TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-xrr9-rh8p-433v
Summary: Request smuggling is possible when both chunked TE and content length specified
Aliases: CVE-2020-5207
Severity: LOW
CVSS score: 5.4
CWE: CWE-444
Published: 2020-01-27T19:28:40Z

### Impact
Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator.

### Patches
https://github.com/ktorio/ktor/pull/1547

### Workarounds
None except migrating to a better proxy.

### References
https://portswigger.net/web-security/request-smuggling
https://tools.ietf.org/html/rfc7230#section-9.5
Vulnerability: GHSA-g8m7-qhv7-9h5x
Summary: Path Traversal in serve-here.js
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-07-05T21:07:14Z

Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-3h99-v4qw-p2h5
Summary: Malicious Package in coinpayment
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:41:56Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m6j4-8r7p-wpp3
Summary: BuddyPress privilege escalation via REST API
Aliases: CVE-2021-21389
Severity: HIGH
CVSS score: 8.1
CWE: CWE-863
Published: 2021-10-06T17:46:55Z

### Impact
It's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the BuddyPress REST API members endpoint.

### Patches
The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

### References
https://buddypress.org/2021/03/buddypress-7-2-1-security-release/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [HackerOne](https://hackerone.com/wordpress)
Vulnerability: GHSA-2gfx-95x2-5v3x
Summary: Heap buffer overflow in `QuantizedReshape`
Aliases: CVE-2021-29536
Severity: LOW
CVSS score: 2.5
CWE: CWE-787
Published: 2021-05-21T14:22:32Z

### Impact
An attacker can cause a heap buffer overflow in `QuantizedReshape` by passing in invalid thresholds for the quantization:

```python
import tensorflow as tf

tensor = tf.constant([], dtype=tf.qint32)
shape = tf.constant([], dtype=tf.int32)
input_min = tf.constant([], dtype=tf.float32)
input_max = tf.constant([], dtype=tf.float32)

tf.raw_ops.QuantizedReshape(tensor=tensor, shape=shape, input_min=input_min, input_max=input_max)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/a324ac84e573fba362a5e53d4e74d5de6729933e/tensorflow/core/kernels/quantized_reshape_op.cc#L38-L55) assumes that the 2 arguments are always valid scalars and tries to access the numeric value directly:

```cc
const auto& input_min_float_tensor = ctx->input(2);
...
const float input_min_float = input_min_float_tensor.flat<float>()(0);
const auto& input_max_float_tensor = ctx->input(3);
...
const float input_max_float = input_max_float_tensor.flat<float>()(0);
```

However, if any of these tensors is empty, then `.flat<T>()` is an empty buffer and accessing the element at position 0 results in overflow.

### Patches
We have patched the issue in GitHub commit [a324ac84e573fba362a5e53d4e74d5de6729933e](https://github.com/tensorflow/tensorflow/commit/a324ac84e573fba362a5e53d4e74d5de6729933e).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-f8rq-m28h-8hxj
Summary: Cross-Site Scripting in htmr
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T15:50:29Z

Versions of `htmr` prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS).  The package uses `innerHTML` to unescape HTML entities. This may lead to [DOM-based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS) through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.8.7 or later.
Vulnerability: GHSA-338v-3958-8v8r
Summary: Information disclosure in JBoss Weld
Aliases: CVE-2014-8122
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2020-06-10T20:54:15Z

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.
Vulnerability: GHSA-76qm-4f93-fg6f
Summary: Improper Input Validation in xdLocalStorage
Aliases: CVE-2015-9545
Severity: MODERATE
CVSS score: 7.1
CWE: CWE-20
Published: 2021-12-09T19:30:29Z

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Vulnerability: GHSA-55m5-whcv-c49c
Summary: Use of Uninitialized Resource in smallvec
Aliases: CVE-2018-25023
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2022-01-06T22:20:28Z

An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.
Vulnerability: GHSA-7qmg-qg53-mrp8
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-12404
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-10-11T18:41:59Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-vhx6-cp8w-295m
Summary: Directory Traversal in serverliujiayi1
Aliases: CVE-2017-16095
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:55:45Z

Affected versions of `serverliujiayi1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-9q3g-m353-cp4p
Summary: Denial of Service in Packetbeat
Aliases: CVE-2017-11480
Severity: HIGH
CVSS score: 7.5
CWE: CWE-404
Published: 2022-02-15T01:57:18Z

Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic.
Vulnerability: GHSA-f523-2f5j-gfcg
Summary: Regular Expression Denial of Service in timespan
Aliases: CVE-2017-16115
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2018-08-29T23:04:14Z

Affected versions of `timespan` are vulnerable to a regular expression denial of service when parsing dates.

The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.


## Recommendation

No direct patch is available for this vulnerability.

Currently, the best available solution is to use a functionally equivalent alternative package.

It is also sufficient to ensure that user input is not being passed into `timespan`, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.
Vulnerability: GHSA-j977-g5vj-j27g
Summary: Cross-Site Scripting in scratch-svg-renderer
Aliases: CVE-2020-7750
Severity: HIGH
CVSS score: 9.6
CWE: CWE-79
Published: 2020-11-09T14:21:17Z

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Vulnerability: GHSA-pm9p-9926-w68m
Summary: Denial of Service in ecstatic
Aliases: CVE-2016-10703
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2017-12-28T22:52:47Z

`ecstatic`, a simple static file server middleware, is vulnerable to denial of service. If a payload with a large number of null bytes (`%00`) is provided by an attacker it can crash ecstatic by running it out of memory.


[Results from the original advisory](https://www.checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package/)

