TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-744r-vv2g-2x6g
Summary: Apache NiFi information disclosure by XXE
Aliases: CVE-2019-10080
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-611
Published: 2019-12-02T18:17:36Z

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.
Vulnerability: GHSA-hj3m-v758-jwx5
Summary: Path Traversal in http-server-node
Aliases: CVE-2021-23797
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-01-05T15:02:43Z

All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.
Vulnerability: GHSA-m5h6-hr3q-22h5
Summary: npm Token Leak in npm
Aliases: CVE-2016-3956
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2018-07-31T22:58:35Z

Affected versions of the `npm` package include the bearer token of the logged in user in every request made by the CLI, even if the request is not directed towards the user's active registry. 

An attacker could create an HTTP server to collect tokens, and by various means including but not limited to install scripts, cause the npm CLI to make a request to that server, which would compromise the user's token.

This compromised token could be used to do anything that the user could do, including publishing new packages.




## Recommendation

1. Update npm with `npm install npm@latest -g`
2. [Revoke your Tokens](https://www.npmjs.com/settings/tokens)
3. Enable [Two-Factor Authentication](https://docs.npmjs.com/getting-started/using-two-factor-authentication)
Vulnerability: GHSA-r9vm-rhmf-7hxx
Summary: OS Command Injection in im-resize
Aliases: CVE-2019-10787
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:17:06Z

im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
Vulnerability: GHSA-5g6j-8hv4-vfgj
Summary: Cross-Site Scripting in node-red
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:21:19Z

Versions of `node-red` prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 0.18.6 or later.
Vulnerability: GHSA-4c4g-crqm-xrxw
Summary: Use of unitialized value in TFLite
Aliases: CVE-2021-37682
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-908
Published: 2021-08-25T14:40:32Z

### Impact
All TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/depthwise_conv.cc#L198-L200):

```cc
    const auto* affine_quantization =
        reinterpret_cast<TfLiteAffineQuantization*>(
            filter->quantization.params);
```

The issue stems from the fact that `quantization.params` is only valid if `quantization.type` is different that `kTfLiteNoQuantization`. However, these checks are missing in large parts of the code.

### Patches
We have patched the issue in GitHub commits [537bc7c723439b9194a358f64d871dd326c18887](https://github.com/tensorflow/tensorflow/commit/537bc7c723439b9194a358f64d871dd326c18887),
[4a91f2069f7145aab6ba2d8cfe41be8a110c18a5](https://github.com/tensorflow/tensorflow/commit/4a91f2069f7145aab6ba2d8cfe41be8a110c18a5) and [8933b8a21280696ab119b63263babdb54c298538](https://github.com/tensorflow/tensorflow/commit/8933b8a21280696ab119b63263babdb54c298538).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-mrwr-2945-fr22
Summary: Cross-site scripting in PageKit
Aliases: CVE-2021-32245
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-22T15:17:28Z

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.
Vulnerability: GHSA-mjcr-rqjg-rhg3
Summary: Implementation trusts the "me" field returned by the authorization server without verifying it
Severity: CRITICAL
CVSS score: 0
CWE: CWE-290
Published: 2020-11-24T21:21:04Z

### Impact

A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final `"me"` URL value returned by the authorization server belongs to the same domain as the initial value entered by the user.

### Patches

Version 1.1 fixes this issue.

### Workarounds

There is no workaround. Upgrade to 1.1 immediately.

