TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-f268-65qc-98vg
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Aliases: CVE-2020-13943
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200
Published: 2022-02-09T23:03:53Z

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Vulnerability: GHSA-c57f-4vp2-jqhm
Summary: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-379
Published: 2021-05-06T15:27:04Z

Insecure temporary directory usage in frontend build functionality of `com.vaadin:flow-server` versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

- https://vaadin.com/security/cve-2021-31411
Vulnerability: GHSA-mh7g-99w9-xpjm
Summary: Remote code execution occurs in Apache Solr
Aliases: CVE-2017-12629
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2018-10-17T19:56:17Z

Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr
Vulnerability: GHSA-wpvm-wqr4-p7cw
Summary: Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
Aliases: CVE-2021-26272
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-829
Published: 2021-10-13T15:34:09Z

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Vulnerability: GHSA-xpwp-rq3x-x6v7
Summary: Critical severity vulnerability that affects recurly-api-client
Aliases: CVE-2017-0907
Severity: CRITICAL
CVSS score: 0
CWE: CWE-918
Published: 2018-10-16T17:35:04Z

The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
Vulnerability: GHSA-93q8-gq69-wqmw
Summary:  Inefficient Regular Expression Complexity in chalk/ansi-regex
Aliases: CVE-2021-3807
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1333
Published: 2021-09-20T20:20:09Z

ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-v3cg-h3f6-2242
Summary: Injection in MockServer
Aliases: CVE-2021-32827
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-74
Published: 2021-08-30T16:24:38Z

MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockServer locally, will be able to run arbitrary code on the MockServer machine. With an overly broad default CORS configuration MockServer allows any site to send cross-site requests. Additionally, MockServer allows you to create dynamic expectations using Javascript or Velocity templates. Both engines may allow an attacker to execute arbitrary code on-behalf of MockServer. By combining these two issues (Overly broad CORS configuration + Script injection), an attacker could serve a malicious page so that if a developer running MockServer visits it, they will get compromised. For more details including a PoC see the referenced GHSL-2021-059.
Vulnerability: GHSA-rrfq-g5fq-fc9c
Summary: Moderate severity vulnerability that affects org.apache.hive:hive-exec
Aliases: CVE-2018-11777
Severity: HIGH
CVSS score: 8.1
Published: 2018-11-21T22:25:04Z

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.
Vulnerability: GHSA-p45v-v4pw-77jr
Summary: Division by 0 in `QuantizedBatchNormWithGlobalNormalization`
Aliases: CVE-2021-29548
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:23:34Z

