TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-9xjr-m6f3-v5wm
Summary: HTTPS MitM vulnerability due to lack of hostname verification
Aliases: CVE-2016-10932
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-347
Published: 2021-08-25T20:43:06Z

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
Vulnerability: GHSA-5h46-h7hh-c6x9
Summary: Integer Overflow in Chunked Transfer-Encoding
Aliases: CVE-2021-32714
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-190
Published: 2021-07-12T16:55:37Z

### Summary

hyper's HTTP server and client code had a flaw that could trigger an integer overflow when decoding chunk sizes that are too big. This allows possible data loss, or if combined with an upstream HTTP proxy that allows chunk sizes larger than hyper does, can result in "request smuggling" or "desync attacks".

### Vulnerability

Example:

```
GET / HTTP/1.1
Host: example.com
Transfer-Encoding: chunked

f0000000000000003
abc
0

```

hyper only reads the rightmost 64-bit integer as the chunk size. So it reads `f0000000000000003` as `3`. A loss of data can occur since hyper would then read only 3 bytes of the body. Additionally, an HTTP request smuggling vulnerability would occur if using a proxy which instead has prefix truncation in the chunk size, or that understands larger than 64-bit chunk sizes.

Read more about desync attacks: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

### Impact

To determine if vulnerable to _data loss_, these things must be true:

- **Using HTTP/1.1.** Since HTTP/2 does not use chunked encoding, it is not vulnerable.
- **Using hyper as a server or client.** The body would be improperly truncated in either case.
- **Users send requests or responses with chunk sizes greater than 18 exabytes**.

To determine if vulnerable to _desync attacks_, these things must be true:

- **Using an upstream proxy that allows chunks sizes larger than 64-bit.** If the proxy rejects chunk sizes that are too large, that request won't be forwarded to hyper.

### Patches

We have released the following patch versions:

 - v0.14.10 (to be released when this advisory is published)

### Workarounds

Besides upgrading hyper, you can take the following options:

- Reject requests manually that contain a `Transfer-Encoding` header.
- Ensure any upstream proxy rejects `Transfer-Encoding` chunk sizes greater than what fits in 64-bit unsigned integers.


### Credits
This issue was initially reported by [Mattias Grenfeldt](https://grenfeldt.dev/) and Asta Olofsson.
Vulnerability: GHSA-85f9-w9cx-h363
Summary: Cross site request forgery in Jenkins Job and Node ownership Plugin
Aliases: CVE-2022-28150
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-03-30T00:00:23Z

Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints. This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Vulnerability: GHSA-9658-c26v-7qvf
Summary: Use-after-free in yottadb
Aliases: CVE-2021-27377
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:55:30Z

An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.
Vulnerability: GHSA-h2r4-4xgf-3865
Summary: Downloads Resources over HTTP in product-monitor
Aliases: CVE-2016-10567
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:35:32Z

Affected versions of `product-monitor` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `product-monitor`.


## Recommendation

Update to versions 2.2.5 or later.
Vulnerability: GHSA-74j8-88mm-7496
Summary: Confused Deputy in Kubernetes
Aliases: CVE-2020-8561
Severity: MODERATE
CVSS score: 4.1
CWE: CWE-610, CWE-441
Published: 2021-09-21T18:28:21Z

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Vulnerability: GHSA-c53x-wwx2-pg96
Summary: Cross-Site Scripting in @berslucas/liljs
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2020-09-03T17:03:58Z

Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

Upgrade to version 1.0.2 or later.
Vulnerability: GHSA-8gjm-h3xj-mp6w
Summary: RPC call failure in ckb
Aliases: CVE-2021-45698
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-01-06T22:10:43Z

An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
Vulnerability: GHSA-gw55-jm4h-x339
Summary: Improper Validation of Certificate with Host Mismatch in Java-WebSocket
Aliases: CVE-2020-11050
Severity: HIGH
CVSS score: 9
CWE: CWE-297, CWE-295
Published: 2020-05-08T18:54:39Z

The Java-WebSocket Client does not perform hostname verification.

