TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-qqxp-xp9v-vvx6
Summary: Moderate severity vulnerability that affects jquery-ui
Aliases: CVE-2012-6662
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Vulnerability: GHSA-jm6p-wfjg-xm7x
Summary: bookstack is vulnerable to Improper Access Control
Aliases: CVE-2021-4026
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-668, CWE-284
Published: 2021-12-01T18:26:48Z

bookstack is vulnerable to Improper Access Control.
Vulnerability: GHSA-p2j5-3f4c-224r
Summary: Improper Input Validation	in HashiCorp Consul
Aliases: CVE-2020-13170
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-05-18T18:21:21Z

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
Vulnerability: GHSA-cxfm-5m4g-x7xp
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-39150
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502, CWE-918
Published: 2021-08-25T14:47:19Z

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39150](https://x-stream.github.io/CVE-2021-39150.html).

### Credits
Lai Han of NSFOCUS security team found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-5cmw-fhq9-8fhh
Summary: Type Confusion in LiveHelperChat
Aliases: CVE-2022-1176
Severity: HIGH
CVSS score: 7.5
CWE: CWE-843
Published: 2022-04-01T00:00:40Z

Live Helper Chat provides live support for your website. Loose comparison causes IDOR on multiple endpoints in LiveHelperChat prior to 3.96. There is a fix released in versions 3.96 and 3.97. Currently, there is no known workaround.
Vulnerability: GHSA-q448-6c3m-cxmj
Summary: Cross-site Scripting in jeecg-boot
Aliases: CVE-2021-44585
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-11T00:01:59Z

jeecg-boot is a code generator. A Cross Site Scripting (XSS) vulnerabilitiy exists in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.
Vulnerability: GHSA-4hv7-3q38-97m8
Summary: Arbitrary code execution in djv
Aliases: CVE-2020-28464
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-04-13T15:24:47Z

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
Vulnerability: GHSA-j6jg-w79c-7p8v
Summary: File Upload Restriction Bypass leading to Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0951
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-434, CWE-79
Published: 2022-03-16T00:00:48Z

ShowDoc prior to 2.10.4 is vulnerable to a file upload restriction bypass leading to stored cross-site scripting.
Vulnerability: GHSA-fvcj-hvfw-7f2v
Summary: Improper Authentication
Aliases: CVE-2021-1725
Severity: HIGH
CVSS score: 0
CWE: CWE-287
Published: 2021-03-08T15:49:53Z

### Impact
A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot.

### Patches
The problem has been patched in all affected versions. Please see the list of patched versions for the most appropriate one for your individual case.

### Workarounds
Users who do not wish or are not able to upgrade can add an authentication configuration containing ClaimsValidator, which throws an exception if the Claims are Skill Claims.

For detailed instructions, see the link in the References section.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Microsoft Bot Builder SDK](https://github.com/microsoft/botbuilder-dotnet)
* Email us at [bf-reports@microsoft.com](mailto:bf-reports@microsoft.com)
Vulnerability: GHSA-3c87-r9f7-qfgq
Summary: Downloads Resources over HTTP in macaca-chromedriver-zxa
Aliases: CVE-2016-10623
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:56:56Z

Affected versions of `macaca-chromedriver-zxa` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `macaca-chromedriver-zxa`.


## Recommendation

The best mitigation is to manually set the download URL to a safe HTTPS server via the `CHROMEDRIVER_CDNURL` environment variable.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rm7c-x424-g2mw
Summary: Malicious Package in asyync
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:36:31Z

All versions of `asyync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-8xx9-rxrj-2m2w
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2021-4139
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-79
Published: 2022-01-05T20:35:12Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-94vp-rmqv-5875
Summary: Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
Aliases: CVE-2020-15247
Severity: MODERATE
CVSS score: 5.2
CWE: CWE-862
Published: 2020-11-23T19:48:27Z

### Impact
An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

### Workarounds
Apply https://github.com/octobercms/october/compare/106daa2930de4cebb18732732d47d4056f01dd5b...7cb148c1677373ac30ccfd3069d18098e403e1ca to your installation manually if unable to upgrade to Build 469.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">
Vulnerability: GHSA-p867-fxfr-ph2w
Summary: b2-sdk-python TOCTOU application key disclosure 
Aliases: CVE-2022-23651
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-367
Published: 2022-02-24T12:08:24Z

### Impact

Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition.

