TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-325j-24f4-qv5x
Summary: Regular Expression Denial of Service in ssri
Aliases: CVE-2018-7651
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2018-03-07T22:22:20Z

Version of `ssri` prior to 5.2.2 are vulnerable to regular expression denial of service (ReDoS) when using strict mode.


## Recommendation

Update to version 5.2.2 or later.
Vulnerability: GHSA-mvrg-5c4w-7qv4
Summary: Cross-site Scripting in yii2cmf
Aliases: CVE-2018-10704
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-22T15:25:22Z

yidashi yii2cmf 2.0 has XSS via the /search q parameter.
Vulnerability: GHSA-fpqv-x9hm-35j9
Summary: Potential XSS vulnerability in Kitodo.Presentation
Aliases: CVE-2020-16095
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-07-31T17:39:22Z

### Impact
Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting (XSS). Only sites using the `ListView`, `Navigation` or `PageView` plugins are affected.

It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site Scripting, although there is currently no known way to exploit this in Kitodo.Presentation.

### Patches
An updated version of Kitodo.Presentation is available on [GitHub](https://github.com/kitodo/kitodo-presentation/releases/tag/v3.1.2), [Packagist](https://packagist.org/packages/kitodo/presentation#v3.1.2) and in the [TYPO3 Extension Repository](https://extensions.typo3.org/extension/dlf/). Users are advised to update as soon as possible.

The issue was also fixed in release 2.3.1 of the 2.x branch, although it is generally not recommended to run this branch since it depends on an outdated TYPO3 version.

### References
TYPO3 Security Advisory [TYPO3-EXT-SA-2020-015](https://typo3.org/security/advisory/typo3-ext-sa-2020-015)
jQuery Security Advisory [GHSA-gxr4-xjj5-5px2](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2)
Open Bug Bounty Report [OBB-1219978](https://www.openbugbounty.org/reports/1219978/)

### Contact
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/kitodo/kitodo-presentation/issues/new/choose)
* Email us at [security@kitodo.org](mailto:security@kitodo.org)
Vulnerability: GHSA-f93j-hmcr-jcwh
Summary: Data Injection Vulnerability in moped Rubygem
Aliases: CVE-2015-4410
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2020-08-19T16:45:49Z

The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.
Vulnerability: GHSA-jwf9-w5xm-f437
Summary: Heap OOB in TFLite's `Gather*` implementations
Aliases: CVE-2021-37687
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2021-08-25T14:40:02Z

### Impact
TFLite's [`GatherNd` implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/gather_nd.cc#L124) does not support negative indices but there are no checks for this situation.

Hence, an attacker can read arbitrary data from the heap by carefully crafting a model with negative values in `indices`.

Similar issue exists in [`Gather` implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/gather.cc).

```python
import tensorflow as tf
import numpy as np
tf.compat.v1.disable_v2_behavior()

params = tf.compat.v1.placeholder(name="params", dtype=tf.int64, shape=(1,))
indices = tf.compat.v1.placeholder(name="indices", dtype=tf.int64, shape=())

out = tf.gather(params, indices, name='out')

with tf.compat.v1.Session() as sess:
   converter = tf.compat.v1.lite.TFLiteConverter.from_session(sess, [params, indices], [out])
   tflite_model = converter.convert()

interpreter = tf.lite.Interpreter(model_content=tflite_model)
interpreter.allocate_tensors()

input_details = interpreter.get_input_details()
output_details = interpreter.get_output_details()

params_data = np.reshape(np.array([1], dtype=np.int64), newshape=(1,))
indices_data = np.reshape(np.array(-10, dtype=np.int64), newshape=())
interpreter.set_tensor(input_details[0]['index'], params_data)
interpreter.set_tensor(input_details[1]['index'], indices_data)

interpreter.invoke()
```

### Patches
We have patched the issue in GitHub commits [bb6a0383ed553c286f87ca88c207f6774d5c4a8f](https://github.com/tensorflow/tensorflow/commit/bb6a0383ed553c286f87ca88c207f6774d5c4a8f) and [eb921122119a6b6e470ee98b89e65d721663179d](https://github.com/tensorflow/tensorflow/commit/eb921122119a6b6e470ee98b89e65d721663179d).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security  guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-9rpc-5v9q-5r7f
Summary: Incomplete validation in `SparseReshape`
Aliases: CVE-2021-29611
Severity: LOW
CVSS score: 3.6
CWE: CWE-665, CWE-20
Published: 2021-05-21T14:28:35Z