 - This means that SSL certificates of other hosts are accepted as long as they are trusted. To exploit this vulnerability an attacker has to perform a man-in-the-middle (MITM) attack between a Java application using the Java-WebSocket Client and an WebSocket server it's connecting to.
 - TLS normally protects users and systems against MITM attacks, it cannot if certificates from other trusted hosts are accepted by the client.

For more information see: CWE-297: Improper Validation of Certificate with Host Mismatch - https://cwe.mitre.org/data/definitions/297.html

## Important note

The OWASP Dependency-Check (https://jeremylong.github.io/DependencyCheck/index.html) may report that a dependency of your project is affected by this security vulnerability, but you don't use this lib.
This is caused by the fuzzy search in the OWASP implementation.
Check out this issue (https://github.com/TooTallNate/Java-WebSocket/issues/1019#issuecomment-628507934) for more information and a way to suppress the warning.
Vulnerability: GHSA-fh63-4r66-jc7v
Summary: Cross-site scripting (XSS) in Apache Velocity Tools
Aliases: CVE-2020-13959
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-03-12T20:24:22Z

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
Vulnerability: GHSA-m6x4-97wx-4q27
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36184
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:26Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
Vulnerability: GHSA-6f89-8j54-29xf
Summary: Heap buffer overflow in `FractionalAvgPoolGrad`
Aliases: CVE-2021-29578
Severity: LOW
CVSS score: 2.5
CWE: CWE-119, CWE-787
Published: 2021-05-21T14:26:21Z