```
A payload of 22kB caused a lag of 1 second,
A payload of 35kB caused a lag of 3 seconds,
A payload of 86kB caused the server to crash
```


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-jppv-gw3r-w3q8
Summary: OS Command Injection in Rake
Aliases: CVE-2020-8130
Severity: MODERATE
CVSS score: 0
CWE: CWE-78
Published: 2020-02-28T16:54:36Z

There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.
Vulnerability: GHSA-q4p3-qw5c-mhpc
Summary: Multiple stored XSS in RBAC Admin screens in Apache Airflow
Aliases: CVE-2020-11983
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-07-27T16:57:25Z

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.
Vulnerability: GHSA-2vqq-jgxx-fxjc
Summary: Malicious Package in motiv.scss
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:24:33Z

Version 0.4.20 of `motiv.scss` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-mgx3-27hr-mfgp
Summary: High severity vulnerability that affects httparty
Aliases: CVE-2013-1801
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:37Z

The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-73jp-3c67-hjfv
Summary: Authentication Bypass in passport-azure-ad
Aliases: CVE-2016-7191
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287
Published: 2018-07-26T15:53:31Z

Affected versions of `passport-azure-ad` do not recognize the `validateIssuer` setting, which allows remote attackers to bypass authentication via a crafted token.


## Recommendation

Version 1.x: Update to version 1.4.6 or later.
Version 2.x: Update to version 2.0.1 or later.
Vulnerability: GHSA-vwrf-r5r4-7775
Summary: Incorrect handling of CORS preflight request headers in hapi
Aliases: CVE-2015-9236
Severity: MODERATE
CVSS score: 0
CWE: CWE-284
Published: 2018-06-07T19:43:25Z

Versions of `hapi` prior to 11.0.0 implement CORS incorrectly, allowing for configurations that at best return inconsistent headers, and at worst allow cross-origin activities that are expected to be forbidden. 

If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.


## Recommendation

Update to version 11.0.0 or later.
Vulnerability: GHSA-558x-2xjg-6232
Summary: Allocation of Resources Without Limits or Throttling in Spring Framework
Aliases: CVE-2022-22950
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-770
Published: 2022-04-03T00:01:00Z

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0 - 5.2.19, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
Vulnerability: GHSA-xgh6-85xh-479p
Summary: Regular Expression Denial of Service in npm-user-validate
Severity: LOW
CVSS score: 0
Published: 2020-10-16T18:56:26Z

`npm-user-validate` before version `1.0.1` is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with `@` characters.

### Impact
The issue affects the `email` function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service.

### Patches
The issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit.

### Workarounds
Restrict the character length to a reasonable degree before passing a value to `.emal()`; Also, consider doing a more rigorous sanitizing/validation beforehand.
Vulnerability: GHSA-6r86-2jm9-9mh4
Summary: File upload restriction bypass in Zenario CMS
Aliases: CVE-2022-23043
Severity: HIGH
CVSS score: 7.2
CWE: CWE-434
Published: 2022-02-25T00:01:07Z

Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.
Vulnerability: GHSA-38vq-cjh5-vw7x
Summary: Malicious Package in nodes.js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:13:41Z

All versions of `nodes.js ` contain malicious code. The package searches and installs globally thousands of packages based on keywords `node`, `react`, `react-native`, `vue`, `angular` and `babel` to fill the system's memory.


## Recommendation

Remove the package from your environment and validate what packages are installed.
Vulnerability: GHSA-pc32-x737-74cv
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0704
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-17T00:00:48Z

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Vulnerability: GHSA-gjhx-gxwx-jx9j
Summary: Cross-Site Scripting in jqtree
Aliases: CVE-2016-1000234
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:35:22Z

Affected versions of `jqtree` are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data. 

When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be executed.


## Recommendation

Update to 1.3.4 or later.
Vulnerability: GHSA-crch-j389-5f84
Summary: Heap OOB write in TFLite
Aliases: CVE-2021-29603
Severity: LOW
CVSS score: 2.5
CWE: CWE-787
Published: 2021-05-21T14:28:15Z

### Impact
A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of [`ArgMin`/`ArgMax`](https://github.com/tensorflow/tensorflow/blob/102b211d892f3abc14f845a72047809b39cc65ab/tensorflow/lite/kernels/arg_min_max.cc#L52-L59):

