TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-g53w-52xc-2j85
Summary: Cross-Site Scripting in react
Aliases: CVE-2013-7035
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2020-09-04T16:52:57Z

Affected versions of `react` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.


## Recommendation

If you are using `react` 0.5.x, upgrade to version 0.5.2 or later.
If you are using `react` 0.4.x, upgrade to version 0.4.2 or later.
Vulnerability: GHSA-fv48-hjhp-94c7
Summary: Incorrect Authorization in TeamPass
Aliases: CVE-2020-12477
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863
Published: 2021-07-26T21:20:38Z

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.
Vulnerability: GHSA-742w-89gc-8m9c
Summary: containerd v1.2.x can be coerced into leaking credentials during image pull
Aliases: CVE-2020-15157
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-522
Published: 2022-02-11T23:27:39Z

## Impact

If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers.

If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account.

The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it.

This vulnerability has been rated by the containerd maintainers as medium, with a CVSS score of 6.1 and a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N.

## Patches

This vulnerability has been fixed in containerd 1.2.14.  containerd 1.3 and later are not affected.

## Workarounds

If you are using containerd 1.3 or later, you are not affected.  If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.  Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.

## Credits

The containerd maintainers would like to thank Brad Geesaman, Josh Larsen, Ian Coldwater, Duffie Cooley, and Rory McCune for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/master/SECURITY.md).
Vulnerability: GHSA-hvv8-336g-rx3m
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-21342
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-502, CWE-918
Published: 2021-03-22T23:28:01Z

### Impact
The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information.  An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21342](https://x-stream.github.io/CVE-2021-21342.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-v47f-vp3p-5j6h
Summary: "Cross-site scripting in ThinkAdmin"
Aliases: CVE-2020-29315
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-05-06T18:53:46Z

"ThinkAdmin version v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML."
Vulnerability: GHSA-c6fm-rgw4-8q73
Summary: Moderate severity vulnerability that affects CoAPthon3
Aliases: CVE-2018-12679
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2019-04-08T15:18:57Z

The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, example collect CoAP server and client) when they receive crafted CoAP messages.
Vulnerability: GHSA-5822-pw57-vv37
Summary: XSS vulnerability when listing users on add & modify server pages.
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-10-08T20:13:19Z

### Impact
An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server.

### Patches
This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release.

### Workarounds
No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed.

### For more information
If you have any questions or comments about this advisory please reach out on Discord, or by emailing `dane` at `pterodactyl` dot `io`.

_Thank you to Sergej for the responsible disclosure of this issue._
Vulnerability: GHSA-gm9x-q798-hmr4
Summary: Command Injection in git-tags-remote
Severity: HIGH
CVSS score: 7.2
CWE: CWE-78
Published: 2020-07-29T14:53:40Z

All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled.  

The following proof-of-concept creates a file in `/tmp`:  
```
const gitTagsRemote = require('git-tags-remote');

gitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo "Injection Success" > /tmp/command-injection.test')
.then(tags => console.log(tags));
```
Vulnerability: GHSA-4q79-fch7-g78q
Summary: Downloads Resources over HTTP in grunt-webdriver-qunit
Aliases: CVE-2016-10606
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:48:11Z

Affected versions of `grunt-webdriver-qunit` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `grunt-webdriver-qunit`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-pmw4-jgxx-pcq9
Summary: File System Bounds Escape
Aliases: CVE-2020-26299
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2021-02-10T18:11:34Z

### Impact

Clients of FTP servers utilizing `ftp-srv` hosted on Windows machines can escape the  FTP user's defined root folder using the expected FTP commands, for example, `CWD` and `UPDR`.

### Background

When windows separators exist within the path (`\`), `path.resolve` leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function.

![Screen Shot 2020-12-15 at 6 42 52 PM](https://user-images.githubusercontent.com/3375444/102293941-5a75fb80-3f05-11eb-9d71-0c190a8dcc75.png)

### Patches
None at the moment.

### Workarounds
There are no workarounds for windows servers. Hosting the server on a different OS mitigates the issue.

### References

Issues: 
https://github.com/autovance/ftp-srv/issues/167
https://github.com/autovance/ftp-srv/issues/225

### For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/autovance/ftp-srv.
Please email us directly; security@autovance.com.
Vulnerability: GHSA-86g5-2wh3-gc9j
Summary: Critical severity vulnerability that affects actionview
Aliases: CVE-2019-5418
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-03-13T17:26:59Z

# File Content Disclosure in Action View

Impact 
------ 
There is a possible file content disclosure vulnerability in Action View. 
Specially crafted accept headers in combination with calls to `render file:` 
can cause arbitrary files on the target server to be rendered, disclosing the 
file contents. 