SDK users of the `SqliteAccountInfo` format are vulnerable while users of the `InMemoryAccountInfo` format are safe. The `SqliteAccountInfo` saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b2/account_info`, `~/.b2_account_info` or a user-defined path). When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory containing the file is readable by a local attacker then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it.

Consumers of this SDK who rely on it to save data using `SqliteAccountInfo` class should upgrade to the latest version of the SDK. Those who believe a local user might have opened a handle using this race condition, should remove the affected database files and regenerate all application keys.

### Patches
Users should upgrade to b2-sdk-python 1.14.1 or later.

### For more information
See the related advisory in the [B2 Command Line Tool](https://github.com/Backblaze/B2_Command_Line_Tool), a consumer of this SDK.

If you have any questions or comments about this advisory:
* Open an issue in [b2-sdk-python](https://github.com/Backblaze/b2-sdk-python)
* Email us at [security@backblaze.com](mailto:security@backblaze.com)
Vulnerability: GHSA-8gf5-q9p9-wvmc
Summary: Data race in atomic-option
Aliases: CVE-2020-36219
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-662
Published: 2021-08-25T20:51:42Z

An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption<T> implements Sync unconditionally, a data race can occur.
Vulnerability: GHSA-xm34-v85h-9pg2
Summary: Authentication Bypass by CSRF Weakness
Aliases: CVE-2021-41274
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-352
Published: 2021-11-18T20:09:32Z

### Impact
CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of  `solidus_auth_devise` are affected if `protect_from_forgery` method is both: 
- Executed whether as:
  - A `before_action` callback (the default)
  - A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find).
- Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

### Patches
Users should promptly update to `solidus_auth_devise` version `2.5.4`.

### Workarounds
A couple of options:

- If possible, change your strategy to `:exception`:
  ```ruby
  class ApplicationController < ActionController::Base
    protect_from_forgery with: :exception
  end
  ```

- Add the following to `config/application.rb` to at least run the `:exception` strategy on the affected controller:
  ```ruby
  config.after_initialize do
    Spree::UsersController.protect_from_forgery with: :exception
  end
  ```

- We've also released new Solidus versions monkey patching `solidus_auth_devise` with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` & `v2.11.12`. See [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g) for details.

### References
- [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)
- [Solidus security](https://solidus.io/security/)

### Thanks
We'd like to thank [vampire000](https://hackerone.com/vampire000) for reporting this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
Vulnerability: GHSA-j4vm-hg8g-g9qv
Summary: Malicious Package in antd-cloud
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:33:50Z

All versions of `antd-cloud` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fc7x-2cmc-8j2g
Summary: Incorrect hash in sha2
Aliases: CVE-2021-45696
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-01-06T22:10:26Z

An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used.
Vulnerability: GHSA-q4rf-3fhx-88pf
Summary: YAML deserialization can run untrusted code
Aliases: CVE-2021-39132
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-502
Published: 2021-09-01T18:27:01Z

### Impact

An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition.  An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition.

The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:

* `admin` level access to the `system` resource type

The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: 

* `create` `update` or `admin` level access to a `project_acl` resource
* `create` `update` or `admin` level access to the `system_acl` resource

The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only.