### Impact
Incomplete validation in `SparseReshape` results in a denial of service based on a `CHECK`-failure.

```python
import tensorflow as tf

input_indices = tf.constant(41, shape=[1, 1], dtype=tf.int64)
input_shape = tf.zeros([11], dtype=tf.int64)
new_shape = tf.zeros([1], dtype=tf.int64)

tf.raw_ops.SparseReshape(input_indices=input_indices,
    input_shape=input_shape,
    new_shape=new_shape)
``` 
    
The [implementation](https://github.com/tensorflow/tensorflow/blob/e87b51ce05c3eb172065a6ea5f48415854223285/tensorflow/core/kernels/sparse_reshape_op.cc#L40) has no validation that the input arguments specify a valid sparse tensor.

### Patches 
We have patched the issue in GitHub commit [1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6](https://github.com/tensorflow/tensorflow/commit/1d04d7d93f4ed3854abf75d6b712d72c3f70d6b6).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are the only affected versions.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-2x6r-7427-95cm
Summary: Deserialization of Untrusted Data in Apache Camel RabbitMQ
Aliases: CVE-2020-11972
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2021-05-21T19:20:47Z

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Vulnerability: GHSA-f32v-vf79-p29q
Summary: Improper authorization in Keycloak
Aliases: CVE-2022-1466
Severity: HIGH
CVSS score: 0
CWE: CWE-863
Published: 2022-04-27T00:00:19Z

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
Vulnerability: GHSA-pqjj-6f5q-gqph
Summary: Denial of Service in OpenCV
Aliases: CVE-2017-12602
Severity: HIGH
CVSS score: 7.5
Published: 2021-10-12T22:01:34Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case.
Vulnerability: GHSA-qcxh-w3j9-58qr
Summary: Denial of Service in Tomcat
Aliases: CVE-2019-0199
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-06-15T18:51:09Z

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Vulnerability: GHSA-gwmc-6795-qghj
Summary: HashiCorp Nomad Artifact Download Race Condition
Aliases: CVE-2022-24686
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2022-02-15T00:02:46Z

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This issue is fixed in 1.0.18, 1.1.12, and 1.2.6.
Vulnerability: GHSA-7frr-c83r-fm22
Summary: Malicious Package in buffez-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:20:49Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-g8wf-rcg3-qw4q
Summary: Directory Traversal in tinyserver2
Aliases: CVE-2017-16085
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T15:01:34Z

Affected versions of `tinyserver2` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to v0.6.0 or later.
Vulnerability: GHSA-v659-54cx-g4qr
Summary: Prototype Pollution in deep-override
Aliases: CVE-2021-25941
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-17T20:57:25Z

Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-q5mq-6fjg-4mw8
Summary: SQL Injection in thinkjs
Aliases: CVE-2020-21176
Severity: HIGH
CVSS score: 9.8
CWE: CWE-89
Published: 2021-11-19T20:42:32Z

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
Vulnerability: GHSA-9xh4-23q4-v6wr
Summary: Heap buffer overflow and undefined behavior in `FusedBatchNorm`
Aliases: CVE-2021-29583
Severity: LOW
CVSS score: 2.5
CWE: CWE-476, CWE-787, CWE-125
Published: 2021-05-21T14:26:35Z

### Impact
The implementation of `tf.raw_ops.FusedBatchNorm` is vulnerable to a heap buffer overflow:
      
```python
import tensorflow as tf

x = tf.zeros([10, 10, 10, 6], dtype=tf.float32)
scale = tf.constant([0.0], shape=[1], dtype=tf.float32)
offset = tf.constant([0.0], shape=[1], dtype=tf.float32)
mean = tf.constant([0.0], shape=[1], dtype=tf.float32)
variance = tf.constant([0.0], shape=[1], dtype=tf.float32)
epsilon = 0.0
exponential_avg_factor = 0.0
data_format = "NHWC"
is_training = False
    
tf.raw_ops.FusedBatchNorm(
  x=x, scale=scale, offset=offset, mean=mean, variance=variance,
  epsilon=epsilon, exponential_avg_factor=exponential_avg_factor,
  data_format=data_format, is_training=is_training)
```
  
