TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-mr6h-chqp-p9g2
Summary: SQL Injection in gogs.io/gogs
Aliases: CVE-2014-8681
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-89
Published: 2021-06-29T18:32:44Z

SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
Vulnerability: GHSA-wvh7-5p38-2qfc
Summary: Storing Password in Local Storage
Severity: MODERATE
CVSS score: 0
CWE: CWE-256
Published: 2020-07-23T18:20:10Z

The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users > Signing Up, it clearly states, "We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext."

Example Code:
```js
async () => {
    const user = Parse.User.current()
    if (user) {
        user.setPassword('newpass')
        await user.save()
    }
}
```
After running the above code, the new password will be stored in localStorage as a property named "password".

Proposed Solution:
Before saving anything to localStorage, Parse should strip out any properties named "password" that are attempting to be stored with a Parse.User type object.

Configuration:
Parse SDK: 2.9.1
Parse Server: 3.9.0
Vulnerability: GHSA-762f-c2wg-m8c8
Summary: Denial of Service in protobufjs
Aliases: CVE-2018-3738
Severity: MODERATE
CVSS score: 0
CWE: CWE-770
Published: 2018-10-09T00:27:15Z

Versions of `protobufjs` before 5.0.3 and 6.8.6 are vulnerable to denial of service when parsing crafted invalid *.proto files.


## Recommendation

Update to version 5.0.3, 6.8.6 or later.
Vulnerability: GHSA-8vmx-qmch-mpqg
Summary: High severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2019-0232
Severity: HIGH
CVSS score: 8.1
CWE: CWE-78
Published: 2019-04-18T14:27:35Z

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
Vulnerability: GHSA-85q4-v37c-wfpc
Summary: Malicious Package in bitcion-ops
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:39:28Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-cqr2-xhg6-p268
Summary: OS Command Injection in node-mpv
Aliases: CVE-2020-7632
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-01-07T00:20:27Z

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Vulnerability: GHSA-2r2v-q399-qq93
Summary: Request injection in Spring Cloud Gateway
Aliases: CVE-2021-22051
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352, CWE-863
Published: 2021-11-10T19:45:02Z

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Vulnerability: GHSA-w7r7-r8r9-vrg2
Summary: Session fixation in change password form
Aliases: CVE-2019-12203
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-384
Published: 2019-11-12T23:01:39Z

SilverStripe through 4.3.3 allows session fixation in the "change password" form.
Vulnerability: GHSA-pj4j-287j-f742
Summary: Cross-site Scripting in Contao
Aliases: CVE-2018-10125
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T20:49:48Z

Contao before 4.5.7 has XSS in the system log.
Vulnerability: GHSA-c7j7-p5jq-26ff
Summary: Low severity vulnerability that affects passenger
Aliases: CVE-2014-1831
Severity: LOW
CVSS score: 0
Published: 2018-10-10T17:29:20Z

Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.
Vulnerability: GHSA-m7mf-48hp-5qmr
Summary: Inappropriate implementation in V8
Aliases: CVE-2020-16009
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2020-12-02T18:28:47Z

CVE-2020-16009: Inappropriate implementation in V8

- https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16009

Google is aware of reports that exploits for CVE-2020-16009 exist in the wild.

Allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

There is currently little to no public information on the issue other than it has been flagged as `High` severity.
Vulnerability: GHSA-hxmr-5gv9-6p8v
Summary: Cross-site Scripting in librenms
Aliases: CVE-2022-0575
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-15T00:02:47Z

Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-fm6q-97gw-c4wh
Summary: Secret exposure in Jenkins HashiCorp Vault Plugin
Aliases: CVE-2022-25186
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-693
Published: 2022-02-16T00:01:28Z

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
Vulnerability: GHSA-v464-rcx7-j875
Summary: Directory Traversal in infraserver
Aliases: CVE-2017-16142
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:48:29Z

Affected versions of `infraserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-g3h8-cg9x-47qw
Summary: PHP Phar archives could be uploaded by Panel users as content files and executed in Kirby
Aliases: CVE-2020-26255
Severity: LOW
CVSS score: 6.8
CWE: CWE-434
Published: 2020-12-08T14:42:08Z

### Impact

An editor with full access to the Kirby Panel can upload a PHP `.phar` file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file.

Visitors without Panel access *cannot* use this attack vector.

### Patches

The problem has been patched in [Kirby 2.5.14](https://github.com/getkirby-v2/panel/releases/tag/2.5.14) and [Kirby 3.4.5](https://github.com/getkirby/kirby/releases/tag/3.4.5). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases/) to fix the vulnerability.

**Note:** Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

### Workarounds

Kirby 2 sites on older releases can also be patched by applying the [changes from this commit](https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881).