### Patches
Versions 3.4.3, 3.3.14

### Workarounds

Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)

Reporter: Rojan Rijal from Tinder Red Team
Vulnerability: GHSA-8mq9-fqv8-59wf
Summary: Cross-Site Scripting in Page Preview
Aliases: CVE-2021-32667
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2021-07-22T19:34:43Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.0)

### Problem
Failing to properly encode _Page TSconfig_ settings, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-009](https://typo3.org/security/advisory/typo3-core-sa-2021-009)
Vulnerability: GHSA-m8wh-mqgf-rr8g
Summary: Code injection in Kubernetes Java Client
Aliases: CVE-2021-25738
Severity: MODERATE
CVSS score: 6.7
CWE: CWE-20
Published: 2021-10-12T17:50:25Z

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
Vulnerability: GHSA-h6m3-cx24-9626
Summary: Malicious Package in js-sla3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:11:45Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-m6cj-93v6-cvr5
Summary: Infinite loop in junrar
Aliases: CVE-2022-23596
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835, CWE-400
Published: 2022-02-01T00:47:23Z

### Impact
A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. 

### Patches
The problem is partially patched in 7.4.1

### Workarounds
None

### References

https://github.com/junrar/junrar/issues/73

https://github.com/junrar/junrar/issues/81
Vulnerability: GHSA-wxjg-p59j-6c92
Summary: Command injection in github.com/google/fscrypt
Aliases: CVE-2022-25328
Severity: MODERATE
CVSS score: 5
CWE: CWE-78
Published: 2022-02-26T00:00:44Z

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above
Vulnerability: GHSA-g452-6rfc-vrvx
Summary: Prototype Pollution in open-graph
Aliases: CVE-2021-23419
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-915
Published: 2021-09-01T18:31:53Z

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
Vulnerability: GHSA-4j6x-w426-6rc6
Summary: Default Express middleware security check is ignored in production
Severity: HIGH
CVSS score: 0
Published: 2019-11-08T17:31:17Z

## Default Express middleware security check is ignored in production

### Impact
All Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected.

### Patches
@cubejs-backend/api-gateway@0.11.17

### Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/cube-js/cube.js/issues
* Reach out us in community Slack: https://slack.cube.dev/
Vulnerability: GHSA-g376-whg7-896m
Summary: Directory Traversal in yjmyjmyjm
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:45:53Z

Affected versions of `yjmyjmyjm` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-g78f-549w-c354
Summary: Prototype Pollution in multi-ini
Aliases: CVE-2020-28448
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-04-13T15:23:59Z

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.
Vulnerability: GHSA-jwvr-vv7p-gpwq
Summary: Privilege escalation for users with create/update permissions in Global Roles in Rancher
Aliases: CVE-2021-36784
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-285, CWE-269
Published: 2022-05-02T19:39:35Z

### Impact
This vulnerability affects customers who utilize non-admin users that are able to create or edit [Global Roles](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/). The most common use case for this scenario is the [`restricted-admin`](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/global-permissions/#restricted-admin) role.

A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 which allows users who have create or update permissions on Global Roles to escalate their permissions, or those of another user, to admin-level permissions. Global Roles grant users Rancher-wide permissions, such as the ability to create clusters. In the identified versions of Rancher, when users are given permission to edit or create Global Roles, they are not restricted to only granting permissions which they already posses.

The privilege escalation can be taken advantage of in two ways by users with create or update permissions on Global Roles (including the `restricted-admin`):

1. Editing the global `admin` role to make it the default for new users, then creating a new user that will be elevated to the global `admin` role.
2. Creating a new global role with permissions already possessed by the `restricted-admin`, assigning this new role to a user, then modifying the global role to grant additional administrive like permissions (`'*'`) to the elevated user.

### Patches
Patched versions include releases 2.5.13, 2.6.4 and later versions.

### Workarounds
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.

**Note:** If you have users who have create or edit permissions on Global Roles but are not admin users (for example, the `restricted-admin`), it is highly advised to review the roles and users created by those users for possible privilege escalations.

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Vulnerability: GHSA-h29c-wcm8-883h
Summary: Incorrect Permission Assignment for Critical Resource in OnionShare
Aliases: CVE-2022-21694
Severity: LOW
CVSS score: 3.7
CWE: CWE-732
Published: 2022-01-21T23:20:17Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-006
- Vulnerability type: Broken Website Hardening Control
- Threat level: Low

## Description:

The CSP can be turned on or off but not configured for the specific needs of the website.