If the tensors are empty, the same implementation can trigger undefined behavior by dereferencing null pointers:

```python 
import tensorflow as tf
import numpy as np

x = tf.zeros([10, 10, 10, 1], dtype=tf.float32)
scale = tf.constant([], shape=[0], dtype=tf.float32)
offset = tf.constant([], shape=[0], dtype=tf.float32)
mean = tf.constant([], shape=[0], dtype=tf.float32)
variance = tf.constant([], shape=[0], dtype=tf.float32)
epsilon = 0.0
exponential_avg_factor = 0.0
data_format = "NHWC"
is_training = False

tf.raw_ops.FusedBatchNorm(
  x=x, scale=scale, offset=offset, mean=mean, variance=variance, 
  epsilon=epsilon, exponential_avg_factor=exponential_avg_factor,
  data_format=data_format, is_training=is_training)
``` 

The  [implementation](https://github.com/tensorflow/tensorflow/blob/57d86e0db5d1365f19adcce848dfc1bf89fdd4c7/tensorflow/core/kernels/fused_batch_norm_op.cc) fails to validate that `scale`, `offset`, `mean` and `variance` (the last two only when required) all have the same number of elements as the number of channels of `x`. This results in heap out of bounds reads when the buffers backing these tensors are indexed past their boundary.

If the tensors are empty, the validation mentioned in the above paragraph would also trigger and prevent the undefined behavior.

### Patches
We have patched the issue in GitHub commit [6972f9dfe325636b3db4e0bc517ee22a159365c0](https://github.com/tensorflow/tensorflow/commit/6972f9dfe325636b3db4e0bc517ee22a159365c0).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-v528-7hrm-frqp
Summary: Improper Check for Unusual or Exceptional Conditions in json-smart
Aliases: CVE-2021-27568
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-754
Published: 2021-06-16T18:03:47Z

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Vulnerability: GHSA-g5v4-5x39-vwhx
Summary: Zip slip directory exploit in github.com/deislabs/oras
Aliases: CVE-2021-21272
Severity: HIGH
CVSS score: 6.5
CWE: CWE-29, CWE-22
Published: 2022-02-15T00:32:04Z

### Impact
The directory support (#55) allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links.

A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. 

Precisely, the following users of the affected versions are impacted
- `oras` CLI users who runs `oras pull`.
- Go programs, which invokes `github.com/deislabs/oras/pkg/content.FileStore`.

### Patches
The problem has been patched by the PR linked with this advisory. Users should upgrade their `oras` CLI and packages to `0.9.0`.

### Workarounds
For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider.

For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.

### References
- [Zip Slip](https://github.com/snyk/zip-slip-vulnerability)

### For more information
If you have any questions or comments about this advisory:
* Open an issue on the [GitHub repo](https://github.com/deislabs/oras)
* Email the [list of maintainers](https://github.com/deislabs/oras/blob/main/MAINTAINERS)
Vulnerability: GHSA-7fqj-cg79-f2pv
Summary: High severity vulnerability that affects thumbshooter
Aliases: CVE-2013-1898
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-rxfq-3vpc-vv72
Summary: Files or Directories Accessible to External Parties in Adminer
Aliases: CVE-2021-43008
Severity: HIGH
CVSS score: 7.5
CWE: CWE-552
Published: 2022-04-06T00:01:33Z

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
Vulnerability: GHSA-46c5-pfj8-fv65
Summary: Improperly checked metadata on tools/armour itemstacks received from the client
Severity: HIGH
CVSS score: 7.5
CWE: CWE-704
Published: 2022-03-18T22:36:03Z

### Impact
Due to a workaround applied in 1.13, an attacker may send a negative damage/meta value in a tool or armour item's NBT, which `TypeConverter` then blindly uses as if it was valid without being checked.

When this invalid metadata value reaches `Durable->setDamage()`, an exception is thrown because the metadata is not within the expected range for damage values.

This can be reproduced with either a too-large damage value, or a negative one.

### Patches
c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1

### Workarounds
In theory this can be checked by plugins using a custom `TypeConverter`, but this is likely to be very cumbersome.