```cc
TfLiteIntArray* output_dims = TfLiteIntArrayCreate(NumDimensions(input) - 1);
int j = 0;
for (int i = 0; i < NumDimensions(input); ++i) { 
  if (i != axis_value) {
    output_dims->data[j] = SizeOfDimension(input, i);
    ++j;
  }
}
```

If `axis_value` is not a value between 0 and `NumDimensions(input)`, then the condition in the `if` is never true, so code writes past the last valid element of `output_dims->data`.
  
### Patches 
We have patched the issue in GitHub commit [c59c37e7b2d563967da813fa50fe20b21f4da683](https://github.com/tensorflow/tensorflow/commit/c59c37e7b2d563967da813fa50fe20b21f4da683).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-w267-m9c4-8555
Summary: Shopware user session is not logged out if the password is reset via password recovery
Aliases: CVE-2022-24744
Severity: LOW
CVSS score: 2.6
CWE: CWE-613
Published: 2022-03-10T17:37:43Z

### Impact
User session is not logged out if the password is reset via password recovery

## Patches
Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-jxwx-85vp-gvwm
Summary: Regular Expression Denial of Service in jquery-validation
Aliases: CVE-2021-21252
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2021-01-13T18:21:54Z

The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.

The project contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service)

This issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen).
Vulnerability: GHSA-gv9j-4w24-q7vx
Summary: Improper random number generation in github.com/coredns/coredns
Severity: MODERATE
CVSS score: 0
CWE: CWE-330
Published: 2022-03-01T21:03:11Z

### Impact

CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

### Patches
The problem has been fixed in 1.6.6+.

### References
- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)

### For more information
Please consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.
Vulnerability: GHSA-246w-56m2-5899
Summary: Cross-site scripting (XSS) vulnerability in the password reset endpoint
Aliases: CVE-2021-21332
Severity: MODERATE
CVSS score: 6.9
CWE: CWE-79
Published: 2021-03-26T19:52:54Z

### Impact
The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

### Patches
This is fixed in #9200.

### Workarounds
Depending on the needs and configuration of the homeserver a few options are available:

1. Password resets can be disabled by delegating email to a third-party service (via the `account_threepid_delegates.email` setting) or disabling email (by not configuring the `email` setting).

2. If the homeserver is not configured to use passwords (via the `password_config.enabled` setting) then the affected endpoint can be blocked at a reverse proxy:

    * `/_synapse/client/password_reset/email/submit_token`

3. The `password_reset_confirmation.html` template can be overridden with a custom template that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.
Vulnerability: GHSA-qf7v-8hj3-4xw7
Summary: Improper Verification of Cryptographic Signature in PySAML2
Aliases: CVE-2020-5390
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2020-05-06T19:41:29Z

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
Vulnerability: GHSA-9r8w-6x8c-6jr9
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2017-12794
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-04T17:50:34Z

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with "DEBUG = True" (which makes this page accessible) in your production settings.
Vulnerability: GHSA-r8j4-96mx-rjcc
Summary: Improper Restriction of XML External Entity Reference in skylot/jadx
Aliases: CVE-2022-0219
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-611
Published: 2022-01-21T18:13:42Z

skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.
Vulnerability: GHSA-w2pf-g6r8-pg22
Summary: Placeholder property does not indicate HTML capable, could lead to inadvertent abuse
Aliases: CVE-2019-20174
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-01-31T17:59:51Z

## Overview

Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the `additionalSignUpFields` customization option to add a checkbox to the sign-up dialog that are passing a `placeholder` property obtained from an untrusted source (e.g. a query parameter) could allow cross-site scripting (XSS) on their signup pages.

## Am I affected?

You are affected by this vulnerability if all of the following conditions apply:

- You are using Auth0 Lock version 11.20.4 or earlier.
- You pass `additionalSignUpFields` as options when initializing Lock which includes a field of type `checkbox` whose `placeholder` value is obtained from an untrusted source.

An example of a vulnerable snippet is the following where the `placeholder` value is partially user-controlled by the `name` query parameter:

```javascript
<script>
    var params = new URLSearchParams(window.location.search);
    var options = {
        auth: {
            redirectUrl: 'http://localhost:12345/callback',
            responseType: 'code',
            params: {
                scope: 'openid email',
            },
        },
        additionalSignUpFields: [{
            name: 'agree',
            type: 'checkbox',
            placeholder: "I agree to Terms and Conditions for " + params.get('name'),
        }],
    };
    var lock = new Auth0Lock('<CLIENT_ID>', '<TENANT_NAME>.auth0.com', options);
    lock.show({
        allowShowPassword: true,
        initialScreen: 'signUp',
    });
</script>
```

## How to fix that?

Developers using Auth0’s signin solution Lock need to upgrade to version 11.21.0 or later. Version 11.21.0 introduces two changes:

1. The existing `placeholder` property is now treated as plain text to mitigate the problem.
2. A new `placeholderHTML` property is introduced that indicates the level of control it provides and that it should be only supplied from trusted sources.

## Will this update impact my users?

This fix patches the Auth0 Lock widget and may require changes in application code, but it will not impact your users, their current state, or any existing sessions.

Developers using the `placeholder` property with HTML content from a trusted source should start using the `placeholderHTML` property to continue providing the same user experience.
Vulnerability: GHSA-rg4m-gww5-7p47
Summary: Free of uninitialized memory in adtensor
Aliases: CVE-2021-29936
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2021-08-25T20:54:18Z

An issue was discovered in the adtensor crate through 0.0.3 for Rust. There is a drop of uninitialized memory via the FromIterator implementation for Vector and Matrix.
Vulnerability: GHSA-cg48-9hh2-x6mx
Summary: HTML Injection in preact
Severity: MODERATE
CVSS score: 0
CWE: CWE-74
Published: 2020-09-02T18:28:58Z

Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with `JSON.parse()` to be passed directly into JSX without sanitization.


## Recommendation

Upgrade to version 10.0.0-beta.1.
Vulnerability: GHSA-p72p-rjr2-r439
Summary: Server-Side Request Forgery in terriajs-server
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2019-05-29T20:24:02Z

Versions of `terriajs-server`prior to 2.7.4 are vulnerable to Server-Side Request Forgery (SSRF). If an attacker has access to a server whitelisted by the terriajs-server proxy or if the attacker is able to modify the DNS records of a domain whitelisted by the terriajs-server proxy, the attacker can use the terriajs-server proxy to access any HTTP-accessible resources that are accessible to the server, including private resources in the hosting environment.


## Recommendation

Upgrade to version 2.7.4 or later.
Vulnerability: GHSA-hwqf-gcqm-7353
Summary: Header injection in nodemailer
Aliases: CVE-2021-23400
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-74
Published: 2021-12-10T18:56:57Z

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Vulnerability: GHSA-76j4-gggq-7rg9
Summary: SQLinjection in falcon-plus
Aliases: CVE-2022-26245
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-03-28T00:00:20Z

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.
Vulnerability: GHSA-v6rh-hp5x-86rv
Summary: Potential bypass of an upstream access control based on URL paths in Django
Aliases: CVE-2021-44420
Severity: HIGH
CVSS score: 7.3
CWE: CWE-287
Published: 2021-12-09T19:09:37Z

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. This issue has low severity, according to the Django security policy.
Vulnerability: GHSA-hx3r-jv9q-85jw
Summary: Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145)
Aliases: CVE-2018-17145
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-09-10T19:44:58Z

There was an easily exploitable uncontrolled memory resource consumption denial-of-service vulnerability that existed in the peer-to-peer network code of three implementations of Bitcoin and several alternative chains.

For more details please see:
https://invdos.net/

For the paper:
https://invdos.net/paper/CVE-2018-17145.pdf
Vulnerability: GHSA-f884-gm86-cg3q
Summary: PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
Severity: HIGH
CVSS score: 0
Published: 2020-01-07T17:20:47Z

### Impact

We have identified that some ps_facetedsearch module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

### Patches

In the [security patch](https://github.com/PrestaShop/ps_facetedsearch/releases/tag/v3.4.1), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com
Vulnerability: GHSA-7r79-mrp6-8mhq
Summary: Rate limit missing in microweber
Aliases: CVE-2022-0777
Severity: HIGH
CVSS score: 7.5
CWE: CWE-640
Published: 2022-03-02T00:00:19Z

Microweber prior to version 1.3 does not rate limit password reset emails.
Vulnerability: GHSA-6xwr-q98w-rvg7
Summary: Prototype Pollution in nconf
Aliases: CVE-2022-21803
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2022-04-13T00:00:30Z

nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Vulnerability: GHSA-fvc6-qjp7-m4g4
Summary: Arbitrary file upload in Ghost
Aliases: CVE-2022-27139
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2022-04-13T00:00:24Z

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file.
Vulnerability: GHSA-r3j7-x2g5-9gx6
Summary: Command injection in samba-client
Aliases: CVE-2021-27185
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74, CWE-78, CWE-77
Published: 2021-02-11T20:47:27Z

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
Vulnerability: GHSA-4pc3-96mx-wwc8
Summary: Remote code execution in PHPMailer
Aliases: CVE-2016-10045
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2020-03-05T22:09:14Z

### Impact
The `isMail` transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the `mail` command and consequently execute arbitrary code by leveraging improper interaction between the `escapeshellarg` function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

This issue really emphasises that it&#39;s worth avoiding the built-in PHP `mail()` function entirely.

### Patches
Fixed in 5.2.20

### Workarounds
Send via SMTP to localhost instead of calling the `mail()` function.

### References
https://nvd.nist.gov/vuln/detail/CVE-2016-10045
See also https://nvd.nist.gov/vuln/detail/CVE-2016-10033

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-cpcr-74q9-74gp
Summary: Broken Authentication in Atlassian Connect Spring Boot
Aliases: CVE-2021-26074
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-287, CWE-863
Published: 2021-05-10T15:19:04Z

Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3. Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions between 1.1.0 - 2.1.2 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
Vulnerability: GHSA-xcr3-4qvr-54rh
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-1351
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2022-04-15T00:00:45Z

Pimcore prior to version 10.4 is vulnerable to stored cross-site scripting in Tooltip.
Vulnerability: GHSA-869j-5855-hjpm
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf
Aliases: CVE-2019-0191
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2019-03-25T16:16:44Z

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.
Vulnerability: GHSA-xcrm-qpp8-hcw4
Summary: Moderate severity vulnerability that affects org.apache.struts:struts2-rest-plugin
Aliases: CVE-2017-15707
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-20
Published: 2018-10-16T19:35:55Z

In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
Vulnerability: GHSA-9295-mhf3-v33m
Summary: Insecure temporary file in Netflix OSS Hollow
Aliases: CVE-2021-28099
Severity: MODERATE
CVSS score: 0
CWE: CWE-377
Published: 2021-03-29T18:25:26Z

> ID: NFLX-2021-001
> Title: Local information disclosure in Hollow
> Release Date: 2021-03-23
> Credit: Security Researcher @JLLeitschuh

# Overview

Security researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.

# Impact

An attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.

# Description

Since the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.