## Technical description:

The website mode of the application allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.

If CSP were configurable, the website creator could harden it accordingly to the needs of the application.

As this issue correlates with the Github issue for exposing the flask application directly (https://github.com/onionshare/ onionshare/issues/1389), it can be assumed that this can be solved by either changing to a well-known webserver, which supports this kind of configuration, or enhancing the status quo by making the CSP a configurable part of each website.

We believe that bundling the nginx or apache webserver would add complexity and dependencies to the application that could result in a larger attack surface - as these packages receive regular security updates. On the other hand it is not recommended to directly expose the flask webserver, due to lack of hardening. This is a trade-off which needs to be evaluated by the Onionshare developers, as multiple features are involved. Ideally the application user could choose between the built-in flask webserver or a system webserver of choice.

## Impact:

As this is a general weakness and not a direct vulnerability in the Onionshare application, the direct impact of this issue is rather low.

## Recommendation:

- Consider offering a configurable webserver choice
- Consider configurable CSP
Vulnerability: GHSA-m2r5-4w96-qxg5
Summary: Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
Aliases: CVE-2022-24898
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-611
Published: 2022-04-28T19:31:55Z

### Impact

It's possible in a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service.

For example:

```
{{velocity}}
#set($xml=$services.get('xml'))
#set($xxe_payload = "<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE root[<!ENTITY xxe SYSTEM 'file:///etc/passwd' >]><root><foo>&xxe;</foo></root>")
#set($doc=$xml.parse($xxe_payload))
$xml.serialize($doc)
{{/velocity}}
```

### Patches

The problem has been patched on versions 12.10.10, 13.4.4 and 13.8RC1.

### Workarounds

There's no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

### References

https://jira.xwiki.org/browse/XWIKI-18946

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-5xgh-643p-cp2g
Summary: Moderate severity vulnerability that affects yapi-vendor
Aliases: CVE-2018-17574
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2018-11-21T22:19:59Z

An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
Vulnerability: GHSA-4c4w-3q45-hp9j
Summary: Aescrypt does not sufficiently use random values
Aliases: CVE-2013-7463
Severity: HIGH
CVSS score: 7.5
CWE: CWE-330
Published: 2017-10-24T18:33:36Z

The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.
Vulnerability: GHSA-6c8p-qphv-668v
Summary: Moderate severity vulnerability that affects ruby-openid
Aliases: CVE-2013-1812
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:37Z

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
Vulnerability: GHSA-jp7f-grcv-6mjf
Summary: Partial path traversal in sharpcompress
Aliases: CVE-2021-39208
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-22
Published: 2021-09-20T19:53:42Z

SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent extraction outside the destination directory the destinationFileName path is verified to begin with fullDestinationDirectoryPath. However it is not enforced that fullDestinationDirectoryPath ends with slash:

```csharp
public static void WriteEntryToDirectory(IEntry entry,
                                         string destinationDirectory,
                                         ExtractionOptions? options,
                                         Action<string, ExtractionOptions?> write)
{
    string destinationFileName;
    string file = Path.GetFileName(entry.Key);
    string fullDestinationDirectoryPath = Path.GetFullPath(destinationDirectory);
...
        throw new ExtractionException("Entry is trying to write a file outside of the destination directory.");
}
```

If the destinationDirectory is not slash terminated like /home/user/dir it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. /home/user/dir.sh.

#### Impact
Because of the file name and destination directory constraints the arbitrary file creation impact is limited and depends on the use case.
Vulnerability: GHSA-v2rg-8cwr-75g8
Summary: Deserializer tampering in Apache Dubbo
Aliases: CVE-2021-25641
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-03-18T17:56:08Z

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
Vulnerability: GHSA-hhqj-cfjx-vj25
Summary: Cross site scripting in reveal.js
Aliases: CVE-2022-0776
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-02T00:00:20Z

The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute arbitrary javascript code on victim's browser window hosting reveal.js
Vulnerability: GHSA-8jq6-w5cg-wm45
Summary: Exploitable inventory component chaining in PocketMine-MP
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2020-11-11T21:38:18Z

### Impact
Specially crafted `InventoryTransactionPacket`s sent by malicious clients were able to exploit the behaviour of `InventoryTransaction->findResultItem()` and cause it to take an abnormally long time to execute (causing an apparent server freeze).