### For more information
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-p2xq-vcm7-xjj6
Summary: Low severity vulnerability that affects org.apache.mesos:mesos
Aliases: CVE-2018-11793
Severity: HIGH
CVSS score: 7.5
CWE: CWE-119
Published: 2019-03-06T17:36:22Z

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Vulnerability: GHSA-8h55-49jm-739x
Summary: Directory Traversal in easyquick
Aliases: CVE-2017-16109
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2018-08-29T23:21:46Z

Affected versions of `easyquick` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-gpg2-7r7j-4pm9
Summary: Malicious Package in buffer-xob
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:09:56Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-f2rp-j8hv-g5gx
Summary: Cross-site scripting in imgURL
Aliases: CVE-2021-38713
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-08-30T16:25:26Z

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
Vulnerability: GHSA-7fcj-pq9j-wh2r
Summary: Local Privilege Escalation in PyInstaller
Aliases: CVE-2019-16784
Severity: HIGH
CVSS score: 7
CWE: CWE-250
Published: 2020-01-16T22:18:27Z

### Impact

Local Privilege Escalation in all Windows software frozen by PyInstaller in "onefile" mode.

The vulnerability is present only on Windows and in this particular case: If a **software frozen by PyInstaller in "onefile" mode** is launched by a (privileged) user who has **his/her "TempPath" resolving to a world writable directory**. This is the case e.g. if the software is launched as a service or as a scheduled task using a system account (in which case TempPath will default to C:\Windows\Temp).

In order to be exploitable the software has to be (re)started after the attacker has launched the exploit program. So for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade).

While PyInstaller itself was not vulnerable, all Windows software frozen by PyInstaller in "onefile" mode is vulnerable.

CVSSv3 score 7.0 (High)
CVSSv3 vector CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected
- all Windows software frozen by PyInstaller in "onefile" mode

No affected
- PyInstaller itself (except if frozen by PyInstaller in "onefile" mode on Windows)
- software frozen in "one*dir*" mode
- other platforms (GNU/Linux, OS X, BSD, etc.)

### Patches
The problem is patched in commits 42a67148b3bdf9211fda8499fdc5b63acdd7e6cc (fixed code) and be948cf0954707671aa499da17b10c86b6fa5e5c (recompiled bootloaders). Users should upgrade to PyInstaller version 3.6 and rebuild their software.

### Workarounds
There is no known workaround. Users using PyInstaller to freeze their Windows software using "onefile" mode should upgrade PyInstaller and rebuild their software.

### Credits
This vulnerability was discovered and reported by Farid AYOUJIL (@faridtsl), David HA, Florent LE NIGER and Yann GASCUEL (@lnv42) from Alter Solutions (@AlterSolutions) and fixed in collaboration with
Hartmut Goebel (@htgoebel, maintainer of PyInstaller).

### Funding Development

PyInstaller is in urgent need of funding to make future security fixes happen, see <https://github.com/pyinstaller/pyinstaller/issues/4404> for details.
Vulnerability: GHSA-49r2-73m6-pp8f
Summary: Directory traversal in development mode handler in Vaadin 14 and 15-17
Aliases: CVE-2020-36321
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-20, CWE-22
Published: 2021-04-19T14:51:58Z

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

- https://vaadin.com/security/cve-2020-36321
Vulnerability: GHSA-h3cw-g4mq-c5x2
Summary: Code Injection in jackson-databind
Aliases: CVE-2020-24616
Severity: HIGH
CVSS score: 8.1
CWE: CWE-94, CWE-502
Published: 2021-12-09T19:14:51Z

This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
Vulnerability: GHSA-86qr-9vqc-pgc6
Summary: Code execution in Spring Integration
Aliases: CVE-2020-5413
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-08-05T14:53:06Z

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
Vulnerability: GHSA-hf5h-hh56-3vrg
Summary: Denial of Service in uws
Aliases: CVE-2016-10544
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2020-09-01T16:02:29Z

Affected versions of `uws` do not properly handle large websocket messages when `permessage-deflate` is enabled, which may result in a denial of service condition.

If `uws` recieves a 256Mb websocket message when `permessage-deflate` is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process.


## Recommendation

Update to version 0.10.9 or later.

