TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-qx9m-27wh-7fjg
Summary: Downloads Resources over HTTP in jvminstall
Aliases: CVE-2016-10631
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:57:03Z

Affected versions of `jvminstall` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jvminstall`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-mg5h-9rhq-4cqx
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0937
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-15T00:01:02Z

ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-364w-9g92-3grq
Summary: Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.
Aliases: CVE-2021-43617
Severity: MODERATE
CVSS score: 0
CWE: CWE-434
Published: 2021-11-16T23:40:08Z

# Withdrawn

This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue.

## Original CVE based description

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).
Vulnerability: GHSA-fmpq-w5q6-9vf9
Summary: Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-main
Aliases: CVE-2019-0224
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-02T15:46:48Z

In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.
Vulnerability: GHSA-m2v2-8227-59f5
Summary: Exposure of sensitive information in concrete5/core
Aliases: CVE-2021-22967
Severity: MODERATE
CVSS score: 0
CWE: CWE-200, CWE-639
Published: 2021-11-23T17:54:39Z

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.
Vulnerability: GHSA-7vrm-3jc8-5wwm
Summary: Incorrect Comparison in Vyper
Severity: HIGH
CVSS score: 7.5
CWE: CWE-697
Published: 2022-04-04T21:40:45Z

### Impact
bytestrings can have dirty bytes in them, resulting in the word-for-word comparison to give incorrect results, e.g.
```vyper
b1: Bytes[32] = b"abcdef"
b1 = slice(b1, 0, 1)
b2: Bytes[32] = b"abcdef"
t: bool = b1 == b2  # incorrectly evaluates to True
```
even without dirty nonzero bytes, because there is no comparison of the length, two bytestrings can compare to equal if one ends with `"\x00"`.
```vyper
b1: Bytes[32] = b"abc\0"
b2: Bytes[32] = b"abc"
t: bool = b1 == b2  # incorrectly evaluates to True
```

### Patches
fixed in https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508
Vulnerability: GHSA-pjxw-22xf-6pwc
Summary: Prototype Pollution in defaults-deep
Aliases: CVE-2018-16486
Severity: MODERATE
CVSS score: 0
CWE: CWE-400, CWE-345
Published: 2019-02-07T18:16:38Z

All versions of `defaults-deep` are vulnerable to prototype pollution. Provided certain input `defaults-deep` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.
Vulnerability: GHSA-j8qh-3xrq-c825
Summary: Division by zero in TFLite's implementation of `OneHot`
Aliases: CVE-2021-29600
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:28:04Z

### Impact
The implementation of the `OneHot` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/f61c57bd425878be108ec787f4d96390579fb83e/tensorflow/lite/kernels/one_hot.cc#L68-L72):

```cc
int prefix_dim_size = 1;
for (int i = 0; i < op_context.axis; ++i) {
  prefix_dim_size *= op_context.indices->dims->data[i];
}
const int suffix_dim_size = NumElements(op_context.indices) / prefix_dim_size;
```

An attacker can craft a model such that at least one of the dimensions of `indices` would be 0. In turn, the `prefix_dim_size` value would become 0.

### Patches
We have patched the issue in GitHub commit [3ebedd7e345453d68e279cfc3e4072648e5e12e5](https://github.com/tensorflow/tensorflow/commit/3ebedd7e345453d68e279cfc3e4072648e5e12e5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-mxr5-p36v-479m
Summary: Moderate severity vulnerability that affects jquery-file-upload
Aliases: CVE-2018-9207
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2018-12-19T19:24:03Z

Arbitrary file upload in jQuery Upload File <= 4.0.2
Vulnerability: GHSA-hx7c-qpfq-xcrp
Summary: Cross-site Scripting in django-cms
Aliases: CVE-2021-44649
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-13T20:10:53Z

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.
Vulnerability: GHSA-3mqv-8gxg-pfm4
Summary: Cross-site scripting in twitter-server
Aliases: CVE-2020-35774
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-09T22:37:28Z

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
Vulnerability: GHSA-7rpc-9m88-cf9w
Summary: OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS
Aliases: CVE-2021-41243
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-78
Published: 2021-12-01T18:29:42Z

There is an OS Command Injection Vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

Target
baserCMS 4.5.3 and earlier versions

Vulnerability
OS Command Injection Vulnerability.