### References

- [Security Considerations: Differing User Profile URLs](https://indieauth.spec.indieweb.org/#differing-user-profile-urls-li-1) in the IndieAuth specification.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [simonw/datasette-indieauth](https://github.com/simonw/datasette-indieauth/issues)
Vulnerability: GHSA-g795-4hxx-qqwm
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0893
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

Pimcore prior to 10.4.0 is vulnerable to stored cross-site scripting.
Vulnerability: GHSA-28ph-f7gx-fqj8
Summary: Data races in rusqlite
Aliases: CVE-2020-35867
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-362
Published: 2021-08-25T20:47:57Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via create_module.
Vulnerability: GHSA-c9jj-3wvg-q65h
Summary: Vulnerability that affects org.apache.pdfbox:pdfbox
Aliases: CVE-2019-0228
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2019-07-05T21:12:54Z

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
Vulnerability: GHSA-7gfg-6934-mqq2
Summary: Improper Authenication in Pion DTLS
Aliases: CVE-2019-20786
Severity: CRITICAL
CVSS score: 5.6
CWE: CWE-287
Published: 2021-06-29T21:34:57Z

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
Vulnerability: GHSA-wjpj-gmc3-5w56
Summary: Malicious Package in buvfer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:30:31Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-4jwx-78vx-gm6g
Summary: Cross-Site Request Forgery in kimai2
Aliases: CVE-2021-4033
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2021-12-10T20:34:01Z

CSRF in saving invoices / modifying status of invoices (pending and cancel only)
Vulnerability: GHSA-w65v-hx54-xrqx
Summary: Malicious Package in midway-xtpl
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:41:23Z

All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-cr5w-6rv4-r2qg
Summary: Malicious Package in maleficent
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T02:37:45Z

All versions of `maleficent` contain malicious code. The package is a demonstration of possible risks when installing npm packages. It gathers system information such as: environment variables, OS information, network interface, AWS credentials, npm credentials and ssh keys. The package prints the information to a local file but does not upload it to a remote server.



## Recommendation

Remove the package from your environment. There is no further compromise.
Vulnerability: GHSA-3x94-fv5h-5q2c
Summary: Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
Aliases: CVE-2020-15099
Severity: HIGH
CVSS score: 8.1
CWE: CWE-200, CWE-20
Published: 2020-07-29T16:15:32Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5)
> * CWE-20, CWE-200

### Problem
In case an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal _encryptionKey_ was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch _typo3conf/LocalConfiguration.php_ which again contains the _encryptionKey_ as well as credentials of the database management system being used.

In case a database server is directly accessible either via internet or in a shared hosting network, this allows to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions.

### Solution
Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007)
Vulnerability: GHSA-34jq-548x-m2x9
Summary: Improper Resource Shutdown or Release in TYPO3 extension
Aliases: CVE-2021-38623
Severity: HIGH
CVSS score: 7
CWE: CWE-404
Published: 2021-08-30T17:22:57Z

Wrong usage of the TYPO3 FAL API results in copies of processed files being saved to the /var/transient/ folder of a TYPO3 website on every frontend request. This  can result in Denial of Service, since the webspace may be filled up with image files simply by crafting a large amount of requests to the website.
Vulnerability: GHSA-wv39-cgmm-cq29
Summary: Malicious Package in buffmr-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:23:00Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-j7vx-8mqj-cqp9
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
Aliases: CVE-2020-10187
Severity: HIGH
CVSS score: 7.5
CWE: CWE-862
Published: 2020-05-07T21:11:07Z

### Impact
Information disclosure vulnerability. Allows an attacker to see all `Doorkeeper::Application` model attribute values (including secrets) using authorized applications controller if it's enabled (GET /oauth/authorized_applications.json).

### Patches

These versions have the fix:

* 5.0.3
* 5.1.1
* 5.2.5
* 5.3.2

### Workarounds
Patch `Doorkeeper::Application` model `#as_json(options = {})` method and define only those attributes you want to expose.

Additional recommended hardening is to enable application secrets hashing ([guide](https://doorkeeper.gitbook.io/guides/security/token-and-application-secrets)), available since Doorkeeper 5.1. This would render the exposed secret useless.