Alternatively, disable `permessage-deflate`.
Vulnerability: GHSA-r9c2-cr39-c8g6
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2015-7579
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
Vulnerability: GHSA-fr58-2xhv-qp3w
Summary: Denial of Service in OpenCV
Aliases: CVE-2017-12600
Severity: HIGH
CVSS score: 7.5
Published: 2021-10-12T22:01:16Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case.
Vulnerability: GHSA-433w-mm6h-rv9p
Summary: Auth bypass in SAML provider
Severity: CRITICAL
CVSS score: 0
Published: 2021-06-23T17:29:06Z

### Impact

The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:

- [`goxmldsig` - Signature Validation Bypass](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7)
- [`gosaml2` - Authentication Bypass](https://github.com/russellhaering/gosaml2/security/advisories/GHSA-xhqq-x44f-9fgg)

### Patches

[Patch available](https://github.com/netlify/gotrue/pull/274)

Please upgrade to v1.0.0 or commit hash `a2b4dd6bc4ef7562d1df044098b303f564eefa90`

### Workarounds

No known workarounds.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [gotrue](https://github.com/netlify/gotrue/issues)
* Email us at [security@netlify.com](mailto:security@netlify.com)
Vulnerability: GHSA-p8pq-r894-fm8f
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39146
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502
Published: 2021-08-25T14:47:57Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39146](https://x-stream.github.io/CVE-2021-39146.html).

### Credits
Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-c9f4-xj24-8jqx
Summary: Regular Expression Denial of Service in uglify-js
Aliases: CVE-2015-8858
Severity: HIGH
CVSS score: 7.5
Published: 2017-10-24T18:33:36Z

Versions of `uglify-js` prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the `parse()` method.


### Proof of Concept

```
var u = require('uglify-js');
var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}

u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
```

### Results
```
$ time node test.js 10000
real	0m1.091s
user	0m1.047s
sys	0m0.039s

$ time node test.js 80000
real	0m6.486s
user	0m6.229s
sys	0m0.094s
```


## Recommendation

Update to version 2.6.0 or later.
Vulnerability: GHSA-mmhj-4w6j-76h7
Summary: Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate
Aliases: CVE-2021-21413
Severity: HIGH
CVSS score: 8
CWE: CWE-913
Published: 2021-04-06T17:22:55Z

Versions of `isolated-vm` before v4.0.0, and especially before v3.0.0, have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate.

`Reference` objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a `Reference` instance to an attacker they would be able to use it to acquire a `Reference` to the nodejs context's `Function` object.

Similar application-specific attacks could be possible by modifying the local prototype of other API objects.

Access to `NativeModule` objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution.

To address these issues the following changes were made in v4.0.0:
- Documentation was updated with more explicit guidelines on building secure applications.
- `Reference` instances will no longer follow prototype chains by default, nor will they invoke accessors or proxies.
- All `isolated-vm` API prototypes are now immutable.
- `NativeModule` constructor may only be invoked from a nodejs isolate.
Vulnerability: GHSA-vhxc-8jjq-859j
Summary: Moderate severity vulnerability that affects org.apache.ranger:ranger
Aliases: CVE-2016-6815
Severity: MODERATE
CVSS score: 6.5
Published: 2018-10-17T17:21:44Z

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.
Vulnerability: GHSA-3p32-j457-pg5x
Summary: Query Binding Exploitation
Aliases: CVE-2021-21263
Severity: HIGH
CVSS score: 7.2
CWE: CWE-74
Published: 2021-01-19T19:36:51Z

### Description

Laravel versions <6.20.12, <7.30.3 & <8.22.1 contain a query binding exploitation.

If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

This vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com).

### References

- https://github.com/laravel/framework/pull/35865
Vulnerability: GHSA-2hfj-cxw7-g45p
Summary: Unsafe inline XSS in pasting DOM element into chat
Aliases: CVE-2021-39183
Severity: HIGH
CVSS score: 8.2
CWE: CWE-79
Published: 2021-12-14T21:48:16Z

### Impact

Inline scripts are executed when Javascript is parsed via a paste action.

1. Open https://watch.owncast.online/
2. Copy and then paste `<img src=null onerror=alert('hello')>` into the
chat field.
3. An alert should pop up.

### Patches
```
    ⋮ 13 │    // Content security policy
    ⋮ 14 │    csp := []string{
    ⋮ 15 │        "script-src 'self' 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY='",
    ⋮ 16 │        "worker-src 'self' blob:", // No single quotes around blob:
    ⋮ 17 │    }
```

Will be patched in 0.0.9 by blocking `unsafe-inline` Content Security Policy and specifying the `script-src`.  The `worker-src` is required to be set to `blob` for the video player.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [owncast/owncast](https://github.com/owncast/owncast/issues)
* Email us at [gabek@real-ity.com](mailto:gabek@real-ity.com)
Vulnerability: GHSA-p92x-r36w-9395
Summary: Type confusion in mpath
Aliases: CVE-2021-23438
Severity: CRITICAL
CVSS score: 5.6
CWE: CWE-843
Published: 2021-09-02T22:02:25Z