Countermeasures
Update to the latest version of baserCMS

Credits
Akagi Yusuke @NTT-ME
Vulnerability: GHSA-g4gm-pxh3-29fq
Summary: Unrestricted Uploads in Concrete5
Aliases: CVE-2020-14961
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-434
Published: 2022-02-10T22:28:41Z

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.
Vulnerability: GHSA-2r8f-2665-3gxq
Summary: Malicious Package in froever
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:36:36Z

All versions of `froever` contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-f9xr-3m55-5q2v
Summary: Data races in cgc
Aliases: CVE-2020-36466
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2021-08-25T20:56:14Z

An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr implements Send and Sync for all types.
Vulnerability: GHSA-fhv8-fx5f-7fxf
Summary: Prototype Pollution in the merge and clone helper methods
Aliases: CVE-2021-39227
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-1321, CWE-915
Published: 2021-09-20T19:53:15Z

### Impact
Using `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.

### Patches
 
It has been patched in https://github.com/ecomfe/zrender/pull/826. 
Users should update zrender to `5.2.1`.  and update echarts to `5.2.1` if project is using echarts.

### References
NA

### For more information
NA
Vulnerability: GHSA-24g6-5rx7-58wj
Summary: Missing Initialization of Resource in pnet
Aliases: CVE-2019-25054
Severity: HIGH
CVSS score: 7.5
CWE: CWE-909
Published: 2022-01-06T22:18:07Z

An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
Vulnerability: GHSA-2xpj-f5g2-8p7m
Summary: Access of Uninitialized Pointer
Aliases: CVE-2020-17446
Severity: HIGH
CVSS score: 9.8
CWE: CWE-824
Published: 2021-04-20T16:30:51Z

asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.
Vulnerability: GHSA-6pw2-5hjv-9pf7
Summary: Sandbox bypass in vm2
Aliases: CVE-2021-23555
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321, CWE-1265
Published: 2022-02-12T00:00:38Z

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
Vulnerability: GHSA-24wf-7vf2-pv59
Summary: XXE vulnerability on Launch import with externally-defined DTD file
Aliases: CVE-2021-29620
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2021-06-28T16:38:29Z

### Impact
Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

### Patches
Fixed with: https://github.com/reportportal/service-api/pull/1392

### Binaries
`docker pull reportportal/service-api:5.4.0`
https://github.com/reportportal/service-api/packages/846871?version=5.4.0

### For more information
If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)
Vulnerability: GHSA-8w3j-g983-8jh5
Summary: Sensitive Data Exposure in parse-server
Aliases: CVE-2019-1020013
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-209
Published: 2019-07-11T14:23:09Z

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking.
`ParseError.ACCOUNT_ALREADY_LINKED(208)` was thrown BEFORE the AuthController checks the password and throws a `ParseError.SESSION_MISSING(206)` for Insufficient auth.  An attacker can guess ids and get information about linked accounts/email addresses.

### For more information
If you have any questions or comments about this advisory,
Open an issue in the [parse-server](https://github.com/parse-community/parse-server)
[Parse Community Vulnerability Disclosure Program](https://github.com/parse-community/parse-server/blob/master/SECURITY.md)
Vulnerability: GHSA-chj8-5xgw-wcvj
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Aliases: CVE-2016-8750
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-90
Published: 2019-01-07T19:14:46Z

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
Vulnerability: GHSA-9mrv-456v-pf22
Summary: Cross-site Scripting in vis-timeline
Aliases: CVE-2020-28487
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2021-04-13T15:19:50Z