### Impact
The implementation of `tf.raw_ops.FractionalAvgPoolGrad` is vulnerable to a heap buffer overflow:
  
```python
import tensorflow as tf

orig_input_tensor_shape = tf.constant([1, 3, 2, 3], shape=[4], dtype=tf.int64)
out_backprop = tf.constant([2], shape=[1, 1, 1, 1], dtype=tf.int64)
row_pooling_sequence = tf.constant([1], shape=[1], dtype=tf.int64)
col_pooling_sequence = tf.constant([1], shape=[1], dtype=tf.int64)


tf.raw_ops.FractionalAvgPoolGrad(
  orig_input_tensor_shape=orig_input_tensor_shape, out_backprop=out_backprop,
  row_pooling_sequence=row_pooling_sequence,
  col_pooling_sequence=col_pooling_sequence, overlapping=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/dcba796a28364d6d7f003f6fe733d82726dda713/tensorflow/core/kernels/fractional_avg_pool_op.cc#L216) fails to validate that the pooling sequence arguments have enough elements as required by the `out_backprop` tensor shape.

### Patches
We have patched the issue in GitHub commit [12c727cee857fa19be717f336943d95fca4ffe4f](https://github.com/tensorflow/tensorflow/commit/12c727cee857fa19be717f336943d95fca4ffe4f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-5wg8-7c9q-794v
Summary: Data races in lock_api
Aliases: CVE-2020-35912
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362
Published: 2021-08-25T20:50:00Z

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
Vulnerability: GHSA-4vww-mc66-62m6
Summary: HTTP Request Smuggling in Apache Tomcat
Aliases: CVE-2021-33037
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-444
Published: 2021-08-13T15:21:14Z

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Vulnerability: GHSA-gjrj-9rj4-pgwx
Summary: DoS Vulnerability from Upstream Actix Web Issues
Severity: HIGH
CVSS score: 0
Published: 2021-12-15T22:51:07Z

### Impact
This vulnerability affects all users of the `perseus deploy` functionality who have not exported their sites to static files. If you are using the inbuilt Perseus server in production, there is a memory leak in Actix Web stemming from [this upstream issue](https://github.com/actix/actix-web/issues/1780) which can allow even a single user to cause the process to exhaust its memory on low-memory servers by continuously reloading the page. Note that this issue does not affect all Actix Web applications, but rather results from certain usage patterns which appear to be present in Perseus' server mechanics.

### Patches
This vulnerability is addressed in all versions after Perseus `v0.3.0-beta.21`, which temporarily discontinues the use of `perseus-actix-web` (until the upstream bug is fixed) and switches to `perseus-warp` instead, which utilizes [Warp](https://github.com/seanmonstar/warp).

Additionally, as of Perseus `v0.3.0-beta.22`, the Actix Web integration has been upgraded to use the latest unstable beta version of Actix Web, which appears to partially resolve this issue (the severity of the memory leak is reduced). However, due to the instability of this version, the default integration will remain Warp for now, and a warning will appear if you attempt to use the Actix Web integration.

<details>
<summary>Using the Actix Web integration</summary>

If the instability of the latest beta version of Actix Web is not a concern for you, you can use this integration by adding `-i actix-web` to `perseus serve` and the like. This will print a warning about instability, and will then operate with the beta version. Please report any failures in functionality that are not security-related to the Perseus team by [opening an issue on the repository](https://github.com/arctic-hen7/perseus/issues/new/choose).

Note however that switching to the Warp integration requires no code changes whatsoever unless you've ejected, so there are very few disadvantages to this change.

</details>

### Workarounds
Due to significant infrastructural changes within other Perseus packages that were needed to support Warp, this integration is not backward-compatible with any previous version of Perseus, meaning there are no easily feasible workarounds. If you're only in development though, this vulnerability is irrelevant until you push to production.

### CVE Status

Due to GitHub's requirements, a CVE can't be issued for this security advisory because the issue is technically one with Actix Web (though it's only in combination with certain mechanics in the Perseus server that this problem arises).

### References
See [this upstream issue](https://github.com/actix/actix-web/issues/1780) in Actix Web.

### For more information
If you have any questions or comments about this advisory:
* Open an issue on this repository
* Email me at [arctic_hen7@pm.me](mailto:arctic_hen7@pm.me)
Vulnerability: GHSA-jqmc-fxxp-r589
Summary: Deserialization of Untrusted Data in Tendenci
Aliases: CVE-2020-14942
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2021-06-18T18:31:05Z

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
Vulnerability: GHSA-5c66-x4wm-rjfx