The impact is limited to calls to `render` which render file contents without 
a specified accept format.  Impacted code in a controller looks something like 
this: 

``` 
class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file" 
  end 
end 
``` 

Rendering templates as opposed to files is not impacted by this vulnerability. 

All users running an affected release should either upgrade or use one of the 
workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are 
available at the normal locations. 

Workarounds 
----------- 
This vulnerability can be mitigated by specifying a format for file rendering, 
like this: 

``` 
class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file", formats: [:html] 
  end 
end 
``` 

In summary, impacted calls to `render` look like this: 

``` 
render file: "#{Rails.root}/some/file" 
``` 

The vulnerability can be mitigated by changing to this: 

``` 
render file: "#{Rails.root}/some/file", formats: [:html] 
``` 

Other calls to `render` are not impacted. 

Alternatively, the following monkey patch can be applied in an initializer: 

``` 
$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end) 
``` 

Credits 
------- 
Thanks to John Hawthorn <john@hawthorn.email> of GitHub
Vulnerability: GHSA-6xg2-cf6h-x4v8
Summary: Malicious Package in buffer-por
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:53:05Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-5fvx-2jj3-6mff
Summary: Insufficiently Protected Credentials in Elasticsearch
Aliases: CVE-2021-22132
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-522
Published: 2021-03-18T19:27:27Z

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Vulnerability: GHSA-8pww-pp5r-rff8
Summary: Path Traversal in marscode
Aliases: CVE-2020-7681
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-07T16:06:03Z

This affects all versionsup to and including version 1.0.1-0 of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.
Vulnerability: GHSA-936x-wgqv-hhgq
Summary: Authenticated path traversal in Umbraco CMS
Aliases: CVE-2020-5811
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2021-04-13T15:51:33Z

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
Vulnerability: GHSA-j7mj-748x-7p78
Summary: DOS attack in Pillow when processing specially crafted image files
Aliases: CVE-2019-16865
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2019-10-22T14:40:42Z

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Vulnerability: GHSA-4hm7-73ch-vm59
Summary: Malicious Package in buffer-8or
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:49:43Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-rfcf-m67m-jcrq
Summary: Authentication granted to all firewalls instead of just one
Aliases: CVE-2021-32693
Severity: HIGH
CVSS score: 6.8
CWE: CWE-287
Published: 2021-06-21T17:03:44Z

Description
-----------

When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application.

Resolution
----------

We now ensure that the authenticated token is only available for the firewall that generates it.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728) for branch 5.3.

Credits
-------

I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien Lamotte for reporting the issue and Wouter J for fixing the issue.
Vulnerability: GHSA-qv8q-v995-72gr
Summary: Validation bypass vulnerability 
Severity: LOW
CVSS score: 0
Published: 2020-09-09T17:29:38Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-hcxx-mp6g-6gr9
Summary: Opencast publishes global system account credentials
Aliases: CVE-2018-16153
Severity: LOW
CVSS score: 0
CWE: CWE-200, CWE-522
Published: 2021-12-14T21:43:48Z

The issue was mostly mitigated before, drastically reducing the risk. See references below for more information.

### Impact

Opencast before version 10.6 will try to authenticate against any external services listed in a media package when it is trying to access the files, sending the global system user's credentials, regardless of the target being part of the Opencast cluster or not.

Previous mitigations already prevented clear text authentications for such requests (e.g. HTTP Basic authentication), but with enough malicious intent, even hashed credentials can be broken.

### Patches

Opencast 10.6 will now send authentication requests only against servers which are part of the Opencast cluster, preventing external services from getting any form of authentication attempt in the first place.

### Workarounds

No workaround available.