This affects the package vis-timeline before 7.4.4.
 An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.
Vulnerability: GHSA-cxrj-66c5-9fmh
Summary: Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Aliases: CVE-2018-1258
Severity: HIGH
CVSS score: 8.8
CWE: CWE-863
Published: 2018-10-17T20:05:49Z

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Vulnerability: GHSA-29q4-gxjq-rx5c
Summary: Remote Code Execution in SCIMono
Aliases: CVE-2021-21479
Severity: HIGH
CVSS score: 0
CWE: CWE-690, CWE-59, CWE-74, CWE-917, CWE-62, CWE-77
Published: 2021-02-10T02:31:53Z

### Impact
It is possible for attacker to inject and execute java expression and compromising the availability and integrity of the system.

### Patches
The issue was fixed on  [0.0.19 version](https://mvnrepository.com/artifact/com.sap.scimono/scimono-server/0.0.19)
Vulnerability: GHSA-3gm7-v7vw-866c
Summary: XML External Entity (XXE) Injection in Apache Solr
Aliases: CVE-2019-0193
Severity: HIGH
CVSS score: 7.2
CWE: CWE-94
Published: 2019-08-01T19:17:35Z

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Vulnerability: GHSA-9w8f-7wgr-2h7g
Summary: kimai2 is vulnerable to Improper Access Control
Aliases: CVE-2021-3992
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863, CWE-284
Published: 2021-12-03T20:42:59Z

kimai2 is vulnerable to Improper Access Control
Vulnerability: GHSA-484q-784p-8m5h
Summary: Cross-site Scripting in keycloak
Aliases: CVE-2020-10776
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2022-02-09T00:58:15Z

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
Vulnerability: GHSA-vfxj-qg93-7wwc
Summary: Sessions could be hijacked due to tracking contacts by an auto-incremented ID in Mautic
Aliases: CVE-2018-10189
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-200
Published: 2021-01-19T21:16:21Z

### Impact
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.

### Patches
Update to 2.13.0 or later

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-9ccv-p7fg-m73x
Summary: XML Injection in python-libnmap
Aliases: CVE-2019-1010017
Severity: HIGH
CVSS score: 7.5
CWE: CWE-91
Published: 2019-07-18T15:38:41Z

python-libnmap is affected by: XML Injection. The impact is: Denial of service (DoS) by consuming resources. The component is: XML Parsing. The attack vector is: Specially crafted XML payload.
Vulnerability: GHSA-g95f-p29q-9xw4
Summary: Regular Expression Denial of Service in braces
Severity: LOW
CVSS score: 3.7
CWE: CWE-400, CWE-185
Published: 2019-06-06T15:30:30Z

Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 2.3.1 or higher.
Vulnerability: GHSA-4fqg-89cc-5pv5
Summary: Malicious Package in sj-labc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-04T14:58:44Z

All versions of `sj-labc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-pfwg-rxf4-97c3
Summary: Open Redirect in Apache Superset
Aliases: CVE-2021-28125
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-10-06T17:47:53Z

Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Vulnerability: GHSA-vqcq-mrmw-mcmg
Summary: Rubyzip gem contains a Directory Traversal vulnerability in zip file component
Aliases: CVE-2018-1000544
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-59, CWE-434
Published: 2018-09-06T03:27:18Z

rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..

This is similar to CVE-2017-5946 which was patched in 1.2.1 but the fix in that case was incomplete.
Vulnerability: GHSA-jqmc-79gx-7g8p
Summary: Incorrect Permission Assignment for Critical Resource in CRI-O
Aliases: CVE-2022-0532
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-732
Published: 2022-02-11T00:00:54Z

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Vulnerability: GHSA-rcwj-2hj2-vmjj
Summary: Insufficient Session Expiration in Apache NiFi Registry
Aliases: CVE-2020-9482
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-613
Published: 2022-02-09T00:23:06Z

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi Registry.
Vulnerability: GHSA-4xfp-4pfp-89wg
Summary: Reference binding to nullptr in `RaggedTensorToSparse`
Aliases: CVE-2021-37656
Severity: HIGH
CVSS score: 7.1
CWE: CWE-824
Published: 2021-08-25T14:42:55Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToSparse`:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToSparse(
  rt_nested_splits=[[0, 38, 0]],
  rt_dense_values=[])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/ragged_tensor_to_sparse_kernel.cc#L30) has an incomplete validation of the splits values: it does not check that they are in increasing order.