Summary: Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)
Aliases: CVE-2016-7119
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2018-10-16T19:34:10Z

Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
Vulnerability: GHSA-58pf-pcwv-qg85
Summary: Path traversal
Aliases: CVE-2020-7665
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-18T21:08:28Z

This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction.
Vulnerability: GHSA-pm52-wwrw-c282
Summary: Command Injection in wiki-plugin-datalog
Severity: HIGH
CVSS score: 6.5
CWE: CWE-94
Published: 2019-06-13T18:59:06Z

Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system.


## Recommendation

Upgrade to version 0.1.6 or later.
Vulnerability: GHSA-wm7q-rxch-43mx
Summary: Byass due to validation before canonicalization in serve
Severity: HIGH
CVSS score: 0
Published: 2020-09-01T19:38:33Z

Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames.



Example:
Here we have a server that ignores the file test.txt.
```
const serve = require('serve')
const server = serve(__dirname, {
      port: 1337,
      ignore: ['test.txt']
})
```

Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file. 

`curl http://localhost:1337/t%65st.txt`

Additionally this technique can be used to get directory listings of ignored directories.


## Recommendation

Update to version 6.5.2 or later.
Vulnerability: GHSA-2cc5-23r7-vc4v
Summary: Default client side session signing key is highly predictable
Aliases: CVE-2021-29480
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-330, CWE-340
Published: 2021-07-01T17:02:26Z

### Impact

The client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used (which is recommended, but is not on by default), the session data could be tampered with by someone with the ability to write cookies. 

The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible, but its use is not actively prevented.

### Vulnerability Location

https://github.com/ratpack/ratpack/blob/29434f7ac6fd4b36a4495429b70f4c8163100332/ratpack-session/src/main/java/ratpack/session/clientside/ClientSideSessionConfig.java#L29

### Patches

As of Ratpack 1.9.0 the default value is a securely randomly generated value, generated at application startup time. 

### Workarounds

Supply an alternative signing key, as per the documentation's recommendation.
Vulnerability: GHSA-7x36-h62w-vw65
Summary: Out-of-bounds Write in actix-web
Aliases: CVE-2018-25026
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2022-01-06T22:18:58Z

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
Vulnerability: GHSA-f499-jv47-9wxf
Summary: Directory Traversal in desafio
Aliases: CVE-2017-16164
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2018-08-06T21:40:02Z

Affected versions of `desafio` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

no patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x8qc-rrcw-4r46
Summary: Symlink reference outside of node_modules in npm
Aliases: CVE-2019-16776
Severity: LOW
CVSS score: 7.7
CWE: CWE-22
Published: 2019-12-13T15:39:26Z

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.  

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.3 or later.
Vulnerability: GHSA-vjmg-pc8h-p6p8
Summary: Out of bounds read in fltk
Aliases: CVE-2021-28308
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-125
Published: 2021-08-25T20:53:58Z

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is an out-of bounds read because the pixmap constructor lacks pixmap input validation.
Vulnerability: GHSA-8c26-wmh5-6g9v
Summary: Use of a Broken or Risky Cryptographic Algorithm in golang.org/x/crypto/ssh
Aliases: CVE-2022-27191
Severity: HIGH
CVSS score: 7.5
CWE: CWE-327
Published: 2022-03-19T00:01:02Z

golang.org/x/crypto/ssh versions 0.0.0-20220214200702-86341886e292 and prior in Go through 1.16.15 and 1.17.x through 1.17.8 allows an attacker to crash a server in certain circumstances involving AddHostKey. Version 0.0.0-20220315160706-3147a52a75dd includes a fix for the vulnerability and support for SHA-2.
Vulnerability: GHSA-qmjg-g86h-6rc9
Summary: Hijacked Environment Variables in d3.js
Aliases: CVE-2017-16044
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T21:00:28Z

The `d3.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-p885-prv3-m4xv
Summary: Cross-site Scripting in snipe-it
Aliases: CVE-2022-1380
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-17T00:00:32Z

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
Vulnerability: GHSA-cfjv-5498-mph5
Summary: XSS in Action View
Aliases: CVE-2020-15169
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-09-11T15:19:57Z

There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks.

### Impact

When an HTML-unsafe string is passed as the default for a missing translation key [named `html` or ending in `_html`](https://guides.rubyonrails.org/i18n.html#using-safe-html-translations), the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:

```erb
<%# The welcome_html translation is not defined for the current locale: %>
<%= t("welcome_html", default: untrusted_user_controlled_string) %>

<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
<%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
```

### Patches

Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.

The patches have also been applied to the `master`, `6-0-stable`, and `5-2-stable` branches on GitHub. If you track any of these branches, you should update to the latest.

To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* [5-2-translate-helper-xss.patch](https://gist.github.com/georgeclaghorn/a466e103922ee81f24c32c9034089442#file-5-2-translate-helper-xss-patch) — patch for the 5.2 release series
* [6-0-translate-helper-xss.patch](https://gist.github.com/georgeclaghorn/a466e103922ee81f24c32c9034089442#file-6-0-translate-helper-xss-patch) — patch for the 6.0 release series

Please note that only the 5.2 and 6.0 release series are currently supported. Users of earlier, unsupported releases are advised to update as soon as possible, as we cannot provide security fixes for unsupported releases.

### Workarounds

Impacted users who can’t upgrade to a patched Rails version can avoid this issue by manually escaping default translations with the `html_escape` helper (aliased as `h`):

```erb
<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
```
Vulnerability: GHSA-p77h-hv6g-fmfp
Summary: Sensitive Data Exposure in ibm_db
Severity: MODERATE
CVSS score: 5
Published: 2020-09-03T20:43:16Z

Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode.


## Recommendation

Upgrade to version 2.6.0 or later and ensure sensitive information was not logged.
Vulnerability: GHSA-36p3-wjmg-h94x
Summary: Remote Code Execution in Spring Framework
Aliases: CVE-2022-22965
Severity: CRITICAL
CVSS score: 0
CWE: CWE-74
Published: 2022-03-31T18:30:50Z

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`. 

## Impact

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit:
- JDK 9 or higher
- Apache Tomcat as the Servlet container
- Packaged as WAR
- `spring-webmvc` or `spring-webflux` dependency

## Patches

- Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE)
- Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12)

## Workarounds

For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting.

To apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux).
Vulnerability: GHSA-g9cg-h3jm-cwrc
Summary: Prototype Pollution in @hapi/subtext
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T15:47:23Z

Versions of `@hapi/subtext` prior to 6.1.3 or 7.0.3 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

Upgrade to versions 6.1.3, 7.0.3 or later.
Vulnerability: GHSA-4hvf-hxvg-f67v
Summary: Read and Write outside of bounds in TensorFlow
Aliases: CVE-2022-23560
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787, CWE-125
Published: 2022-02-09T23:53:30Z

### Impact
An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in [the conversion from sparse tensors to dense tensors](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293).

### Patches
We have patched the issue in GitHub commit [6364463d6f5b6254cac3d6aedf999b6a96225038](https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability: GHSA-7h42-5vj2-cq39
Summary: High severity vulnerability that affects tiny-json-http
Aliases: CVE-2018-1000096
Severity: HIGH
CVSS score: 8.1
CWE: CWE-295
Published: 2018-03-13T20:42:00Z

brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks.
Vulnerability: GHSA-hw3m-8h25-8frw
Summary: Command Injection in Apache Kylin
Aliases: CVE-2021-45456
Severity: MODERATE
CVSS score: 0
CWE: CWE-77
Published: 2022-01-08T00:42:59Z

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Vulnerability: GHSA-fpcv-j2q9-vqhw
Summary: Moderate severity vulnerability that affects mayan-edms
Aliases: CVE-2018-16405
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-06T03:24:50Z

An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly, leading to XSS.
Vulnerability: GHSA-94cq-7ccq-cmcm
Summary: lynx doesn't properly sanitize user input and exposes database password to unauthorized users
Aliases: CVE-2014-5002
Severity: HIGH
CVSS score: 7.8
Published: 2018-01-24T17:10:45Z

The lynx gem 0.2.0 for Ruby places the configured password on command lines, which allows local users to obtain sensitive information by listing processes.
Vulnerability: GHSA-r8rm-4hfj-2x87
Summary: Data Amplification in Play Framework
Aliases: CVE-2020-26882
Severity: HIGH
CVSS score: 7.5
CWE: CWE-674
Published: 2022-02-10T20:23:28Z

In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
Vulnerability: GHSA-rh7x-ppxx-p34c
Summary: Insufficient size checks in ws
Aliases: CVE-2020-35896
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-08-25T20:49:32Z

An issue was discovered in the ws crate through 2020-09-25 for Rust. The outgoing buffer is not properly limited, leading to a remote memory-consumption attack.
Vulnerability: GHSA-8qv8-fq5w-p966
Summary: phpservermon is vulnerable to CRLF Injection
Aliases: CVE-2021-4097
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-93
Published: 2021-12-16T14:26:00Z

phpservermon is vulnerable to Improper Neutralization of CRLF Sequences.
Vulnerability: GHSA-jv7g-9g6q-cxvw
Summary: Path Traversal in convert-svg packages
Aliases: CVE-2021-23631
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-01-27T14:04:28Z

This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.