### References

- [Patch fixing the issue](https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51)
- [Original security notice](https://groups.google.com/a/opencast.org/g/security-notices/c/XRZzRiqp-NE)
- [Original security mitigation](https://github.com/opencast/opencast/commit/fe8c3d3a60dc5869b468957270dbad5f8c30ead6)

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
- Email us at [security@opencast.org](mailto:security@opencast.org)
Vulnerability: GHSA-gg2g-m5wc-vccq
Summary: Rebuild-bot workflow may allow unauthorised repository modifications
Aliases: CVE-2021-21423
Severity: HIGH
CVSS score: 9.4
CWE: CWE-527
Published: 2021-04-06T18:36:40Z

### Impact

`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository.

The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made).

Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch. 

### Patches

The issue was mitigated in version `0.16.41` of the `projen` tool, which removes the `issue_comment` trigger from this workflow. Version `0.17.0` of projen completely removes the `rebuild-bot.yml` workflow.

### Workarounds

The recommended way to address the vulnerability is to upgrade `projen`. Users who cannot upgrade `projen` may also remove the `.github/workflows/rebuild-bot.yml` file and add it to their `.gitignore` file (via `projenrc.js`) to mitigate the issue.

### References

The `rebuild-bot.yml` workflow managed by `projen` is only one occurrence of a GitHub Workflows mis-configuration, but it may also be present in other workflows not managed by `projen` (either hand-written, or managed by other tools). For more information on this class of issues, the [Keeping your GitHub Actions and workflows secure: Preventing pwn requests][1] article provides a great overview of the problem.
 

[1]: https://securitylab.github.com/research/github-actions-preventing-pwn-requests
Vulnerability: GHSA-j77r-2fxf-5jrw
Summary: Improper path handling in kustomization files allows path traversal
Aliases: CVE-2022-24877
Severity: CRITICAL
CVSS score: 9.9
CWE: CWE-22
Published: 2022-05-04T18:04:07Z

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted `kustomization.yaml` to expose sensitive data from the controller’s pod filesystem. In multi-tenancy deployments this can lead to privilege escalation if the controller's service account has elevated permissions.

Within the affected versions, users with write access to a Flux source are able to use built-in features to expose sensitive data from the controller’s pod filesystem using a malicious `kustomization.yaml` file.

This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce a new Kustomize file system implementation which ensures that all files being handled are contained within the Kustomization working directory, blocking references to any files that do not meet that requirement.

Automated tooling (e.g. conftest) could be employed as a workaround, as part of a user's CI/CD pipeline to ensure that their `kustomization.yaml` files conform with specific policies, blocking access to sensitive path locations.
Vulnerability: GHSA-mcg9-64cp-xwp7
Summary: Server-Side Request Forgery in Hawt Hawtio
Aliases: CVE-2019-9827
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-918
Published: 2019-07-05T21:08:09Z

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
Vulnerability: GHSA-c4w7-xm78-47vh
Summary: Prototype Pollution in y18n
Aliases: CVE-2020-7774
Severity: HIGH
CVSS score: 7.3
CWE: CWE-20, CWE-915
Published: 2021-03-29T16:05:12Z

### Overview

The npm package `y18n` before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. 

### POC

```
const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true
```

### Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.
Vulnerability: GHSA-mv55-23xp-3wp8
Summary: Access control flaw in Kiali
Aliases: CVE-2021-3495
Severity: HIGH
CVSS score: 8.8
CWE: CWE-281
Published: 2021-06-08T20:09:36Z

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-jff3-mwp3-f8cw
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup
Aliases: CVE-2021-21360
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2021-03-09T00:38:31Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Visit the ZMI Security tab at `portal_setup/manage_access` and click on the link _Access contents information_. On the next page, uncheck the box _Also use roles acquired from folders containing this objects_ at the bottom and check the boxes for _Manager_ and _Owner_. Then click on _Save Changes_. Return to the ZMI Security tab at `portal_setup/manage_access` and scroll down to the link _View_. Click on _View_, uncheck the box _Also use roles acquired from folders containing this objects_ at the bottom and check the boxes for _Manager_ and _Owner_. Then click on _Save Changes_. 