### Impact
An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.QuantizedBatchNormWithGlobalNormalization`:

```python
import tensorflow as tf

t = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.quint8)
t_min = tf.constant(-10.0, dtype=tf.float32)
t_max = tf.constant(-10.0, dtype=tf.float32)
m = tf.constant([], shape=[0], dtype=tf.quint8)
m_min = tf.constant(-10.0, dtype=tf.float32)
m_max = tf.constant(-10.0, dtype=tf.float32)
v = tf.constant([], shape=[0], dtype=tf.quint8)
v_min = tf.constant(-10.0, dtype=tf.float32)
v_max = tf.constant(-10.0, dtype=tf.float32)
beta = tf.constant([], shape=[0], dtype=tf.quint8)
beta_min = tf.constant(-10.0, dtype=tf.float32)
beta_max = tf.constant(-10.0, dtype=tf.float32)
gamma = tf.constant([], shape=[0], dtype=tf.quint8)
gamma_min = tf.constant(-10.0, dtype=tf.float32)
gamma_max = tf.constant(-10.0, dtype=tf.float32)

tf.raw_ops.QuantizedBatchNormWithGlobalNormalization(
  t=t, t_min=t_min, t_max=t_max, m=m, m_min=m_min, m_max=m_max,
  v=v, v_min=v_min, v_max=v_max, beta=beta, beta_min=beta_min,
  beta_max=beta_max, gamma=gamma, gamma_min=gamma_min,
  gamma_max=gamma_max, out_type=tf.qint32,
  variance_epsilon=0.1, scale_after_normalization=True)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/55a97caa9e99c7f37a0bbbeb414dc55553d3ae7f/tensorflow/core/kernels/quantized_batch_norm_op.cc) does not validate all constraints specified in the [op's contract](https://www.tensorflow.org/api_docs/python/tf/raw_ops/QuantizedBatchNormWithGlobalNormalization).

### Patches 
We have patched the issue in GitHub commit [d6ed5bcfe1dcab9e85a4d39931bd18d99018e75b](https://github.com/tensorflow/tensorflow/commit/d6ed5bcfe1dcab9e85a4d39931bd18d99018e75b).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team
Vulnerability: GHSA-r6rj-9ch6-g264
Summary: Prototype pollution in Merge-deep
Aliases: CVE-2021-26707
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-06-07T22:09:26Z

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Vulnerability: GHSA-6qj8-c27w-rp33
Summary: Cross-site scripting in Apache Syncome EndUser
Aliases: CVE-2019-17557
Severity: LOW
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-06T19:38:07Z

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Vulnerability: GHSA-6wqp-v4v6-c87c
Summary: Deserialization of Untrusted Data
Aliases: CVE-2018-12023
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2020-06-15T18:44:51Z

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Vulnerability: GHSA-c94w-c95p-phf8
Summary: Integer overflow in Tensorflow
Aliases: CVE-2022-23575
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-190
Published: 2022-02-10T00:32:59Z

### Impact
The [implementation of `OpLevelCostEstimator::CalculateTensorSize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1552-L1558) is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements:
```cc
int64_t OpLevelCostEstimator::CalculateTensorSize(
    const OpInfo::TensorProperties& tensor, bool* found_unknown_shapes) {
  int64_t count = CalculateTensorElementCount(tensor, found_unknown_shapes);
  int size = DataTypeSize(BaseType(tensor.dtype()));
  VLOG(2) << "Count: " << count << " DataTypeSize: " << size;
  return count * size;
}
```
Here, `count` and `size` can be large enough to cause `count * size` to overflow.

### Patches
We have patched the issue in GitHub commit [fcd18ce3101f245b083b30655c27b239dc72221e](https://github.com/tensorflow/tensorflow/commit/fcd18ce3101f245b083b30655c27b239dc72221e).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-34fr-fhqr-7235
Summary: Information Disclosure in User Authentication
Aliases: CVE-2021-32767
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-532
Published: 2021-07-26T21:16:28Z

> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration.

### Solution
Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)
Vulnerability: GHSA-cmgw-8vpc-rc59
Summary: Segfault on strings tensors with mistmatched dimensions, due to Go code
Aliases: CVE-2021-37692
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2021-08-25T14:38:57Z

### Impact
Under certain conditions, Go code can trigger a segfault in string deallocation.