Vulnerability: GHSA-wv5p-gmmv-wh9v
Summary: Insertion of Sensitive Information into Log File in ansible
Aliases: CVE-2021-20178
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-532
Published: 2021-06-01T21:53:29Z

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Vulnerability: GHSA-hv96-xxx2-5v7w
Summary: Downloads Resources over HTTP in nw
Aliases: CVE-2016-10588
Severity: HIGH
CVSS score: 8.1
CWE: CWE-311
Published: 2019-02-18T23:51:04Z

Affected versions of `nw` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nw`.


## Recommendation

Update to version 0.23.6-1 or later.
Vulnerability: GHSA-82rf-q3pr-4f6p
Summary: Sensitive data exposure in NATS
Aliases: CVE-2020-26149
Severity: HIGH
CVSS score: 7.5
CWE: CWE-522
Published: 2020-10-08T22:11:32Z

Preview versions of two NPM packages and one Deno package from the NATS
project contain an information disclosure flaw, leaking options to the
NATS server; for one package, this includes TLS private credentials.

The _connection_ configuration options in these JavaScript-based
implementations were fully serialized and sent to the server in the
client's CONNECT message, immediately after TLS establishment.

The nats.js client supports Mutual TLS and the credentials for the TLS
client key are included in the connection configuration options;
disclosure of the client's TLS private key to the server has been
observed.

Most authentication mechanisms are handled after connection, instead of
as part of connection, so other authentication mechanisms are
unaffected.
For clarity: NATS account NKey authentication is NOT affected.

Neither the nats.ws nor the nats.deno clients support Mutual TLS: the
affected versions listed below are those where the logic flaw is
present. We are including the nats.ws and nats.deno versions out of an
abundance of caution, as library maintainers, but rate as minimal the
likelihood of applications leaking sensitive data.

Affected versions:

Security impact:

* NPM package nats.js:
+ mainline is unaffected
+ beta branch is vulnerable from 2.0.0-201, fixed in 2.0.0-209

Logic flaw:

* NPM package nats.ws:
+ status: preview
+ flawed from 1.0.0-85, fixed in 1.0.0-111
* Deno repository https://github.com/nats-io/nats.deno
+ status: preview
+ flawed in all git tags prior to fix
+ fixed with git tag v1.0.0-9

Impact:

For deployments using TLS client certificates (for mutual TLS), private
key material for TLS is leaked from the client application to the
server. If the server is untrusted (run by a third party), or if the
client application also disables TLS verification (and so the true
identity of the server is unverifiable) then authentication credentials
are leaked.
Vulnerability: GHSA-52rg-hpwq-qp56
Summary: Allocation of Resources Without Limits or Throttling in Keycloak
Aliases: CVE-2020-10758
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2022-02-09T00:56:51Z

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.
Vulnerability: GHSA-9w8r-397f-prfh
Summary: Infinite Loop in Pygments
Aliases: CVE-2021-20270
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2021-04-20T16:35:47Z

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Vulnerability: GHSA-3whx-qrj5-hh2h
Summary: Improper Input Validation in Apache Pulsar
Aliases: CVE-2021-41571
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2022-02-02T00:01:52Z

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.
Vulnerability: GHSA-2qrg-x229-3v8q
Summary: Deserialization of Untrusted Data in Log4j
Aliases: CVE-2019-17571
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-01-06T18:43:49Z

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Users are advised to migrate to `org.apache.logging.log4j:log4j-core`
Vulnerability: GHSA-8vfw-v2jv-9hwc
Summary: Reflected cross-site scripting in development mode handler in Vaadin
Severity: LOW
CVSS score: 2.5
CWE: CWE-172
Published: 2021-06-28T16:52:45Z

URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

- https://vaadin.com/security/cve-2021-33604
Vulnerability: GHSA-8qh8-cv77-h83g
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0769
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2019-04-09T19:43:46Z

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
Vulnerability: GHSA-w7rc-rwvf-8q5r
Summary: The `size` option isn't honored after following a redirect in node-fetch
Aliases: CVE-2020-15168
Severity: LOW
CVSS score: 2.6
CWE: CWE-20, CWE-770
Published: 2020-09-10T17:46:21Z

### Impact
Node Fetch did not honor the `size` option after following a redirect, which means that when a content size was over the limit, a `FetchError` would never get thrown and the process would end without failure.

For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after `fetch()` has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

### Patches
We released patched versions for both stable and beta channels:

- For `v2`: 2.6.1
- For `v3`: 3.0.0-beta.9

### Workarounds
None, it is strongly recommended to update as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [node-fetch](https://github.com/node-fetch/node-fetch/issues/new?assignees=&labels=question&template=support-or-usage.md&title=Question%3A+)
* Contact one of the core maintainers.
Vulnerability: GHSA-28f8-hqmc-7ph8
Summary: Malicious Package in ember-power-timepicker
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:19:09Z

Version 1.0.8 of `ember-power-timepicker` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-7q44-r25x-wm4q