# Workarounds and Fixes

Avoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.
Vulnerability: GHSA-w7j2-35mf-95p7
Summary: Incorrect check on buffer length in rand_core
Aliases: CVE-2021-27378
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-330
Published: 2021-08-25T20:52:16Z

An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because `read_u32_into` and `read_u64_into` mishandle certain buffer-length checks, a random number generator may be seeded with too little data. The vulnerability was introduced in v0.6.0. The advisory doesn't apply to earlier minor version numbers.
Vulnerability: GHSA-3hw5-q855-g6cw
Summary: Prototype Pollution in Dojox
Aliases: CVE-2020-5259
Severity: LOW
CVSS score: 7.7
CWE: CWE-94
Published: 2020-03-10T18:03:32Z

The Dojox jQuery wrapper `jqMix` mixin method is vulnerable to Prototype Pollution. 

Affected Area:
```
//https://github.com/dojo/dojox/blob/master/jq.js#L442
		var tobj = {};
		for(var x in props){
			// the "tobj" condition avoid copying properties in "props"
			// inherited from Object.prototype.  For example, if obj has a custom
			// toString() method, don't overwrite it with the toString() method
			// that props inherited from Object.prototype
			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
					if(dojo.isArray(props[x])){
						obj[x] = props[x];
					}else{
						obj[x] = jqMix(obj[x], props[x]);
					}
				}else{
					obj[x] = props[x];
				}
```
Vulnerability: GHSA-jmf4-pq78-f8vj
Summary: Moderate severity vulnerability that affects org.apache.hive:hive-jdbc
Aliases: CVE-2018-1314
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2018-11-21T22:24:50Z

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.
Vulnerability: GHSA-4822-jvwx-w47h
Summary: Uncontrolled Resource Consumption in Matrix Synapse
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2022-04-01T18:16:42Z

### Impact

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast).

This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled.

### Patches
1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview.

We recommend upgrading to 1.53.0 to fully resolve the issue.

### Workarounds
Turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.

### References
- Patch (timeout): https://github.com/matrix-org/synapse/pull/11784
- Patch (content type allow list): https://github.com/matrix-org/synapse/pull/11936

### For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Vulnerability: GHSA-p2hm-8725-c8x8
Summary: Downloads Resources over HTTP in cue-sdk-node
Aliases: CVE-2016-10590
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:50:58Z

Affected versions of `cue-sdk-node` insecurely download an executable over an unencrypted HTTP connection. 
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cue-sdk-node`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-mv2r-q4g5-j8q5
Summary: Microsoft.Data.OData Library improperly handles web requests
Aliases: CVE-2018-8269
Severity: HIGH
CVSS score: 7.5
Published: 2018-10-16T19:58:31Z

A denial of service vulnerability exists when OData Library improperly handles web requests, aka "OData Denial of Service Vulnerability." This affects Microsoft.Data.OData.
Vulnerability: GHSA-hgr5-82rc-p936
Summary: Cross-Site Scripting in md-data-table
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T21:24:41Z

All versions of `md-data-table` are vulnerable to cross-site scripting (XSS). This vulnerability is exploitable if an attacker has control over data that is rendered by `mdt-row`


## Recommendation

As there is no fix for this vulnerability at this time we recommend either selecting another package to perform this functionality or properly sanitizing all user data prior to rendering with `md-data-table`
Vulnerability: GHSA-4hpf-3wq7-5rpr
Summary: Regular expression deinal of service (ReDoS) in is-my-json-valid
Aliases: CVE-2018-1107
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-01-06T20:44:07Z

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
Vulnerability: GHSA-fr26-qjc8-mvjx