For string tensors, `C.TF_TString_Dealloc` is called during garbage collection within a finalizer function.  However, tensor structure isn't checked until encoding to avoid a performance penalty.  The current method for dealloc assumes that encoding succeeded, but segfaults when a string tensor is garbage collected whose encoding failed (e.g., due to mismatched dimensions).

To fix this, the call to set the finalizer function is deferred until `NewTensor` returns and, if encoding failed for a string tensor, deallocs are determined based on bytes written.

### Patches
We have patched the issue in GitHub commit [8721ba96e5760c229217b594f6d2ba332beedf22](https://github.com/tensorflow/tensorflow/commit/8721ba96e5760c229217b594f6d2ba332beedf22) (merging [#50508](https://github.com/tensorflow/tensorflow/pull/50508)).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, which is the other affected version.                                                                                                                                               

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [fixing PR](https://github.com/tensorflow/tensorflow/pull/50508).
Vulnerability: GHSA-c4qp-h3m6-785f
Summary: Downloads Resources over HTTP in ibm_db
Aliases: CVE-2016-10577
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:51:59Z

Affected versions of `ibm_db` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-5wqj-f379-6jh4
Summary: Command injection in kill-process-on-port
Aliases: CVE-2020-28426
Severity: HIGH
CVSS score: 7.3
CWE: CWE-77
Published: 2021-03-19T21:19:47Z

All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
Vulnerability: GHSA-wmpm-fq7r-jq56
Summary: Imporoper path validation in elFinder.NetCore
Aliases: CVE-2021-23427
Severity: HIGH
CVSS score: 8.6
CWE: CWE-20
Published: 2021-09-02T22:05:17Z

This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.
Vulnerability: GHSA-9h63-7qf6-mv6r
Summary: Improper Authorization in github.com/containers/libpod
Aliases: CVE-2021-20188
Severity: HIGH
CVSS score: 7
CWE: CWE-863
Published: 2021-05-18T18:33:12Z

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-8q64-wrfr-q48c
Summary: Data races in model
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T20:59:24Z

`Shared` data structure in `model` crate implements `Send` and `Sync` traits regardless of the inner type.
This allows safe Rust code to trigger a data race, which is undefined behavior in Rust.

Users are advised to treat `Shared` as an unsafe type.
It should not be used outside of the testing context,
and care must be taken so that the testing code does not have a data race
besides a race condition that is expected to be caught by the test.

Check [the Rustonomicon](https://doc.rust-lang.org/nomicon/races.html) for the difference between
a data race and a general race condition.
Vulnerability: GHSA-qx3f-p745-w4hr
Summary: Integer overflow in Tensorflow
Aliases: CVE-2022-23562
Severity: HIGH
CVSS score: 7.6
CWE: CWE-190
Published: 2022-02-09T23:54:07Z

### Impact
The implementation of `Range` suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations.

### Patches
We have patched the issue in GitHub commit [f0147751fd5d2ff23251149ebad9af9f03010732](https://github.com/tensorflow/tensorflow/commit/f0147751fd5d2ff23251149ebad9af9f03010732) (merging [#51733](https://github.com/tensorflow/tensorflow/pull/51733)).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/52676).
Vulnerability: GHSA-vxp9-wv2f-wqmw
Summary: High severity vulnerability that affects superset
Aliases: CVE-2018-8021
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-11-09T17:40:56Z

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.
Vulnerability: GHSA-m85c-9mf8-m2m6
Summary: Critical severity vulnerability that affects confire
Aliases: CVE-2017-16763
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-07-18T18:28:26Z

An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from "~/.confire.yaml" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Vulnerability: GHSA-cpf4-wx82-gxp6
Summary: Segfault due to negative splits in `SplitV`
Aliases: CVE-2021-41222
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-682
Published: 2021-11-10T18:48:15Z

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/split_v_op.cc#L49-L205) of `SplitV` can trigger a segfault is an attacker supplies negative arguments:

```python
import tensorflow as tf

tf.raw_ops.SplitV(
  value=tf.constant([]),
  size_splits=[-1, -2]
  ,axis=0,
  num_split=2)
``` 
  
This occurs whenever `size_splits` contains more than one value and at least one value is negative.
  
### Patches 
We have patched the issue in GitHub commit [25d622ffc432acc736b14ca3904177579e733cc6](https://github.com/tensorflow/tensorflow/commit/25d622ffc432acc736b14ca3904177579e733cc6).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-8f93-rv4p-x4jw
Summary: SQL Injection in sql
Severity: MODERATE
CVSS score: 0
CWE: CWE-89
Published: 2019-06-12T16:36:52Z

All versions of `sql` are vulnerable to sql injection as it does not properly escape parameters when building SQL queries.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Vulnerability: GHSA-v6wr-fch2-vm5w
Summary: Moderate severity vulnerability that affects com.orientechnologies:orientdb-studio
Aliases: CVE-2015-2913
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2018-10-18T17:41:27Z

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.
Vulnerability: GHSA-8gv3-3j7f-wg94
Summary: Potential Remote Code Execution vulnerability
Aliases: CVE-2020-15227
Severity: HIGH
CVSS score: 8.7
CWE: CWE-94, CWE-74
Published: 2020-10-02T16:22:19Z

Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. 

Reported by Cyku Hong from DEVCORE (https://devco.re)

### Impact
Code injection, possible remote code execution.

### Patches
Fixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13
Vulnerability: GHSA-m7j4-fhg6-xf5v
Summary: Prototype pollution in datatables.net
Aliases: CVE-2020-28458
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2020-12-17T21:00:50Z

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
Vulnerability: GHSA-26v6-w6fw-rh94
Summary: Apache Camel can allow remote attackers to execute arbitrary commands
Aliases: CVE-2015-5348
Severity: HIGH
CVSS score: 8.1
Published: 2018-10-16T23:12:20Z

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Vulnerability: GHSA-785g-gx74-gr39
Summary: Malicious Package in js-wha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:12:48Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-65mj-7c86-79jf
Summary: Authentication Bypass in ADOdb/ADOdb
Aliases: CVE-2021-3850
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-287, CWE-305
Published: 2022-01-27T15:23:19Z

### Impact

An attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes.

Depending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server's IP address, etc.

### Patches

The vulnerability is fixed in ADOdb versions 5.20.21 (952de6c4273d9b1e91c2b838044f8c2111150c29) and 5.21.4 or later (b4d5ce70034c5aac3a1d51d317d93c037a0938d2).

The simplest patch is to delete line 29 in `drivers/adodb-postgres64.inc.php`:

```php
diff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php
index d04b7f67..729d7141 100644
--- a/drivers/adodb-postgres64.inc.php
+++ b/drivers/adodb-postgres64.inc.php
@@ -26,7 +26,6 @@ function adodb_addslashes($s)
 {
    $len = strlen($s);
    if ($len == 0) return "''";
-   if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted
 