### References

- Commit with fix: https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
Vulnerability: GHSA-rx32-c25r-79mx
Summary: Directory Traversal in serverhuwenhui
Aliases: CVE-2017-16102
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:54:41Z

Affected versions of `serverhuwenhui` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x3m6-rprw-862w
Summary: Malicious Package in node-buc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:43:31Z

All versions of `node-buc` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-r97x-3g8f-gx3m
Summary: The Bouncy Castle JCE Provider carry a propagation bug
Aliases: CVE-2016-1000340
Severity: HIGH
CVSS score: 7.5
Published: 2018-10-17T16:23:50Z

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
Vulnerability: GHSA-rrm8-32g4-w8m3
Summary: Cross-site Request Forgery (CSRF)
Aliases: CVE-2017-1000069
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-12-20T18:04:46Z

CSRF in Bitly oauth2_proxy 2.1 during authentication flow
Vulnerability: GHSA-6pwf-whc8-hjf6
Summary: Downloads Resources over HTTP in baryton-saxophone
Aliases: CVE-2016-10573
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:35:18Z

Affected versions of `baryton-saxophone` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `baryton-saxophone`.


## Recommendation

Update to version 3.0.1 or later.
Vulnerability: GHSA-r98r-j25q-rmpr
Summary: Type confusion in failure
Aliases: CVE-2019-25010
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-843
Published: 2021-08-25T20:46:38Z

An issue was discovered in the failure crate through 2019-11-13 for Rust. Type confusion can occur when __private_get_type_id__ is overridden.
Vulnerability: GHSA-2j2x-hx4g-2gf4
Summary: In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode
Aliases: CVE-2016-1000344
Severity: HIGH
CVSS score: 7.4
CWE: CWE-1310
Published: 2018-10-18T17:43:55Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Vulnerability: GHSA-54mg-vgrp-mwx9
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack
Aliases: CVE-2019-11808
Severity: LOW
CVSS score: 3.7
CWE: CWE-338
Published: 2019-05-14T04:01:37Z

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
Vulnerability: GHSA-288c-cq4h-88gq
Summary: XML External Entity (XXE) Injection in Jackson Databind
Aliases: CVE-2020-25649
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2021-02-18T20:51:54Z

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Vulnerability: GHSA-vpw5-grxx-v396
Summary: CSRF token exposure in TYPO3 extension
Aliases: CVE-2021-36793
Severity: HIGH
CVSS score: 6.3
CWE: CWE-668
Published: 2021-09-02T17:16:56Z

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting  in the frontend output.
Vulnerability: GHSA-w3g5-2848-2v8r
Summary: Data races in generator
Aliases: CVE-2020-36471
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2021-08-25T20:57:05Z

The `Generator` type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no `Send` bounds despite the `Generator` itself implementing `Send`.

The generator function lacking a `Send` bound means that types that are
dangerous to send across threads such as `Rc` could be sent as part of a
generator, potentially leading to data races.

This flaw was fixed in commit [`f7d120a3b`](https://github.com/Xudong-Huang/generator-rs/commit/f7d120a3b724d06a7b623d0a4306acf8f78cb4f0)
by enforcing that the generator function be bound by `Send`.
Vulnerability: GHSA-gj77-59wh-66hg
Summary: Regular Expression Denial of Service (ReDoS) in Prism
Aliases: CVE-2021-32723
Severity: HIGH
CVSS score: 7.4
CWE: CWE-400
Published: 2021-06-28T18:33:18Z

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

### Impact

When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.

- ASCIIDoc
- ERB

Other languages are __not__ affected and can be used to highlight untrusted text.

### Patches
This problem has been fixed in Prism v1.24.

### References

- PrismJS/prism#2774
- PrismJS/prism#2688
Vulnerability: GHSA-8877-prq4-9xfw
Summary: Open Redirect in actionpack
Aliases: CVE-2021-22881
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-03-02T03:44:17Z

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Vulnerability: GHSA-vmh4-322v-cfpc
Summary: Cross-Site Scripting in cmmn-js-properties-panel
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T18:18:06Z

Versions of `cmmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.8.0 or later.
Vulnerability: GHSA-fmfv-x8mp-5767
Summary: Improper input validation in Drupal core
Aliases: CVE-2022-25271
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2022-02-18T00:00:37Z

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Vulnerability: GHSA-9m87-6fj3-c5xh
Summary: Untrusted Search Path in PNPM
Aliases: CVE-2022-26183
Severity: HIGH
CVSS score: 8.8
CWE: CWE-426
Published: 2022-03-23T00:00:24Z

PNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Vulnerability: GHSA-m2mx-rfpw-jghv
Summary: DLL Injection in kerberos
Severity: HIGH
CVSS score: 0
Published: 2020-09-04T18:01:59Z

Version of `kerberos` prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.