Summary: Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Severity: MODERATE
CVSS score: 5.3
Published: 2021-10-13T18:56:12Z

Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided.
Vulnerability: GHSA-g39q-f4rm-85x4
Summary: OS Command Injection in baserCMS
Aliases: CVE-2021-20682
Severity: HIGH
CVSS score: 7.2
CWE: CWE-78
Published: 2021-06-08T20:10:37Z

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
Vulnerability: GHSA-rp4x-wxqv-cf9m
Summary: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Aliases: CVE-2019-25027
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-81, CWE-79
Published: 2021-04-19T14:52:29Z

Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

- https://vaadin.com/security/cve-2019-25027
Vulnerability: GHSA-x8wj-6m73-gfqp
Summary: Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle
Aliases: CVE-2020-5237
Severity: HIGH
CVSS score: 8.8
CWE: CWE-23, CWE-22
Published: 2020-02-18T18:59:24Z

### Impact
The vulnerability was identified in the web service for a chunked file
upload. While the names of the POST parameters vary with the used
frontend, their values are always used in the same way to build a path
where the chunks are stored and assembled temporarily. By not validating
these parameters properly, OneupUploaderBundle is susceptible to a path
traversal vulnerability which can be exploited to upload files to
arbitrary folders on the filesystem. The assembly process can further be
misused with some restrictions to delete and copy files to other
locations.

The vulnerability can be exploited by any users that have legitimate
access to the upload functionality and can lead to arbitrary code
execution, denial of service and disclosure of confidential information.

### Patches
Yes, see version 1.9.3 and 2.1.5.

### References
https://owasp.org/www-community/attacks/Path_Traversal

### Credits:
This security vulnerability was found by Thibaud Kehler of SySS GmbH.
E-Mail: thibaud.kehler@syss.de
Vulnerability: GHSA-r8hx-3qx6-hxq9
Summary: Malicious Package in commandre
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:41:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-jcxc-rh6w-wf49
Summary: Link Following in Iris
Aliases: CVE-2021-23772
Severity: HIGH
CVSS score: 7.5
CWE: CWE-59
Published: 2022-01-06T21:36:19Z

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
Vulnerability: GHSA-qmv4-jgp7-mf68
Summary: Broken CORS in sails
Aliases: CVE-2016-10549
Severity: HIGH
CVSS score: 0
CWE: CWE-284
Published: 2019-02-18T23:40:10Z

Affected versions of `sails` have an issue with the CORS configuration where the value of the origin header is reflected as the value for the `Access-Control-Allow-Origin` header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. 

## Mitigating Factors

This is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. 

The problem can be compounded when the cors `credentials` setting is not provided, because at that point authenticated cross domain requests are possible.


## Recommendation

Update to version 0.12.7 or later.

As this vulnerability is primarily a user error, the patch for the vulnerability will simply cause the application to write an error message to the console when a vulnerable configuration is used in a production environment.

Writing a proper CORS configuration is still the responsibility of the user, so it is necessary to check for the error message after installing the patch. Be sure you are not using `allRoutes: true` with `origin:'*'`, and that you uncomment `origin` and set it to a reasonable value. Ensure that if `origin` is set to `*` that you truly mean for all other websites to be able to make cross-domain requests to your API.

Likewise, ensure `credentials` is uncommented out and set to the appropriate value. Make sure to explicitly set which origins may request resources via CORS.
Vulnerability: GHSA-45xm-v8gq-7jqx
Summary: Excessive memory allocation
Aliases: CVE-2018-12541
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-119, CWE-789
Published: 2018-10-17T16:19:59Z

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.