### References
_Are there any links users can visit to find out more?_

- [GHSA-jff3-mwp3-f8cw](https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw)
- [Products.GenericSetup on PyPI](https://pypi.org/project/Products.GenericSetup/)
- [Definition of information disclosure at MITRE](https://cwe.mitre.org/data/definitions/200.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Products.GenericSetup issue tracker](https://github.com/zopefoundation/Products.GenericSetup/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-8wgc-jjvv-cv6v
Summary: Improper Authorization in loopback
Severity: HIGH
CVSS score: 0
CWE: CWE-285
Published: 2020-09-02T15:54:52Z

Vulnerable versions of `loopback` may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's `userId`. This will allow the attacker to access the user's data and their privileges.


## Recommendation

For loopback 2.x, upgrade to version 2.40.0 or later
For loopback 3.x, upgrade to version 3.22.0 or later
Vulnerability: GHSA-2r6q-6c8c-g762
Summary: Data races in toolshed
Aliases: CVE-2020-36456
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:58:03Z

An issue was discovered in the toolshed crate through 2020-11-15 for Rust. In CopyCell<T>, the Send trait lacks bounds on the contained type.
Vulnerability: GHSA-79qm-h35f-hr77
Summary: OS Command Injection in compile-sass
Aliases: CVE-2019-10799
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:23:13Z

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function &quot;setupCleanupOnExit(cssPath)&quot; within &quot;dist/index.js&quot; is executed as part of the &quot;rm&quot; command without any sanitization.
Vulnerability: GHSA-588m-9qg5-35pq
Summary: Reverse Tabnabbing in quill
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1022
Published: 2020-09-03T17:19:09Z

Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-r64m-qchj-hrjp
Summary: Webcache Poisoning in shopware/platform and shopware/core
Severity: CRITICAL
CVSS score: 0
CWE: CWE-444
Published: 2021-11-24T20:05:19Z

### Impact
Webcache Poisoning via X-Forwarded-Prefix and sub-request

### Patches
We recommend updating to the current version 6.4.6.1. You can get the update to 6.4.6.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-43gj-mj2w-wh46
Summary: Cross-Site Scripting in TYPO3 CMS Form Engine
Aliases: CVE-2020-11064
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-05-13T23:17:48Z

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML `placeholder` attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-002
Vulnerability: GHSA-h232-fpqx-mqgr
Summary: Malicious Package in log-symboles
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:03:15Z

Version 2.1.0 of `log-symboles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fxp8-7h5w-h235
Summary: XSS in search engine
Aliases: CVE-2019-13234
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-12T22:58:11Z

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
Vulnerability: GHSA-crp2-qrr5-8pq7
Summary: containerd CRI plugin: Insecure handling of image volumes
Aliases: CVE-2022-23648
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-03-02T21:33:17Z

### Impact

A bug was found in containerd where containers launched through containerd’s CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host.  This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information.  Kubernetes and crictl can both be configured to use containerd’s CRI implementation.

### Patches

This bug has been fixed in containerd 1.6.1, 1.5.10 and 1.4.13.  Users should update to these versions to resolve the issue.

### Workarounds

Ensure that only trusted images are used.

### Credits

The containerd project would like to thank Felix Wilhelm of Google Project Zero for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Vulnerability: GHSA-8r8j-xvfj-36f9
Summary: Code injection in ymlref
Aliases: CVE-2018-20133
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2018-12-19T19:25:14Z

ymlref allows code injection.
Vulnerability: GHSA-m57p-p67h-mq74
Summary: Command Injection Vulnerability in systeminformation
Aliases: CVE-2020-26274
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-78
Published: 2020-12-16T19:25:00Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.31.1

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetLatency()

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
Vulnerability: GHSA-6fcr-9h9g-23fq
Summary: Denial of Service in ipfs-bitswap
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2020-09-02T21:50:51Z

Versions of `ipfs-bitswap` prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions.