    return "'".addslashes($s)."'";
 }
```

### Workarounds

Ensure the parameters passed to *ADOConnection::connect()* or related functions (_nConnect()_, _pConnect()_) are not surrounded by single quotes.

### Credits

Thanks to **Emmet Leahy** (@meme-lord) of Sorcery Ltd for reporting this vulnerability, and to the [huntr](https://huntr.dev/) team for their support.

### References

- Original issue report https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c/
- ADOdb reference issue #793 

### For more information

If you have any questions or comments about this advisory:
* Add a note in issue #793
* Contact the maintainers on [Gitter](https://gitter.im/adodb/adodb)
Vulnerability: GHSA-6c9x-mj3g-h47x
Summary: Spoofing attack in swagger-ui-dist
Aliases: CVE-2021-46708
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-1021
Published: 2022-03-12T00:00:36Z

The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Vulnerability: GHSA-qrg9-f472-qwfm
Summary: Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Aliases: CVE-2021-31412
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-1295, CWE-668
Published: 2021-06-28T16:55:58Z

Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided.

- https://vaadin.com/security/cve-2021-31412
Vulnerability: GHSA-4f68-49qq-h392
Summary: Improper certificate validation in em-map
Aliases: CVE-2020-13163
Severity: MODERATE
CVSS score: 7.4
CWE: CWE-295
Published: 2021-05-24T18:12:20Z

em-imap 0.5 and earlier use the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
Vulnerability: GHSA-7rp2-fm2h-wchj
Summary: Cross-site Scripting in Django
Aliases: CVE-2019-12308
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-06-10T18:43:25Z

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.
Vulnerability: GHSA-jqjj-r4qp-x2gh
Summary: Use of Uninitialized Resource in messagepack-rs.
Aliases: CVE-2021-45693
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:12:42Z

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
Vulnerability: GHSA-rrrm-qjm4-v8hf
Summary: Inefficient Regular Expression Complexity in marked
Aliases: CVE-2022-21680
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1333
Published: 2022-01-14T21:04:41Z

### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `block.def` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from "marked";

marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)
Vulnerability: GHSA-69p3-xp37-f692
Summary: Improper Certificate Validation in kubeclient
Aliases: CVE-2022-0759
Severity: HIGH
CVSS score: 8.1
CWE: CWE-295
Published: 2022-03-26T00:00:29Z

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
Vulnerability: GHSA-h3mf-4fwp-59c7
Summary: VecStorage Deserialize Allows Violation of Length Invariant
Severity: MODERATE
CVSS score: 0
Published: 2021-08-05T19:58:06Z

The `Deserialize` implementation for `VecStorage` did not maintain the invariant that the number of elements must equal `nrows * ncols`. Deserialization of specially crafted inputs could allow memory access beyond allocation of the vector.

This flaw was introduced in v0.11.0 ([`086e6e`](https://github.com/dimforge/nalgebra/commit/086e6e719f53fecba6dadad2e953a487976387f5)) due to the addition of an automatically derived implementation of `Deserialize` for `MatrixVec`. `MatrixVec` was later renamed to `VecStorage` in v0.16.13 ([`0f66403`](https://github.com/dimforge/nalgebra/commit/0f66403cbbe9eeac15cedd8a906c0d6a3d8841f2)) and continued to use the automatically derived implementation of `Deserialize`.

This flaw was corrected in commit [`5bff536`](https://github.com/dimforge/nalgebra/commit/5bff5368bf38ddfa31416e4ae9897b163031a513) by returning an error during deserialization if the number of elements does not exactly match the expected size.
Vulnerability: GHSA-x6hx-7gh3-3q98
Summary: Prototype Pollution in mootools
Aliases: CVE-2021-23432
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-1321
Published: 2021-09-02T17:09:30Z

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
Vulnerability: GHSA-pjfr-qf3p-3q25
Summary: When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server
Aliases: CVE-2017-12615
Severity: HIGH
CVSS score: 8.1
CWE: CWE-434
Published: 2018-10-17T16:30:31Z

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Vulnerability: GHSA-grfj-wjv9-4f9v
Summary: Open redirect in Jupyter Server
Aliases: CVE-2020-26232
Severity: MODERATE
CVSS score: 4.1
CWE: CWE-601
Published: 2020-11-24T21:20:52Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.

All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.

This originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh

### Patches

_Has the problem been patched? What versions should users upgrade to?_

jupyter_server 1.0.6

### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: zhuonan li of Alibaba Application Security Team
Vulnerability: GHSA-w74j-v8xh-3w5h
Summary: Reference binding to nullptr in unicode encoding
Aliases: CVE-2021-37667
Severity: HIGH
CVSS score: 7.8
CWE: CWE-824
Published: 2021-08-25T14:42:09Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.UnicodeEncode`:

```python
import tensorflow as tf
from tensorflow.python.ops import gen_string_ops

gen_string_ops.unicode_encode(
  input_values=[],
  input_splits=[],
  output_encoding='UTF-8',
  errors='ignore',
  replacement_char='a')
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/unicode_ops.cc#L533-L539) reads the first dimension of the `input_splits` tensor before validating that this tensor is not empty: 

```cc
  const Tensor& input_splits = context->input(1);
  const auto input_splits_flat = input_splits.flat<SPLITS_TYPE>();
  TensorShape output_shape({input_splits.dim_size(0) - 1});
```

### Patches
We have patched the issue in GitHub commit [2e0ee46f1a47675152d3d865797a18358881d7a6](https://github.com/tensorflow/tensorflow/commit/2e0ee46f1a47675152d3d865797a18358881d7a6).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-52r9-g5g6-2hjp
Summary: Path Traversal in node-srv
Aliases: CVE-2018-3714
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-26T14:50:41Z

Versions of `node-srv` before 2.1.1 are vulnerable to path traversal allowing a remote attacker to read files from the server that uses `node-srv`.