The affected code is intended to compact conflicting `InventoryActions` which are in the same `InventoryTransaction` by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening became exponential.

The problem was fixed by bailing when ambiguities are detected.

**At the time of writing, this exploit is being used in the wild by attackers to deny service to servers.**

### Patches
Upgrade to 3.15.4 or newer.

### Workarounds
No practical workarounds are possible, short of backporting the fix or implementing checks in a plugin listening to `DataPacketReceiveEvent`.

### References
c368ebb5e74632bc622534b37cd1447b97281e20

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-m2c7-42rf-c62f
Summary: Unrestricted Upload of File with Dangerous Type in motionEye
Aliases: CVE-2021-44255
Severity: HIGH
CVSS score: 7.2
CWE: CWE-434
Published: 2022-02-01T00:00:44Z

motionEye <= 0.42.1 and motioneEyeOS <= 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials.

The GitHub repositories for motionEye and motionEyeOS are no longer being actively maintained as of January 2022, so release of a patched version is unlikely. Keeping a motionEye or motionEyeOS installation off of the Internet and/or using strong credentials provide protection against this issue.
Vulnerability: GHSA-c35v-qwqg-87jc
Summary: Timing Attack in express-basic-auth
Severity: LOW
CVSS score: 3.1
CWE: CWE-208
Published: 2019-06-06T15:32:32Z

Versions of `express-basic-auth` prior to 1.2.0 are vulnerable to Timing Attacks. The package uses nating string comparison instead of a constant time string compare which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-cmfg-87vq-g5g4
Summary: Deserialization of untrusted data in FasterXML jackson-databind
Aliases: CVE-2019-12814
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-502
Published: 2019-07-17T15:26:12Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
Vulnerability: GHSA-qjwc-v72v-fq6r
Summary: HTTP request smuggling in Undertow
Aliases: CVE-2021-20220
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-444
Published: 2021-06-16T17:47:52Z

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Vulnerability: GHSA-q879-9g95-56mx
Summary: Wrong type for `Linker`-define functions when used across two `Engine`s
Aliases: CVE-2021-39219
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-843
Published: 2021-09-20T19:54:26Z

### Impact

As a Rust library the `wasmtime` crate clearly marks which functions are safe and which are `unsafe`, guaranteeing that if consumers never use `unsafe` then it should not be possible to have memory unsafety issues in their embeddings of Wasmtime. An issue was discovered in the safe API of `Linker::func_*` APIs. These APIs were previously not sound when one `Engine` was used to create the `Linker` and then a different `Engine` was used to create a `Store` and then the `Linker` was used to instantiate a module into that `Store`. Cross-`Engine` usage of functions is not supported in Wasmtime and this can result in type confusion of function pointers, resulting in being able to safely call a function with the wrong type.

Triggering this bug requires using at least two `Engine` values in an embedding and then additionally using two different values with a `Linker` (one at the creation time of the `Linker` and another when instantiating a module with the `Linker`).

It's expected that usage of more-than-one `Engine` in an embedding is relatively rare since an `Engine` is intended to be a globally shared resource, so the expectation is that the impact of this issue is relatively small.

The fix implemented is to change this behavior to `panic!()` in Rust instead of silently allowing it. Using different `Engine` instances with a `Linker` is a programmer bug that `wasmtime` catches at runtime.

### Patches

This bug has been patched and users should upgrade to Wasmtime version 0.30.0.

### Workarounds

If you cannot upgrade Wasmtime and are using more than one `Engine` in your embedding it's recommended to instead use only one `Engine` for the entire program if possible. An `Engine` is designed to be a globally shared resource that is suitable to have only one for the lifetime of an entire process. If using multiple `Engine`s is required then code should be audited to ensure that `Linker` is only used with one `Engine`.