## Recommendation

Upgrade to version 0.24.1 or later.
Vulnerability: GHSA-w4x9-4f5x-8jj8
Summary: Low severity vulnerability that affects      org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service
Aliases: CVE-2014-0228
Severity: LOW
CVSS score: 0
CWE: CWE-284
Published: 2018-11-21T22:23:29Z

Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
Vulnerability: GHSA-j4mr-9xw3-c9jx
Summary: Out-of-bounds Read in base64-url
Severity: HIGH
CVSS score: 0
CWE: CWE-125
Published: 2019-05-31T23:47:01Z

Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-rp65-9cf3-cjxr
Summary: Inefficient Regular Expression Complexity in nth-check
Aliases: CVE-2021-3803
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-1333
Published: 2021-09-20T20:47:31Z

nth-check is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-c4rh-4376-gff4
Summary: Improper certificate management in AWS IoT Device SDK v2
Aliases: CVE-2021-40830
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-295
Published: 2021-11-24T21:12:04Z

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.
Vulnerability: GHSA-j28r-j54m-gpc4
Summary: Code Injection in SLO Generator
Aliases: CVE-2021-22557
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-94
Published: 2021-10-05T17:53:59Z

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173
Vulnerability: GHSA-w542-cpp9-r3g7
Summary: CSRF in Field Test
Aliases: CVE-2020-16252
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2020-08-05T14:53:34Z

The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods in versions v0.2.0 through v0.3.2.

## Impact
The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods, like basic authentication. Session-based authentication methods (like Devise's default authentication) are not affected.

A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, a single endpoint is affected, which allows for changing the variant assigned to a user.

All users running an affected release should upgrade immediately.

## Technical Details
Field Test uses the `protect_from_forgery` method from Rails to prevent CSRF. However, this defaults to `:null_session`, which has no effect on non-session based authentication methods. This has been changed to `protect_from_forgery with: :exception`.
Vulnerability: GHSA-4vf4-qmvg-mh7h
Summary: Cookie prefix spoofing in CGI
Aliases: CVE-2021-41819
Severity: HIGH
CVSS score: 7.5
CWE: CWE-565
Published: 2022-01-21T23:22:17Z

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
Vulnerability: GHSA-ccgm-3xw4-h5p8
Summary: Improper Restriction of XML External Entity Reference in pikepdf
Aliases: CVE-2021-29421
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2021-04-20T16:30:03Z

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
Vulnerability: GHSA-95hx-62rh-gg96
Summary: Potential XSS injection In PrestaShop contactform
Aliases: CVE-2020-15178
Severity: HIGH
CVSS score: 8
CWE: CWE-79
Published: 2020-09-15T17:34:17Z

### Impact
An attacker is able to inject javascript while using the contact form. 

### Patches
The problem is fixed in v4.3.0

### References
[Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)
Vulnerability: GHSA-v2wx-jj66-2hp7
Summary: Cross-site Scripting in Wildfly
Aliases: CVE-2021-3536
Severity: LOW
CVSS score: 3.8
CWE: CWE-79
Published: 2021-05-25T18:45:05Z

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
Vulnerability: GHSA-vv6j-ww6x-54gx
Summary: Use after free in Animation
Aliases: CVE-2022-0609
Severity: HIGH
CVSS score: 8.8
CWE: CWE-416
Published: 2022-02-22T21:51:19Z

CVE-2022-0609: Use after free in Animation

- https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0609

Google is aware of reports that exploits for CVE-2022-0609 exist in the wild.

The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available.

There is currently little other public information on the issue other than it has been flagged as `High` severity.
Vulnerability: GHSA-4rhm-m2fp-hx7q
Summary: Potential CSV Injection vector in OctoberCMS
Aliases: CVE-2020-5299
Severity: MODERATE
CVSS score: 4
CWE: CWE-77
Published: 2020-06-03T21:58:35Z

### Impact
Any users with the ability to modify any data that could eventually be exported as a CSV file from the `ImportExportController` could potentially introduce a CSV injection into the data to cause the generated CSV export file to be malicious. This requires attackers to achieve the following before a successful attack can be completed: 

1. Have found a vulnerability in the victim's spreadsheet software of choice.
2. Control data that would potentially be exported through the `ImportExportController` by a theoretical victim.
3. Convince the victim to export above data as a CSV and run it in vulnerable spreadsheet software while also bypassing any sanity checks by said software.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/library/commit/c84bf03f506052c848f2fddc05f24be631427a1a & https://github.com/octobercms/october/commit/802d8c8e09a2b342649393edb6d3ceb958851484 to your installation manually if unable to upgrade to Build 466.