## Recommendation

Upgrade to version 1.0.0 or later.
Vulnerability: GHSA-5wm5-8q42-rhxg
Summary: File system access via H2 in Apache Ignite
Aliases: CVE-2020-1963
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-862
Published: 2020-06-05T16:11:02Z

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.
Vulnerability: GHSA-hr84-fqvp-48mm
Summary: Segfault in SparseCountSparseOutput
Aliases: CVE-2021-29521
Severity: LOW
CVSS score: 2.5
CWE: CWE-131
Published: 2021-05-21T14:21:16Z

### Impact
Specifying a negative dense shape in `tf.raw_ops.SparseCountSparseOutput` results in a segmentation fault being thrown out from the standard library as `std::vector` invariants are broken.

```python
import tensorflow as tf

indices = tf.constant([], shape=[0, 0], dtype=tf.int64)
values = tf.constant([], shape=[0, 0], dtype=tf.int64)
dense_shape = tf.constant([-100, -100, -100], shape=[3], dtype=tf.int64)
weights = tf.constant([], shape=[0, 0], dtype=tf.int64)

tf.raw_ops.SparseCountSparseOutput(indices=indices, values=values, dense_shape=dense_shape, weights=weights, minlength=79, maxlength=96, binary_output=False)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L199-L213) assumes the first element of the dense shape is always positive and uses it to initialize a `BatchedMap<T>` (i.e., [`std::vector<absl::flat_hash_map<int64,T>>`](https://github.com/tensorflow/tensorflow/blob/8f7b60ee8c0206a2c99802e3a4d1bb55d2bc0624/tensorflow/core/kernels/count_ops.cc#L27)) data structure.

```cc
  bool is_1d = shape.NumElements() == 1;
  int num_batches = is_1d ? 1 : shape.flat<int64>()(0);
  ...
  auto per_batch_counts = BatchedMap<W>(num_batches); 
```

If the `shape` tensor has more than one element, `num_batches` is the first value in `shape`.
                       
Ensuring that the `dense_shape` argument is a valid tensor shape (that is, all elements are non-negative) solves this issue.

### Patches
We have patched the issue in GitHub commit [c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5](https://github.com/tensorflow/tensorflow/commit/c57c0b9f3a4f8684f3489dd9a9ec627ad8b599f5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-3qpg-33wr-533j
Summary: Improper Restriction of XML External Entity Reference in Magnolia CMS
Aliases: CVE-2021-46365
Severity: HIGH
CVSS score: 7.8
CWE: CWE-611
Published: 2022-02-12T00:00:37Z

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted XLF file.
Vulnerability: GHSA-w736-hf9p-qqh3
Summary: Key Caching behavior in the DynamoDB Encryption Client.
Severity: LOW
CVSS score: 0
CWE: CWE-862
Published: 2021-02-08T17:43:36Z

### Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.

When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.

### Patches
Fixed as of 1.15.0.  We recommend users to modify their code and adopt `CachingMostRecentProvider`.

### Workarounds
Users who cannot upgrade to use the `CachingMostRecentProvider` can call `clear()` on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
Vulnerability: GHSA-c5xm-m64m-f2vq
Summary: Malicious Package in cxct
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-04T15:23:47Z

All versions of `cxct` contain malicious code. The package finds and exfiltrates cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-wmwp-pggc-h4mj
Summary: Cross-site Scripting in Documize
Aliases: CVE-2019-19619
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-18T15:30:30Z

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.
Vulnerability: GHSA-73hr-6785-f5p8
Summary: Malicious Package in donotinstallthis
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:24:55Z

The package `donotinstallthis` contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise.


## Recommendation

Remove the package from your environment.
Vulnerability: GHSA-jmv4-73v2-pvgc
Summary: Cross-site Scripting in OpenNMS Horizon
Aliases: CVE-2021-25929
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-05-25T18:46:58Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.
Vulnerability: GHSA-ch3h-j2vf-95pv
Summary: XSS Vulnerability in Action View tag helpers
Aliases: CVE-2022-27777
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2022-04-27T22:32:49Z

There is a possible XSS vulnerability in Action View tag helpers.  Passing
untrusted input as hash keys can lead to a possible XSS vulnerability. This
vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected:  ALL
Not affected:       NONE
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a
possibility that the untrusted data may not be properly escaped which can
lead to an XSS vulnerability.

Impacted code will look something like this:

```
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.
Vulnerability: GHSA-xqg8-cv3h-xppv
Summary: SQL Injection in sequelize
Aliases: CVE-2015-1369
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

Versions 2.0.0-rc-7 and earlier of `sequelize` are affected by a SQL injection vulnerability when user input is passed into the order parameter.



## Proof of Concept

```javascript
Test.findAndCountAll({
where: { id :1 },
order : [['id', 'UNTRUSTED USER INPUT']]
})
```


## Recommendation

Update to version 2.0.0-rc8 or later
Vulnerability: GHSA-f8x6-m9f5-ffp8
Summary: Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager
Aliases: CVE-2021-23814
Severity: MODERATE
CVSS score: 6.7
CWE: CWE-434
Published: 2022-01-06T21:08:34Z

This affects the package unisharp/laravel-filemanager from 0.0.0. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload window - Upload an image file, then capture the request - Edit the request contents with a malicious file (webshell) - Enter the path of file uploaded on URL - Remote Code Execution **Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).
Vulnerability: GHSA-9j49-mfvp-vmhm
Summary: Code Injection in pac-resolver
Aliases: CVE-2021-23406
Severity: HIGH
CVSS score: 8.1
CWE: CWE-94
Published: 2021-09-02T17:10:06Z

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Vulnerability: GHSA-3fx4-7f69-5mmg
Summary: Integer Overflow in go-jose
Aliases: CVE-2016-9123
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2021-06-23T17:14:12Z

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Vulnerability: GHSA-qr4p-c9wr-phr6
Summary: Prototype pollution in set-in
Aliases: CVE-2020-28273
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-03-19T21:01:46Z

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-fpwp-69xv-c67f
Summary: Moderate severity vulnerability that affects aiohttp-session
Aliases: CVE-2018-1000519
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-384
Published: 2018-09-13T15:46:40Z

The pypi package aiohttp-session before 2.4.0 contained a Session Fixation vulnerability in load_session function for RedisStorage  that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Vulnerability: GHSA-7mx5-x372-xh87
Summary: Incorrect Session Validation in Apache Airflow
Aliases: CVE-2020-17526
Severity: HIGH
CVSS score: 7.7
CWE: CWE-269
Published: 2021-04-20T16:40:27Z

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.
Vulnerability: GHSA-f9vc-q3hh-qhfv
Summary: Content Injection in remarkable
Aliases: CVE-2014-10065
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2020-08-31T22:56:00Z

Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used. 


### Proof of Concept

Markdown Source:
```
[link](<javascript:alert(1)>)
```

Rendered HTML:
```
<a href="javascript:alert(1)">link</a>
```


## Recommendation

Update to version 1.4.1 or later
Vulnerability: GHSA-997c-fj8j-rq5h
Summary: Arbitrary Code Execution
Aliases: CVE-2014-9357
Severity: HIGH
CVSS score: 9.8
CWE: CWE-285
Published: 2022-02-15T01:57:18Z

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
Vulnerability: GHSA-m6gx-rhvj-fh52
Summary: Denial of service in go-ethereum due to CVE-2020-28362
Severity: CRITICAL
CVSS score: 0
Published: 2021-06-29T21:13:54Z

### Impact
Versions of Geth built with Go `<1.15.5` or `<1.14.12` are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’.