Summary: Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
Aliases: CVE-2021-34551
Severity: HIGH
CVSS score: 8.1
CWE: CWE-94, CWE-434
Published: 2021-06-22T15:17:51Z

PHPMailer 6.4.1 contains a possible remote code execution vulnerability through the `$lang_path` parameter of the `setLanguage()` method. If the `$lang_path` parameter is passed unfiltered from user input, it can be set to [a UNC path](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths), and if an attacker is also able to create a remote mount on the server that the UNC path points to, a script file under their control may be executed. 

### Impact
Arbitrary code may be run by a remote attacker under the web server or PHP process running on Window hosts.

### Patches
Mitigated in PHPMailer 6.5.0 by no longer treating translation files as PHP code, but by parsing their text content directly.
This approach avoids the possibility of executing unknown code while retaining backward compatibility. This isn't ideal, so the current translation format is deprecated and will be replaced in the next major release.

### Workarounds
Any of:
* Ensure that calling code does not pass unfiltered user-supplied data to the `$lang_path` parameter of the `setLanguage()` method.
* Block or filter the use of unknown UNC paths in this parameter (or altogether).
* Ensure that unauthorised users do not have the ability to read from unknown remote servers via UNC paths.
* Run on an OS that does not support UNC paths

### References
[CVE-2021-34551](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34551).

Reported by [listensec.com](https://listensec.com) via Tidelift.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [PHPMailer](https://github.com/PHPMailer/PHPMailer)
* [Email the maintainers](mailto:phpmailer@synchromedia.co.uk)
Vulnerability: GHSA-3hxh-8cp2-g4hg
Summary: Use after free and segfault in shape inference functions
Aliases: CVE-2021-37690
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-416
Published: 2021-08-25T14:39:22Z

### Impact
When running shape functions, some functions (such as `MutableHashTableShape`) produce extra output information in the form of a `ShapeAndType` struct. The shapes embedded in this struct are owned by an inference context that is cleaned up almost immediately; if the upstream code attempts to access this shape information, it can trigger a segfault.

`ShapeRefiner` is mitigating this for normal output shapes by cloning them (and thus putting the newly created shape under ownership of an inference context that will not die), but we were not doing the same for shapes and types. This commit fixes that by doing similar logic on output shapes and types.

### Patches
We have patched the issue in GitHub commit [ee119d4a498979525046fba1c3dd3f13a039fbb1](https://github.com/tensorflow/tensorflow/commit/ee119d4a498979525046fba1c3dd3f13a039fbb1).                                                                                                          

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-rg5m-3fqp-6px8
Summary: Moderate severity vulnerability that affects actionmailer
Aliases: CVE-2013-4389
Severity: MODERATE
CVSS score: 0
CWE: CWE-134
Published: 2017-10-24T18:33:37Z

Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
Vulnerability: GHSA-8g64-9cm2-838j
Summary: Malicious Package in bugfer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:29:26Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-wmfg-55f9-j8hq
Summary: Server-Side Template Injection
Aliases: CVE-2020-26282
Severity: HIGH
CVSS score: 10
CWE: CWE-74
Published: 2020-12-24T20:49:34Z

### Impact
A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282.

### Patches
Effective Immediately, all users should upgrade to version 2.1.2 or higher.

### Workarounds
None. 

### References
https://securitylab.github.com/research/bean-validation-RCE


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the BrowserUp Proxy repo](http://github.com/browserup/browserup-proxy)
* Contact us via  the [BrowserUp website](https://browserup.com) or email us at [support@browserup.com](mailto:support@browserup.com)
Vulnerability: GHSA-vw7g-jq9m-3q9v
Summary: Unauthorized File Access in glance
Severity: MODERATE
CVSS score: 0
Published: 2020-09-02T18:23:35Z

Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins with `.`. 


## Recommendation

Upgrade to version 3.0.7 or later.
Vulnerability: GHSA-92wj-x78c-m4fx
Summary: Moderate severity vulnerability that affects org.apache.karaf:karaf
Aliases: CVE-2018-11788
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2019-01-07T19:14:49Z

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Vulnerability: GHSA-fcr8-6q7r-m4wg
Summary: Bypass of fix for CVE-2020-26231, Twig sandbox escape
Aliases: CVE-2021-21264
Severity: MODERATE
CVSS score: 5.2
CWE: CWE-862
Published: 2021-05-04T17:42:33Z

### Impact
A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247:

An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 472 (v1.0.472) and v1.1.2.

### Workarounds
Apply https://github.com/octobercms/october/commit/f63519ff1e8d375df30deba63156a2fc97aa9ee7 to your installation manually if unable to upgrade to Build 472 or v1.1.2.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">
Vulnerability: GHSA-xvvv-wj7j-r9jm
Summary: Cross-site Scripting in Netgen Tags Bundle
Aliases: CVE-2021-45895
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-06T22:04:19Z

Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.