### For more information

If you have any questions or comments about this advisory:

* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)
* Open an issue in [the `bytecodealliance/wasmtime` repository](https://github.com/bytecodealliance/wasmtime/)
Vulnerability: GHSA-9r5x-fjv3-q6h4
Summary: Incorrect Access Control in github.com/nats-io/jwt and github.com/nats-io/nats-server/v2
Aliases: CVE-2021-3127
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863, CWE-284
Published: 2022-02-15T01:57:18Z

NATS Server 2.x before 2.2.0 and JWT library before 2.0.1 have Incorrect Access Control because Import Token bindings are mishandled.
Vulnerability: GHSA-x56p-c8cg-q435
Summary: Open Redirect in Next.js versions
Aliases: CVE-2020-15242
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-601
Published: 2020-10-08T19:28:07Z

### Impact

- **Affected**: Users of Next.js between 9.5.0 and 9.5.3 
- **Not affected**: Deployments on Vercel ([https://vercel.com](https://vercel.com)) are not affected
- **Not affected**: Deployments using `next export`

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/vercel/next.js/releases/tag/v9.5.4

### References

https://github.com/vercel/next.js/releases/tag/v9.5.4
Vulnerability: GHSA-c65v-p733-9796
Summary: Cross-site Scripting in snipe/snipe-it
Aliases: CVE-2021-3961
Severity: HIGH
CVSS score: 8
CWE: CWE-79
Published: 2021-11-23T18:17:33Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-q2qw-rmrh-vv42
Summary: Moderate severity vulnerability that affects activejob
Aliases: CVE-2018-16476
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502, CWE-284
Published: 2018-12-05T17:24:27Z

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
Vulnerability: GHSA-jgpv-4h4c-xhw3
Summary: Uncontrolled Resource Consumption in pillow
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-23T16:54:36Z

### Impact
_Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large._

### Patches
_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._

### Workarounds
_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._

### References
https://nvd.nist.gov/vuln/detail/CVE-2021-27921

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Vulnerability: GHSA-qjfh-xc44-rm9x
Summary: Path Traversal in file-static-server
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T16:49:43Z

All versions of `file-static-server` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-78j3-7wpm-qhvp
Summary: Critical severity vulnerability that affects kelredd-pruview
Aliases: CVE-2013-1947
Severity: CRITICAL
CVSS score: 0
CWE: CWE-78
Published: 2017-10-24T18:33:37Z

kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
Vulnerability: GHSA-5fq8-3q2f-4m5g
Summary: Session key exposure through session list in Django User Sessions
Aliases: CVE-2020-5224
Severity: LOW
CVSS score: 6.5
CWE: CWE-287
Published: 2020-01-24T19:56:59Z

### Impact
The views provided by django-user-sessions allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

### Patches
Patch is under way.

### Workarounds
Remove the session_key from the template.

### References
_None._

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Bouke/django-user-sessions](https://github.com/Bouke/django-user-sessions/issues)
* Email us at [bouke@haarsma.eu](mailto:bouke@haarsma.eu)
Vulnerability: GHSA-6r58-4xgr-gm6m
Summary: Access escalation for CMS users with limited access through permission cache pollution
Aliases: CVE-2019-12617
Severity: MODERATE
CVSS score: 0
Published: 2019-11-12T23:01:59Z

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
Vulnerability: GHSA-6c3f-p5wp-34mh
Summary: OS Command Injection in async-git
Aliases: CVE-2021-3190
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-01-29T18:14:00Z

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted user input before passing it to one of the vulnerable functions as a workaround or update async-git to version 1.13.1.
Vulnerability: GHSA-cwg9-c9cr-p5fq
Summary: Improper Neutralization of Input in Theia console
Aliases: CVE-2021-28161
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-13T15:18:53Z