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Vulnerability: GHSA-gqfv-g9f6-3v3m
Summary: Directory Traversal in serveryaozeyan
Aliases: CVE-2017-16096
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:50:23Z

Affected versions of `serveryaozeyan` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-q863-cchm-c6c6
Summary: SQL Injection in Fork CMS
Aliases: CVE-2022-0153
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2022-03-25T00:00:33Z

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module `FormBuilder`), the parameter `id[]` is vulnerable to SQL injection.
Vulnerability: GHSA-xrr6-6ww3-f3qm
Summary: Sandbox Breakout / Arbitrary Code Execution in value-censorship
Severity: MODERATE
CVSS score: 0
Published: 2020-09-02T21:25:58Z

All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7q44-gfvq-6g93
Summary: SQL Injection in Subrion CMS 
Aliases: CVE-2020-18155
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-09-08T17:27:45Z

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
Vulnerability: GHSA-c6h4-gc3f-hgjq
Summary: Prototype Pollution in js-data
Aliases: CVE-2021-23574
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-01-06T21:58:56Z

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
Vulnerability: GHSA-jg4m-q6w8-vrjp
Summary: High severity vulnerability that affects rgpg
Aliases: CVE-2013-4203
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Vulnerability: GHSA-2wj9-434x-9hvp
Summary: Insecure Deserialization in Backend User Settings in TYPO3 CMS
Aliases: CVE-2020-11067
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2020-05-13T23:29:04Z

It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-005
Vulnerability: GHSA-f64g-whxf-w8f2
Summary: Malicious Package in buffar-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:44:06Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-qpgw-2c72-4c89
Summary: Mautic users able to download any files from server using filemanager
Aliases: CVE-2017-1000490
Severity: HIGH
CVSS score: 6.5
CWE: CWE-22
Published: 2021-01-19T20:50:38Z

### Impact
Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

### Patches
Update to 2.12.0 or later.

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-c2v2-7rcg-2ch7
Summary: Regular Expression Denial of Service in ansi2html
Aliases: CVE-2015-9239
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2020-09-01T15:17:48Z

The `ansi2html` package is affected by a regular expression denial of service vulnerability when certain types of user input is passed in.


## Proof of concept
```
var ansi2html = require('ansi2html')

var start = process.hrtime();
ansi2html("[1111111111111111111111;0000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;00000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;000000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;0000000000000000000000000000");
console.log(process.hrtime(start));
```

Results of the above
```
00:29:53-adam_baldwin~/tmp$ node test
[ 0, 119615367 ]
[ 0, 149934565 ]
[ 0, 233325677 ]
[ 3, 46582479 ]
```


## Recommendation

At the time of this writing, February 2018, all versions of `ansi2html` remain vulnerable, and the package has not been updated for 4 years. 

In order to use this package safely, it is necessary to avoid passing user input to the package, or to limit the size of the input string to a size with a parse time you find acceptable. Unfortunately, the match time grows at quite a small character count, so it is unlikely for it to both allow strings of a useful size while protecting against the denial of service attack. 

In the case that user input of significant length must be parsed by ansi2html, the best mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.][available on npm](https://www.npmjs.com/search?q=ansi+html)
Vulnerability: GHSA-r43h-gmrm-h5c9
Summary: Access of Uninitialized Pointer in linked-hash-map
Aliases: CVE-2020-25573
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-824
Published: 2021-08-25T20:45:09Z

An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint.
Vulnerability: GHSA-8v3j-jfg3-v3fv
Summary: Prototype Pollution in Sails.js
Aliases: CVE-2021-44908
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

Sails.js <= 1.5.2 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). A [patch](https://github.com/balderdashy/sails/commit/7c5379a656bb305c958df1dcc2b51a9668830358) is available in the `master` branch of Sails.js's GItHub repository.
Vulnerability: GHSA-px8v-hxxx-2rgh
Summary: Potential Code Injection in Sprout Forms
Aliases: CVE-2020-11056
Severity: CRITICAL
CVSS score: 7.4
CWE: CWE-94, CWE-74
Published: 2020-05-08T21:00:02Z

### Impact

A potential Server-Side Template Injection vulnerability exists in Sprout Forms which could lead to the execution of Twig code.