### Patches
We have patched the issue in GitHub commit [1071f554dbd09f7e101324d366eec5f4fe5a3ece](https://github.com/tensorflow/tensorflow/commit/1071f554dbd09f7e101324d366eec5f4fe5a3ece).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-w9q5-mvc6-5cw3
Summary: Malicious Package in bufder-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:45:13Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-mm4f-47ch-f7hx
Summary: Arbitrary code execution in kill-by-port
Aliases: CVE-2021-23363
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-77
Published: 2021-04-13T15:32:43Z

This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-j9m2-6hq2-4r3c
Summary: Cross-site Scripting in invenio-previewer
Aliases: CVE-2019-1020019
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-07-16T00:52:22Z

## Cross-Site Scripting (XSS) vulnerability in JSON, Markdown and iPython Notebook previewers

### Impact
Several Cross-Site Scripting (XSS) vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or Notebook file with embedded scripts that would be executed by a victims browser.

### Patches
Invenio-Previewer v1.0.0a12 fixes the issue.

### Workarounds
You can remediate the vulnerability without upgrading by disabling the affected previewers. You do this by adding the following to your configuration:

```python
PREVIEWER_PREFERENCE = [
    'csv_dthreejs',
    'simple_image',
    # 'json_prismjs',
    'xml_prismjs',
    # 'mistune',
    'pdfjs',
    # 'ipynb',
    'zip',
]
```

Afterwards, you should not be able to preview JSON, Markdown or iPython Notebook files.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
Vulnerability: GHSA-4p7j-5ppx-rfhm
Summary: Downloads Resources over HTTP in apk-parser3
Aliases: CVE-2016-10574
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:06:49Z

Affected versions of `apk-parser3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `apk-parser3`.


## Recommendation

Update to version 0.1.3 or greater.
Vulnerability: GHSA-6h7f-qwqm-35pp
Summary: Arbitrary File Read in phantom-html-to-pdf
Aliases: CVE-2020-7763
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-22
Published: 2020-11-06T18:06:16Z

This affects the package phantom-html-to-pdf before 0.6.1.
Vulnerability: GHSA-25v4-mcx4-hh35
Summary: Cross-Site Scripting in atlasboard-atlassian-package
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-04T17:28:28Z

All versions of `atlasboard-atlassian-package` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS).  The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able to change issue summaries in Jira tickets.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-x6mj-w4jf-jmgw
Summary: Server Side Request Forgery (SSRF) in Kubernetes
Aliases: CVE-2020-8555
Severity: LOW
CVSS score: 6.3
CWE: CWE-918
Published: 2022-02-15T01:57:18Z

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Vulnerability: GHSA-qrx8-8545-4wg2
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39148
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502
Published: 2021-08-25T14:47:38Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39148](https://x-stream.github.io/CVE-2021-39148.html).

### Credits
wh1t3p1g from TSRC (Tencent Security Response Center) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-m9hp-7r99-94h5
Summary: Critical security issues in XML encoding in github.com/dexidp/dex
Aliases: CVE-2020-26290
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-347
Published: 2021-12-20T17:53:53Z

### Impact

The following vulnerabilities have been disclosed, which impact users leveraging the SAML connector:

Signature Validation Bypass (CVE-2020-15216): https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-q547-gmf8-8jr7

`encoding/xml` instabilities:
 - [Element namespace prefix instability (CVE-2020-29511)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-elements.md)
 - [Attribute namespace prefix instability (CVE-2020-29509)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-attributes.md)
 - [Directive comment instability (CVE-2020-29510)](https://github.com/mattermost/xml-roundtrip-validator/blob/master/advisories/unstable-directives.md)

### Patches

Immediately update to [Dex v2.27.0](https://github.com/dexidp/dex/releases/tag/v2.27.0).

