a 2.x -> 3.x [upgrade guide](https://github.com/sequelize/sequelize/wiki/Upgrade-from-2.0-to-3.0) to ease this transition.

If upgrading is not an option, it is also possible to mitigate this by ensuring that all uses of `where: "input"` and `findOne("input")` are properly sanitized, such as by the use of a wrapper function.
Vulnerability: GHSA-3qxp-qjq7-w4hf
Summary: CHECK-fail in tf.raw_ops.EncodePng
Aliases: CVE-2021-29531
Severity: LOW
CVSS score: 2.5
CWE: CWE-754
Published: 2021-05-21T14:22:13Z

### Impact
An attacker can trigger a `CHECK` fail in PNG encoding by providing an empty input tensor as the pixel data:

```python
import tensorflow as tf

image = tf.zeros([0, 0, 3])
image = tf.cast(image, dtype=tf.uint8) 
tf.raw_ops.EncodePng(image=image) 
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/kernels/image/encode_png_op.cc#L57-L60) only validates that the total number of pixels in the image does not overflow. Thus, an attacker can send an empty matrix for encoding. However, if the tensor is empty, then the associated buffer is `nullptr`. Hence, when [calling `png::WriteImageToBuffer`](https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/kernels/image/encode_png_op.cc#L79-L93), the first argument (i.e., `image.flat<T>().data()`) is `NULL`. This then triggers the `CHECK_NOTNULL` in the [first line of `png::WriteImageToBuffer`](https://github.com/tensorflow/tensorflow/blob/e312e0791ce486a80c9d23110841525c6f7c3289/tensorflow/core/lib/png/png_io.cc#L345-L349).

```cc
template <typename T>
bool WriteImageToBuffer(
    const void* image, int width, int height, int row_bytes, int num_channels,
    int channel_bits, int compression, T* png_string,
    const std::vector<std::pair<std::string, std::string> >* metadata) {
  CHECK_NOTNULL(image);
  ...
}
```

Since `image` is null, this results in `abort` being called after printing the stacktrace. Effectively, this allows an attacker to mount a denial of service attack.

### Patches
We have patched the issue in GitHub commit [26eb323554ffccd173e8a79a8c05c15b685ae4d1](https://github.com/tensorflow/tensorflow/commit/26eb323554ffccd173e8a79a8c05c15b685ae4d1).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-pp2h-95hm-hv9r
Summary: Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
Aliases: CVE-2021-37702
Severity: MODERATE
CVSS score: 0
CWE: CWE-1236
Published: 2021-08-30T16:13:13Z

### Impact
Data Object CSV import allows formular injection. 

### Patches
Problem is patched in 10.1.1

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/9992.patch

### References
https://cwe.mitre.org/data/definitions/1236.html
Vulnerability: GHSA-5679-7qrc-5m7j
Summary: IDOR can reveal execution data and logs to unauthorized user in Rundeck
Aliases: CVE-2020-11009
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-639
Published: 2020-04-29T16:31:12Z

### Impact

Authenticated users can craft a request that reveals Execution data and logs  and Job details that they are not authorized to see.

> Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher.

### Details

An authenticated user could craft a request to:

* View Executions and download execution logs without access to `read` or `view` the associated Job, or ad-hoc resource.
* Get the list of running executions in a project, without Event `read` access, if they have `read` access to view the project.
* View the Options definitions of a Job without access to view the Job.
* View the definition of a workflow step of a Job without access to view the Job.
* View the SCM diff of a modified Job definition if SCM is enabled, without Project `export` access level.
* View the New User Profile Form for a different username, without User `admin` access. Note: they would not be allowed to create or modify a profile for a different user, or reveal any user profile information for a different user.

Some authenticated API requests were not correctly checking appropriate authorization levels:

* The list of running Executions would be sent without `read` access to Events.
* The Plugin Input Parameters for a SCM plugin would be sent without authorization for project `import`,`scm_import`,`export`, or `scm_export` actions.
* Job Retry action could retry an execution without `read` or `view` access to the Execution, which would reveal the Execution's option values. (`run` access to the Job was still required).

### Patches
Upgrade to Rundeck version 3.2.6

### Workarounds
None

### References
[3.2.6 Release Notes](https://docs.rundeck.com/docs/history/3_2_x/version-3.2.6.html)

### Report
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [http://rundeck.com/security](http://rundeck.com/security)

Reporter: Justine Osborne of Apple Information Security
Vulnerability: GHSA-xwx6-vmj4-5rv8
Summary: Denial of service via deserialization attack in nifi
Aliases: CVE-2017-15703
Severity: MODERATE
CVSS score: 5
CWE: CWE-502
Published: 2019-10-25T19:42:50Z

A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.
Vulnerability: GHSA-6g47-63mv-qpgh
Summary: Prototype Pollution in dotty
Aliases: CVE-2021-23624
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:55:48Z

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.
Vulnerability: GHSA-7wq4-89xx-g62j
Summary: Password exposure in ShenYu
Aliases: CVE-2022-23223
Severity: HIGH
CVSS score: 7.5
CWE: CWE-522
Published: 2022-01-28T22:13:57Z

The HTTP response will disclose the user password. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-2p6p-v69p-9mm9
Summary: XSS in login form
Aliases: CVE-2019-13235
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-12T22:58:16Z

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
Vulnerability: GHSA-9rgv-h7x4-qw8g
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2018-12536
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-209
Published: 2018-10-19T16:15:56Z

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
Vulnerability: GHSA-vpgw-ffh3-648h
Summary: Prototype Pollution in fullpage.js
Aliases: CVE-2022-1295
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2022-04-12T00:00:38Z

fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.

Javascript is "prototype" language which means when a new "object" is created, it carries the predefined properties and methods of an "object" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that "object" type. If the victim developer has used that property anywhere in the code, then it will have severe effect on the application.