We recommend all users to rebuild (ideally `v1.9.24`) with Go `1.15.5` or `1.14.12`, to avoid node crashes. Alternatively, if you are running binaries distributed via one of our official channels, we’re going to release `v1.9.24` ourselves built with Go `1.15.5`.

### Patches
This is not an issue in go-ethereum, rebuilding an older version with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. 

### Workarounds
Rebuilding with Go `1.15.5` or `1.14.12` will suffice to address the vulnerability. 

### References
- https://blog.ethereum.org/2020/11/12/geth_security_release/
- https://groups.google.com/g/golang-announce/c/NpBGTTmKzpM

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-2grh-hm3w-w7hv
Summary: Race condition in tokio
Aliases: CVE-2021-38191
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362, CWE-366
Published: 2021-08-25T20:55:51Z

An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.
Vulnerability: GHSA-gx2c-fvhc-ph4j
Summary: Path traversal in Hadoop
Aliases: CVE-2022-26612
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2022-04-08T00:00:21Z

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3
Vulnerability: GHSA-q854-j362-cfq9
Summary: Cross-site Scripting in jsoneditor
Aliases: CVE-2020-23849
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-12T16:22:30Z

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
Vulnerability: GHSA-cr3f-r24j-3chw
Summary: Cobbler before 3.3.0 allows authorization bypass for modification of settings.
Aliases: CVE-2021-40325
Severity: MODERATE
CVSS score: 0
CWE: CWE-863
Published: 2021-10-05T17:53:29Z

Cobbler before 3.3.0 allows authorization bypass for modification of settings.
Vulnerability: GHSA-hp68-xhvj-x6j6
Summary: Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1
Aliases: CVE-2021-43843
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-01-06T18:34:18Z

We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack.

This vulnerability affects to jsx-slack v4.5.1 and earlier versions.

### Impact

If attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

```javascript
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'

console.log(
  <Section>
    <blockquote>
      {[...Array(40)].map(() => (
        <p>亜</p>
      ))}
    </blockquote>
  </Section>
)
```

v4.5.1 has released by passing the test against ASCII characters but missed the case of multibyte characters.
https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q

### Patches

jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.

### References

- https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc

### Credits

Thanks to @hieki for finding out this vulnerability.
Vulnerability: GHSA-vxhc-c4qm-647p
Summary: Improper Access Control in Dolibarr
Aliases: CVE-2021-25954
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-863, CWE-284
Published: 2021-08-11T15:18:11Z

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.
Vulnerability: GHSA-q34c-48gc-m9g8
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-2694
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:38Z

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.
Vulnerability: GHSA-jmgw-6vjg-jjwg
Summary: High severity vulnerability that affects actionpack
Aliases: CVE-2013-0156
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Vulnerability: GHSA-wmpv-c2jp-j2xg
Summary: ERC1155Supply vulnerability in OpenZeppelin Contracts
Severity: LOW
CVSS score: 0
Published: 2021-11-15T23:28:18Z

When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of tokens in circulation.

### Impact
If a system relies on accurately reported supply, an attacker may be able to mint tokens and invoke that system after receiving the token balance but before the supply is updated.

### Patches
A fix is included in version 4.3.3 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds
If accurate supply is relevant, do not mint tokens to untrusted receivers.

### Credits
The issue was identified and reported by @ChainSecurityAudits.

### For more information
Read [TotalSupply Inconsistency in ERC1155 NFT Tokens](https://medium.com/chainsecurity/totalsupply-inconsistency-in-erc1155-nft-tokens-8f8e3b29f5aa) by @ChainSecurityAudits for a more detailed breakdown.