### Workarounds

There are no known workarounds.
Vulnerability: GHSA-p5wr-vp8g-q5p4
Summary: Moderate severity vulnerability that affects Plone
Aliases: CVE-2017-5524
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-134
Published: 2018-07-12T14:45:15Z

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
Vulnerability: GHSA-6qgx-f452-7699
Summary: Malicious Package in superhappyfuntime
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:28:39Z

All versions of `superhappyfuntime` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rvjg-gxwx-j5gf
Summary: OIDC Logout redirect in keycloak
Aliases: CVE-2020-10734
Severity: LOW
CVSS score: 3.3
CWE: CWE-601
Published: 2022-04-28T17:13:58Z

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.
Vulnerability: GHSA-wqg7-vrj7-v82h
Summary: High severity vulnerability that affects mosca
Aliases: CVE-2018-11615
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2018-08-31T06:22:50Z

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system.
Vulnerability: GHSA-4xc7-x2jr-cr74
Summary: Improper Authorization in dolibarr/dolibarr
Aliases: CVE-2022-0731
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863
Published: 2022-02-24T00:00:52Z

Dolibarr allows improper access control issues in the userphoto modulepart. The impact could lead to data exposure as the attached files and documents may contain sensitive information of relevant parties such as contacts, suppliers, invoices, orders, stocks, agenda, accounting and more.
Vulnerability: GHSA-hrgx-7j6v-xj82
Summary: Reflected cross-site scripting (XSS) vulnerability
Aliases: CVE-2022-0087
Severity: HIGH
CVSS score: 7.1
CWE: CWE-79
Published: 2022-01-12T21:55:40Z

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the `@keystone-6/auth` package.

#### Impact
The vulnerability can impact users of the administration user interface when following an untrusted link to the `signin` or `init` page.
This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.

## Vulnerability mitigation
Please upgrade to `@keystone-6/auth >= 1.0.2`, where this vulnerability has been closed.
If you are using `@keystone-next/auth`,  we **strongly** recommend you upgrade to `@keystone-6`.

### Workarounds
If for some reason you cannot upgrade the dependencies in software, you could alternatively

- disable the administration user interface, or 
- if using a reverse-proxy, strip query parameters when accessing the administration interface

### References
https://owasp.org/www-community/attacks/xss/

Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability
Vulnerability: GHSA-6675-wwqr-jhmf
Summary: Cross-site Scripting in GilaCMS
Aliases: CVE-2020-20695
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-09-30T17:12:56Z

A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
Vulnerability: GHSA-qcx9-j53g-ccgf
Summary: Remote Code Execution via unsafe classes in otherwise permitted modules
Aliases: CVE-2021-32807
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-915
Published: 2021-08-05T17:01:30Z

### Impact
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. 

The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution.

By default, you need to have the admin-level Zope "Manager" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk.

### Patches
The problem has been fixed in AccessControl 4.3 and 5.2.
Only AccessControl versions 4 and 5 are vulnerable, and only on Python 3, not Python 2.7.