### Patches

The problem is fixed in`barrelstrength/sprout-forms:v3.9.0` which upgrades to `barrelstrength/sprout-base-email:v1.2.7`

### Workarounds

Users unable to upgrade should update any Notification Emails to use the "Basic Notification (Sprout Email)" template and avoid using the "Basic Notification (Sprout Forms)" template or any custom templates that display Form Fields.

### References

- See the release notes in the [CHANGELOG](https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical)
- Credits to Paweł Hałdrzyński, Daniel Kalinowski from [ISEC.PL](https://isec.pl/) for discovery and responsible disclosure

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Sprout Forms repo](https://github.com/barrelstrength/craft-sprout-forms/issues)
* Email us at [sprout@barrelstrengthdesign.com](mailto:sprout@barrelstrengthdesign.com)
Vulnerability: GHSA-65xw-pcqw-hjrh
Summary: Cross site scripting in apache airflow
Aliases: CVE-2021-45229
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-26T00:00:45Z

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.
Vulnerability: GHSA-pgv6-jrvv-75jp
Summary: Moderate severity vulnerability that affects send
Severity: MODERATE
CVSS score: 0
Published: 2018-10-09T00:34:30Z

Withdrawn, accidental duplicate publish.

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Vulnerability: GHSA-g6ww-2x43-h963
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-10090
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-10-11T18:41:44Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-mgpf-hhgf-cxg4
Summary: In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin.
Aliases: CVE-2021-45457
Severity: MODERATE
CVSS score: 0
CWE: CWE-522
Published: 2022-01-08T00:43:16Z

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Vulnerability: GHSA-c9j3-wqph-5xx9
Summary: Command Injection in egg-scripts
Aliases: CVE-2018-3786
Severity: LOW
CVSS score: 0
CWE: CWE-77
Published: 2018-09-17T20:43:34Z

Versions of `egg-scripts` before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line.


Example:
`eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'`


## Recommendation

Update to version 2.8.1 or later.
Vulnerability: GHSA-mw6v-crh8-8533
Summary: Integer Overflow or Wraparound in Google TensorFlow
Aliases: CVE-2018-7575
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-190
Published: 2019-04-30T15:36:41Z

Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent.
Vulnerability: GHSA-g4gq-j4p2-j8fr
Summary: Remote Code Execution via Script (Python) objects under Python 3
Aliases: CVE-2021-32811
Severity: HIGH
CVSS score: 7.5
CWE: CWE-915
Published: 2021-08-05T17:00:37Z

### Impact
Background: The optional add-on package `Products.PythonScripts` adds `Script (Python)` to the list of content items a user can add to the Zope object database. Inside these scripts users can write Python code that is executed when rendered through the web. The code environment in these script objects is limited, it relies on the `RestrictedPython` package to provide a "safe" subset of Python instructions as well as the `AccessControl` package that defines security policies for execution in the context of a Zope application.

Recently the `AccessControl` package was updated to fix a remote code execution security issue. A link to the security advisory is provided in the References section below. The bug tightens the `AccessControl` security policies for Zope by blocking access to unsafe classes inside the Python `string` module.

You are only affected if the following are true:

- You use Python 3 for your Zope deployment (Zope 4 on Python 2 is not affected)
- You run Zope 4 below version 4.6.3 or Zope 5 below version 5.3
- You have installed the optional `Products.PythonScripts` add-on package

By default, you need to have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk.

### Patches
The problem has been fixed in `AccessControl` versions 4.3 and 5.2. Zope releases 4.6.3 and 5.3 now require these new `AccessControl` releases.

### Workarounds
A site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

### References
* [AccessControl security advisory GHSA-qcx9-j53g-ccgf](https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Zope issue tracker](https://github.com/zopefoundation/Zope/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-9gp4-qrff-c648
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2016-1000345
Severity: MODERATE
CVSS score: 5.9
Published: 2018-10-18T18:04:13Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
Vulnerability: GHSA-94jq-q5v2-76wj
Summary: Improper certificate management in AWS IoT Device SDK v2
Aliases: CVE-2021-40828
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-295
Published: 2021-11-24T21:02:24Z

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.
Vulnerability: GHSA-grh6-q6m2-rh72
Summary: Origin Validation Error
Aliases: CVE-2021-20199
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200, CWE-346
Published: 2021-05-18T21:07:49Z

Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podman versions from 1.8.0 to 3.0.0.