## Recommendation

Update to version 2.1.1 or later.
Vulnerability: GHSA-v42f-j8fx-99f3
Summary: Queue<T> should have a Send bound on its Send/Sync traits
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:13Z

Affected versions of this crate unconditionally implements `Send`/`Sync` for `Queue<T>`.

This allows (1) creating data races to a `T: !Sync` and (2) sending `T: !Send` to other threads, resulting in memory corruption or other undefined behavior.
Vulnerability: GHSA-r2x6-vrxx-jgv4
Summary: Data races in multiqueue
Aliases: CVE-2020-36463
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:58:07Z

An issue was discovered in the multiqueue crate through 2020-12-25 for Rust. There are unconditional implementations of Send for InnerSend<RW, T>, InnerRecv<RW, T>, FutInnerSend<RW, T>, and FutInnerRecv<RW, T>.
Vulnerability: GHSA-x9hc-rw35-f44h
Summary: Sandbox Breakout / Arbitrary Code Execution in static-eval
Severity: HIGH
CVSS score: 7.3
CWE: CWE-94
Published: 2020-09-02T15:46:03Z

Versions of `static-eval`prior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

## Proof of concept
```
var evaluate = require('static-eval');
var parse = require('esprima').parse;

var src = process.argv[2];
var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()'
var ast = parse(payload).body[0].expression;
console.log(evaluate(ast, {x:1}));
```


## Recommendation

Upgrade to version 2.0.2 or later.
Vulnerability: GHSA-q2c6-c6pm-g3gh
Summary: Arbitrary Code Execution in handlebars
Severity: HIGH
CVSS score: 0
Published: 2020-09-04T15:07:38Z

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).


## Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.
Vulnerability: GHSA-cfcv-q4qq-2ph4
Summary: CKEditor 4 vulnerabilities in versions <4.16.1
Severity: MODERATE
CVSS score: 0
Published: 2021-08-23T19:42:05Z

Details see: 

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg  ( CVE-2021-32809 )

Patch: 
https://github.com/pimcore/pimcore/pull/10032
Vulnerability: GHSA-5vjc-qx43-r747
Summary: Stored Cross-site Scripting in folder-auth plugin
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-03-18T23:57:52Z

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

See https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2646
Vulnerability: GHSA-xc7v-wxcw-j472
Summary: Memory Exposure in tunnel-agent
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2019-06-03T17:08:26Z

Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Proof-of-concept:
```js
require('request')({
  method: 'GET',
  uri: 'http://www.example.com',
  tunnel: true,
  proxy:{
    protocol: 'http:',
    host:'127.0.0.1',
    port:8080,
    auth:USERSUPPLIEDINPUT // number
  }
});
```


## Recommendation

Update to version 0.6.0 or later.
Vulnerability: GHSA-wxj3-qwv4-cvfm
Summary: Privilege Escalation in Docker
Aliases: CVE-2014-3499
Severity: HIGH
CVSS score: 8.4
CWE: CWE-269
Published: 2022-02-15T00:40:44Z

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.
Vulnerability: GHSA-rfhr-62xp-2fp2
Summary: Open Redirect in trailing-slash
Aliases: CVE-2021-23387
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-601
Published: 2021-06-08T23:19:21Z

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.
Vulnerability: GHSA-f7jg-mcvw-9gwv
Summary: Directory Traversal in reecerver
Aliases: CVE-2017-16188
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:40:40Z

Affected versions of `reecerver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x5jp-9fmm-m9pf
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3683
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-352
Published: 2021-11-15T23:13:52Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-9959-6p3m-wxpc
Summary: Denial of service in Netty
Aliases: CVE-2014-3488
Severity: MODERATE
CVSS score: 0
CWE: CWE-119
Published: 2020-06-30T21:01:31Z

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Vulnerability: GHSA-mm7h-323r-9p4g
Summary: Downloads Resources over HTTP in imageoptim
Aliases: CVE-2016-10596
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:50:33Z

imageoptim is a Node.js wrapper for some images compression algorithms.

imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

No fix is currently available for this vulnerability.