If you have any questions or comments about this advisory, email us at security@openzeppelin.com.
Vulnerability: GHSA-mh9j-v6mq-pfch
Summary: Path manipulation in matyhtf/framework
Aliases: CVE-2021-43676
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2021-12-04T00:01:07Z

matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. The issue was fixed in version 3.0.6.
Vulnerability: GHSA-gv2h-gf8m-r68j
Summary: Exposure of server configuration in github.com/go-vela/server
Aliases: CVE-2020-26294
Severity: HIGH
CVSS score: 7.4
CWE: CWE-200, CWE-78
Published: 2022-02-15T00:19:57Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

* The ability to expose configuration set in the [Vela server](https://github.com/go-vela/server) via [pipeline template functionality](https://go-vela.github.io/docs/templates/overview/).
* It impacts all users of Vela.


Sample of template exposing server configuration [using Sprig's `env` function](http://masterminds.github.io/sprig/os.html):

```yaml
metadata:
  template: true

steps:
  - name: sample
    image: alpine:latest
    commands:
      # OAuth client ID for Vela <-> GitHub communication
      - echo {{ env "VELA_SOURCE_CLIENT" }}
      # secret used for server <-> worker communication
      - echo {{ env "VELA_SECRET" }}
```

### Patches
_Has the problem been patched? What versions should users upgrade to?_

* Upgrade to `0.6.1`

#### Additional Recommended Action(s)

* Rotate all secrets

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

* No

### For more information

If you have any questions or comments about this advisory:

* Email us at [vela@target.com](mailto:vela@target.com)
Vulnerability: GHSA-3qpm-h9ch-px3c
Summary: Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library
Severity: CRITICAL
CVSS score: 10
CWE: CWE-20, CWE-502, CWE-400
Published: 2022-01-06T18:31:23Z

### Summary
The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser.
It's well detailed at [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) and  CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).

### Impact
Malicious client code could be used to send messages and cause remote code execution on the server.

### Patches
PowerNukkit `1.5.2.1` is a patch-release that only updates the Log4j version to `2.17.0` and should be used instead of `1.5.2.0`.
All versions prior to `1.5.2.1` are affected and are not patched.

### Workarounds
If you can't upgrade, you can use the `-Dlog4j2.formatMsgNoLookups=true` startup argument as remediation, as this prevents the vulnerability from happening.

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/advisories/GHSA-p6xc-xr62-6r2g

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PowerNukkit repository](https://github.com/PowerNukkit/PowerNukkit/issues)
Vulnerability: GHSA-855m-jchh-9qjc
Summary: Malicious Package in commnader
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:19:22Z

All versions of `commnader` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-7g8m-5qh9-9pgw
Summary: Directory Traversal in wind-mvc
Aliases: CVE-2017-16220
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:07:51Z

Affected versions of `wind-mvc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-2gxj-qrp2-53jv
Summary: Incorrect reliance on Trait memory layout in mopa
Aliases: CVE-2021-45695
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-01-06T22:11:11Z

An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, possibly leading to future occurrences of arbitrary code execution or ASLR bypass.
Vulnerability: GHSA-gvr4-7xgc-gx3w
Summary: Cross-Site Scripting in fileview
Aliases: CVE-2019-15602
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-04-01T16:36:15Z

All versions of `fileview` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-w5m8-5v9m-xhx5
Summary: Critical severity vulnerability that affects Haraka
Aliases: CVE-2016-1000282
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2019-02-12T17:26:10Z

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Vulnerability: GHSA-j96r-xvjq-r9pg
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2015-3227
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Vulnerability: GHSA-52c9-458g-whrf
Summary: Malicious Package in js-3ha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:58:17Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-j8jp-9x42-4pj5
Summary: Unrestricted Upload of File with Dangerous Type in MODX Revolution
Aliases: CVE-2022-26149
Severity: HIGH
CVSS score: 7.2
CWE: CWE-434
Published: 2022-02-27T00:00:14Z

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.