### References
Reported by @chrisvidal initially & [Sivanesh Ashok](https://stazot.com/) later.

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
Given the number of hoops that a potential attacker would have to jump through, this vulnerability really boils down to the possibility of abusing the trust that a user may have in the export functionality of the project. Thus, this has been rated low severity as it requires vulnerabilities to also exist in other software used by any potential victims as well as successful social engineering attacks.
Vulnerability: GHSA-2j6v-xpf3-xvrv
Summary: Use of Externally-Controlled Format String in wire-avs
Aliases: CVE-2021-41193
Severity: HIGH
CVSS score: 9.8
CWE: CWE-134
Published: 2022-03-01T18:58:23Z

### Impact
A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.

### Patches
* The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)

### Workarounds
* No workaround known

### References
* Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe

### For more information

If you have any questions or comments about this advisory feel free to email us at [vulnerability-report@wire.com](mailto:vulnerability-report@wire.com)
Vulnerability: GHSA-h5h8-pc6h-jvvx
Summary: Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer
Aliases: CVE-2021-29472
Severity: HIGH
CVSS score: 8.8
CWE: CWE-88, CWE-94
Published: 2021-04-29T21:52:04Z

URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow commands to be executed in the HgDriver if hg/Mercurial is installed on the system.

### Impact
- The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins.
- The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote command injection. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone.
- Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately

### Patches
1.10.22 and 2.0.13 include patches for this issue.
Vulnerability: GHSA-q3gh-5r98-j4h3
Summary: RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign
Aliases: CVE-2020-14968
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2020-06-26T16:26:50Z

### Impact
Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value with prepending zeros as a valid signature.

- If you are not use RSA-PSS signature validation, this vulnerability is not affected. 
- Risk to accept a forged or crafted message to be signed is low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.

### Patches
Users using RSA-PSS signature validation should upgrade to 8.0.17.

### Workarounds
Reject RSA-PSS signatures with unnecessary prepending zeros.

### References
https://github.com/kjur/jsrsasign/security/advisories/GHSA-q3gh-5r98-j4h3
[https://github.com/kjur/jsrsasign/issues/438](https://github.com/kjur/jsrsasign/issues/438)
https://nvd.nist.gov/vuln/detail/CVE-2020-14968
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968
https://vuldb.com/?id.157125
https://kjur.github.io/jsrsasign/api/symbols/RSAKey.html#.verifyWithMessageHashPSS
Vulnerability: GHSA-wp4h-pvgw-5727
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
Aliases: CVE-2019-0230
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-12-02T14:50:51Z

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Vulnerability: GHSA-53qw-q765-4fww
Summary: Denial-of-service in Django
Aliases: CVE-2021-45115
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-01-12T19:20:53Z

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
Vulnerability: GHSA-42qm-c3cf-9wv2
Summary: Code injection in dolibarr/dolibarr
Aliases: CVE-2022-0819
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94
Published: 2022-03-03T00:00:49Z

Improper php function sanitization, lead to an ability to inject arbitrary PHP code and run arbitrary commands on file system. In the function "dol_eval" in file "dolibarr/htdocs/core/lib/functions.lib.php" dangerous PHP functions are sanitized using "str_replace" and can be bypassed using following code in $s parameter
Vulnerability: GHSA-v768-w7m9-2vmm
Summary: Reference binding to nullptr in shape inference
Aliases: CVE-2021-37676
Severity: HIGH
CVSS score: 7.8
CWE: CWE-824
Published: 2021-08-25T14:41:26Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.SparseFillEmptyRows`:

```python
import tensorflow as tf
  
tf.compat.v1.disable_v2_behavior()
tf.raw_ops.SparseFillEmptyRows(
  indices = tf.constant([], shape=[0, 0], dtype=tf.int64),
  values = tf.constant([], shape=[0], dtype=tf.int64),
  dense_shape = tf.constant([], shape=[0], dtype=tf.int64),
  default_value = 0)
```
  
The shape inference [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/ops/sparse_ops.cc#L608-L634) does not validate that the input arguments are not empty tensors.

### Patches 
We have patched the issue in GitHub commit [578e634b4f1c1c684d4b4294f9e5281b2133b3ed](https://github.com/tensorflow/tensorflow/commit/578e634b4f1c1c684d4b4294f9e5281b2133b3ed).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security