It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-4qwq-q4pr-rr7r
Summary: Vulnerability in packageCmd function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36378
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2021-11-02T15:42:38Z

aaptjs is a node wraper for aapt. An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-4wjq-69rc-8wcp
Summary: Path Traversal in Apache Camel
Aliases: CVE-2019-0194
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-05-02T15:21:34Z

Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
Vulnerability: GHSA-8c5j-9r9f-c6w8
Summary: Information disclosure in Django
Aliases: CVE-2021-45116
Severity: HIGH
CVSS score: 7.5
CWE: CWE-668
Published: 2022-01-12T19:21:10Z

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
Vulnerability: GHSA-qcc4-3rxf-gf4m
Summary: Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Aliases: CVE-2021-33605
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-754
Published: 2021-08-30T16:16:38Z

Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled `Checkbox` inside enabled `CheckboxGroup` component via unspecified vectors.

- https://vaadin.com/security/cve-2021-33605
Vulnerability: GHSA-jg8v-48h5-wgxg
Summary: Prototype Pollution
Aliases: CVE-2021-23413
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-1321
Published: 2021-08-10T16:02:18Z

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance.
Vulnerability: GHSA-8v27-2fg9-7h62
Summary: Withdrawn: Arbitrary Code Execution in static-eval
Aliases: CVE-2021-23334
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-06T16:11:25Z

All versions of package static-eval are vulnerable to Arbitrary Code Execution using FunctionExpressions and TemplateLiterals. PoC: var evaluate = require('static-eval'); var parse = require('esprima').parse; var src="(function (x) { return ${eval("console.log(global.process.mainModule.constructor._load('child_process').execSync('ls').toString())")} })()" var ast = parse(src).body[0].expression; evaluate(ast)

# WITHDRAWN

This was deemed not a vulnerability. See [this issue](https://github.com/browserify/static-eval/issues/34) for details.
Vulnerability: GHSA-ghjx-3jg5-h6r2
Summary: High severity vulnerability that affects mercurial
Aliases: CVE-2017-9462
Severity: HIGH
CVSS score: 8.8
CWE: CWE-732
Published: 2018-07-13T15:17:10Z

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
Vulnerability: GHSA-62ww-4p3p-7fhj
Summary: API information disclosure flaw in Elasticsearch
Aliases: CVE-2021-22135
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-07-02T18:33:02Z

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
Vulnerability: GHSA-955p-rc5h-hg6h
Summary: Double free in arenavec
Aliases: CVE-2021-29931
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:55:04Z

An issue was discovered in the arenavec crate through 2021-01-12 for Rust. A double drop can sometimes occur upon a panic in T::drop().
Vulnerability: GHSA-r5xw-q988-826m
Summary: Remote Memory Exposure in mongoose
Severity: MODERATE
CVSS score: 5.1
CWE: CWE-201
Published: 2020-09-01T19:39:37Z

Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure.

Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database.


## Recommendation

Update to version 4.3.6, 3.8.39 or later.
Vulnerability: GHSA-xj3h-vc9j-j823
Summary: Directory Traversal in nodeaaaaa
Aliases: CVE-2017-16223
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:39:32Z

Affected versions of `nodeaaaaa` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x7p5-p2c9-phvg
Summary: Unexpected database bindings
Severity: HIGH
CVSS score: 7.2
CWE: CWE-74
Published: 2021-02-02T15:47:08Z

This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases.

If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.