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Vulnerability: GHSA-8cr8-4vfw-mr7h
Summary: Round-trip instability in REXML
Aliases: CVE-2021-28965
Severity: HIGH
CVSS score: 0
CWE: CWE-611, CWE-115
Published: 2021-04-30T17:30:37Z

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Vulnerability: GHSA-q9x4-q76f-5h5j
Summary: Unauthenticated users can exploit an enumeration vulnerability in Harbor (CVE-2019-19030)
Aliases: CVE-2019-19030
Severity: LOW
CVSS score: 0
Published: 2022-02-11T23:17:25Z

# Impact
Sean Wright from Secureworks has discovered an enumeration vulnerability. An attacker can make use of the Harbor API to make unauthenticated calls to the Harbor instance. Based on the HTTP status code in the response, an attacker is then able to work out which resources exist, and which do not. This would likely be accomplished by either providing a wordlist or enumerating through a sequence an
unauthenticated attacker is able to enumerate resources on the system. This provides them with information such as existing projects, repositories, etc.

The vulnerability was immediately fixed by the Harbor team.  

# Issue 
The following API resources where found to be vulnerable to enumeration attacks:
/api/chartrepo/{repo}/prov (POST)
/api/chartrepo/{repo}/charts (GET, POST)
/api/chartrepo/{repo}/charts/{name} (GET, DELETE)
/api/chartrepo/{repo}/charts/{name}/{version} (GET, DELETE)
/api/labels?name={name}&scope=p (GET)
/api/repositories?project_id={id} (GET)
/api/repositories/{repo_name}/ (GET, PUT, DELETE)
/api/repositories/{repo_name}/tags (GET)
/api/repositories/{repo_name}/tags/{tag}/manifest?version={version} (GET)
/api/repositories/{repo_name/{tag}/labels (GET)
/api/projects?project_name={name} (HEAD)
/api/projects/{project_id}/summary (GET)
/api/projects/{project_id}/logs (GET)
/api/projects/{project_id} (GET, PUT, DELETE)
/api/projects/{project_id}/metadatas (GET, POST)
/api/projects/{project_id}/metadatas/{metadata_name} (GET, PUT)

# Known Attack Vectors
Successful exploitation of this issue will lead to bad actors identifying which resources exist in Harbor without requiring authentication for the Harbor API.

# Patches
If your product uses the affected releases of Harbor, update to version 1.10.3 or 2.0.1 to patch this issue immediately.

https://github.com/goharbor/harbor/releases/tag/v1.10.3
https://github.com/goharbor/harbor/releases/tag/v2.0.1

# Workarounds
There is no known workaround

# For more information
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
Vulnerability: GHSA-jjr8-m8g8-p6wv
Summary: Null pointer dereference in TFLite's `Reshape` operator
Aliases: CVE-2021-29592
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-476
Published: 2021-05-21T14:26:58Z

### Impact
The fix for [CVE-2020-15209](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15209) missed the case when the target shape of `Reshape` operator is given by the elements of a 1-D tensor. As such, the [fix for the vulnerability](https://github.com/tensorflow/tensorflow/blob/9c1dc920d8ffb4893d6c9d27d1f039607b326743/tensorflow/lite/core/subgraph.cc#L1062-L1074) allowed passing a null-buffer-backed tensor with a 1D shape:

```cc
if (tensor->data.raw == nullptr && tensor->bytes > 0) {
  if (registration.builtin_code == kTfLiteBuiltinReshape && i == 1) {
    // In general, having a tensor here with no buffer will be an error.
    // However, for the reshape operator, the second input tensor is only
    // used for the shape, not for the data. Thus, null buffer is ok.
    continue;
  } else {
    // In all other cases, we need to return an error as otherwise we will
    // trigger a null pointer dereference (likely).
    ReportError("Input tensor %d lacks data", tensor_index);
    return kTfLiteError;
  }
}
```

### Patches
We have patched the issue in GitHub commit [f8378920345f4f4604202d4ab15ef64b2aceaa16](https://github.com/tensorflow/tensorflow/commit/f8378920345f4f4604202d4ab15ef64b2aceaa16).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.