### Workarounds
A site administrator can restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [AccessControl issue tracker](https://github.com/zopefoundation/AccessControl/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-25pc-85qf-6j69
Summary: Deserialization of Untrusted Data in Apache Storm
Aliases: CVE-2018-11779
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-08-01T19:17:53Z

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.
Vulnerability: GHSA-mm57-9j6q-rxm2
Summary: High severity vulnerability that affects com.typesafe.akka:akka-actor_2.11 and com.typesafe.akka:akka-actor_2.12
Aliases: CVE-2017-1000034
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2018-10-22T20:52:38Z

Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.
Vulnerability: GHSA-q759-hwvc-m3jg
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-1855
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
Vulnerability: GHSA-mj9r-wwm8-7q52
Summary: Open Redirect in github.com/AndrewBurian/powermux
Aliases: CVE-2021-32721
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-601
Published: 2021-07-01T17:00:32Z

### Impact
Attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link.

### Patches
The issue is resolved in v1.1.1

### Workarounds
There are no existing workarounds.
You may detect attempts to craft urls that exploit this feature by looking for request paths containing pairs of forward slashes in sequence combined with a trailing slash e.g. `https://example.com//foo/`
Vulnerability: GHSA-w5hr-jm4j-9jvq
Summary: Sandbox escape through template_object in smarty
Aliases: CVE-2021-26119
Severity: HIGH
CVSS score: 7.5
Published: 2021-03-02T02:57:23Z

Sandbox protection could be bypassed through access to an internal Smarty object that should have been blocked. Sites that rely on [Smarty Security features](https://www.smarty.net/docs/en/advanced.features.tpl) should upgrade as soon as possible. Please upgrade to 3.1.39 or higher.
Vulnerability: GHSA-g87r-23vw-7f87
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45719
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:00:21Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free.
Vulnerability: GHSA-ghgj-3xqr-6jfm
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2015-2080
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2018-11-09T17:50:00Z

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Vulnerability: GHSA-f3pg-qwvg-p99c
Summary: Lenient Parsing of Content-Length Header When Prefixed with Plus Sign
Aliases: CVE-2021-32715
Severity: LOW
CVSS score: 3.1
CWE: CWE-444
Published: 2021-07-12T16:54:20Z

### Summary

hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such `Content-Length` headers, but forwards them, can result in "request smuggling" or "desync attacks".

### Vulnerability

The flaw exists in all prior versions of hyper, if built with [`rustc` v1.5.0 or newer](https://github.com/rust-lang/rust/pull/28826/commits/123a83326fb95366e94a3be1a74775df4db97739).

Example:

```
GET / HTTP/1.1
Host: example.com
Content-Length: +3

abc
```

This request gets accepted and hyper reads the body as abc. The request _should_ be rejected, according to RFC 7230, since the ABNF for `Content-Length` only allows for `DIGIT`s. This is due to using the `FromStr` implementation for `u64` in the standard library. By differing from the spec, it is possible to send requests like these to endpoints that have different HTTP implementations, with different interpretations of the payload semantics, and cause "desync attacks".

In this particular case, an upstream proxy would need to error when parsing the `Content-Length`, but _not_ reject the request (swallowing its own error), and forwarding the request as-is with the `Content-Length` still included. _Then_ the upstream proxy and hyper would disagree on the length of the request body. The combination of these factors would be extremely rare.

Read more about desync attacks: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

### Impact

To determine if vulnerable, all these things must be true:

- **Using hyper as an HTTP server**. While the lenient decoder also exists in the client, a vulnerability does not exist around _responses_.
- **Using HTTP/1**. The HTTP/2 code uses a stricter parser.
- **Using a vulnerable HTTP proxy upstream to hyper**. If an upstream proxy correctly rejects the illegal `Content-Length` header, *OR* can parse the length with the plus sign, the desync attack cannot succeed.

### Patches

We have released the following patch versions:

- v0.14.10 (to be released when this advisor is published)

### Workarounds

Besides upgrading hyper, you can take the following options:

- Reject requests manually that contain a plus sign prefix in the `Content-Length` header.
- Ensure any upstream proxy handles `Content-Length` headers with a plus sign prefix.

### Credits
This issue was initially reported by [Mattias Grenfeldt](https://grenfeldt.dev/) and Asta Olofsson.
Vulnerability: GHSA-35c4-f3rq-f9g3
Summary: Moderate severity vulnerability that affects activesupport
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:57:23Z

Withdrawn, accidental duplicate publish.

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Vulnerability: GHSA-gmv4-r438-p67f
Summary: Leading white space bypasses protocol validation
Aliases: CVE-2022-24723
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2022-03-03T19:23:36Z

### Impact
Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.

### Patches
Patched in 1.19.9

### Workarounds
Remove leading whitespace from values before passing them to URI.parse (e.g. via `.href(value)` or `new URI(value)`), e.g. by using

```js
function remove_whitespace(url){
     const whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
     url = url.replace(whitespace, '')
     return url
}
```

### References
* https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [medialize/URI.js](https://github.com/medialize/URI.js/)
Vulnerability: GHSA-m833-jv95-mfjh
Summary: Memory safety violation in crayon
Aliases: CVE-2020-35889
Severity: HIGH
CVSS score: 8.1
CWE: CWE-367
Published: 2021-08-25T20:48:50Z

An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike.
Vulnerability: GHSA-f263-c949-w85g
Summary: Improper Authorization in Google OAuth Client
Aliases: CVE-2020-7692
Severity: HIGH
CVSS score: 7.4
CWE: CWE-862, CWE-863
Published: 2021-09-28T16:16:52Z

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Vulnerability: GHSA-fpjm-rp2g-3r4c
Summary: Django Rest Framework jwt allows obtaining new token from notionally invalidated token
Aliases: CVE-2020-10594
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-287
Published: 2020-06-05T16:09:34Z

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
Vulnerability: GHSA-fcrx-8829-jpqx
Summary: Improper Restriction of XML External Entity Reference in wutka jox
Aliases: CVE-2021-43142
Severity: MODERATE
CVSS score: 0
CWE: CWE-611
Published: 2022-04-01T00:00:45Z

An XML External Entity (XXE) vulnerability exists in wutka jox 1.16 in the readObject method in JOXSAXBeanInput.
Vulnerability: GHSA-ph8p-2g97-9654
Summary: Downloads Resources over HTTP in jstestdriver
Aliases: CVE-2016-10643
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-08-15T19:27:25Z

Affected versions of `jstestdriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jstestdriver`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2011.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-38f9-m297-6q9g
Summary: DoS via malicious record IDs in WatermelonDB
Aliases: CVE-2020-4035
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-89
Published: 2020-06-03T21:57:53Z

## Impact

Medium severity 5.9 https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

A maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the database, generally causing the app to become unusable.

This may happen in apps that don't validate IDs (valid IDs are `/^[a-zA-Z0-9_-.]+$/`) and use Watermelon Sync or low-level `database.adapter.destroyDeletedRecords` method.

The integrity risk is low due to the fact that maliciously deleted records won't synchronize, so logout-login will restore all data, although some local changes may be lost if the malicious deletion causes the sync process to fail to proceed to push stage.

No way to breach confidentiality with this vulnerability is known. Full exploitation of SQL Injection is mitigated, because it's not possible to nest an insert/update query inside a delete query in SQLite, and it's not possible to pass a semicolon-separated second query. There's also no known practicable way to breach confidentiality by selectively deleting records, because those records will not be synchronized.

It's theoretically possible that selective record deletion could cause an app to behave insecurely if lack of a record is used to make security decisions by the app. 

## Patches

Patched versions include:

- 0.15.1
- 0.16.2
- 0.16.1-fix
	- this is actually the same as 0.16.0, but with the patch applied - as 0.16.1 is causing issues for some users
- `924c7ae2a8d` commit id contains the patch

## Workarounds

1. Ensure that your backend service sanitizes record IDs sent in the `pull sync` endpoint, such that only IDs matching `/^[a-zA-Z0-9_-.]+$/` are returned. This could also be done in JavaScript `pullChanges` function passed to `synchronize()`
2. If you use `destroyDeletedRecords` directly, validate all IDs passed the same way

## For more information

If you have any questions about this advisory, contact @radex.