### Credits

Thanks to Thore Imhof of Accenture for reporting the problem.
Vulnerability: GHSA-qpwj-mvv7-v3m9
Summary: High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2
Aliases: CVE-2016-4464
Severity: HIGH
CVSS score: 0
CWE: CWE-284
Published: 2018-10-18T16:57:10Z

The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
Vulnerability: GHSA-m38j-pmg3-v5x5
Summary: Timing attack on django-basic-auth-ip-whitelist
Aliases: CVE-2020-4071
Severity: LOW
CVSS score: 2.2
CWE: CWE-208
Published: 2020-06-23T19:58:27Z

### Impact

Potential timing attack exists on websites where the basic authentication is used or configured, i.e. `BASIC_AUTH_LOGIN` and `BASIC_AUTH_PASSWORD` is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located.

Sites protected by IP address whitelisting only are unaffected by this vulnerability.

### Patches
This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package.

### Workarounds
Stop using basic authentication and use the IP whitelisting component only. It can be achieved by not setting `BASIC_AUTH_LOGIN` and `BASIC_AUTH_PASSWORD` in Django project settings.

### References

- [Django mailing list discussion](https://groups.google.com/forum/#!msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue at https://github.com/tm-kn/django-basic-auth-ip-whitelist/issues
* Email us at the email specified on the [security policy](https://github.com/tm-kn/django-basic-auth-ip-whitelist/security/policy).

### Acknowledgements

Thanks to Thibaud Colas for reporting this.
Vulnerability: GHSA-x6jv-5vfg-gm7x
Summary: Path traversal in ServcieCenter
Aliases: CVE-2021-21501
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-09-01T18:35:52Z

Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0.
Vulnerability: GHSA-4rx9-58m7-gr8w
Summary: Malicious Package in css_transform_step
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T19:53:40Z

Version 1.0.6 of `css_transform_step` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.6 of this module is found installed you will want to replace it with a version before or after 1.0.6. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-cvcq-gmc3-q6m8
Summary: Plain text storage of passwords in Apache Airflow
Aliases: CVE-2020-17511
Severity: MODERATE
CVSS score: 0
CWE: CWE-312
Published: 2020-12-17T21:00:56Z

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.
Vulnerability: GHSA-mxr5-mc97-63rc
Summary: Account Takeover in Octobercms
Aliases: CVE-2021-32648
Severity: HIGH
CVSS score: 8.2
CWE: CWE-287
Published: 2021-08-30T16:13:02Z

### Impact

An attacker can request an account password reset and then gain access to the account using a specially crafted request.

- To exploit this vulnerability, an attacker must know the username of an administrator and have access to the password reset form.

### Patches

- Issue has been patched in Build 472 and v1.1.5
- [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648)

### Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[**Update 2022-01-20**] [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648) can be found here.

### Recommendations

We recommend the following steps to make sure your server stays secure:

- Keep server OS and system software up to date.
- Keep October CMS software up to date.
- Use a multi-factor authentication plugin.
- Change the [default backend URL](https://github.com/octobercms/october/blob/1.1/config/cms.php#L39) or block public access to the backend area.
- Include the [Roave/SecurityAdvisories](https://github.com/Roave/SecurityAdvisories) Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

### References

Bugs found as part of Solar Security CMS Research. Credits to:
• Andrey Basarygin
• Andrey Guzei
• Mikhail Khramenkov
• Alexander Sidukov
• Maxim Teplykh

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-9f8f-574q-8jmf
Summary: Manipulation of product reviews via API
Aliases: CVE-2021-37707
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2021-08-30T16:14:00Z

### Impact
Manipulation of product reviews via API

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-cjw5-f2x5-r4q5
Summary: Cross-site Scripting in TastyIgniter
Aliases: CVE-2022-0602
Severity: HIGH
CVSS score: 7.4
CWE: CWE-79
Published: 2022-04-06T00:01:29Z

TastyIgniter prior to version 3.3.0 is vulnerable to Document Object Model (DOM) based Cross-site Scripting (XSS).
Vulnerability: GHSA-6m8p-4fxj-pgc2
Summary: OS Command Injection in mversion
Aliases: CVE-2020-7688
Severity: MODERATE
CVSS score: 7.8
CWE: CWE-78
Published: 2021-05-17T21:01:08Z

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Vulnerability: GHSA-jh5g-9m4v-9vv9
Summary: Insecure Java Deserialization in Apache Karaf
Aliases: CVE-2021-41766
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2022-01-28T22:24:48Z

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).
Vulnerability: GHSA-v2ch-fc8f-qm33
Summary: Use of Uninitialized Resource in bite.
Aliases: CVE-2020-36511
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2022-01-06T22:16:57Z

An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
Vulnerability: GHSA-435c-qcpm-wjw5
Summary: Malicious Package in fs-extar
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:05:43Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-735v-wx75-xmmm
Summary: Cross-site Scripting in grav
Aliases: CVE-2022-0268
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-79
Published: 2022-01-27T18:27:56Z

In grav prior to version 1.7.28, a low privilege user can create a page with arbitrary javascript by bypassing insufficent XSS filtering.
Vulnerability: GHSA-hxwc-5vw9-2w4w
Summary: NoSQL Injection in loopback-connector-mongodb
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2020-09-02T15:52:39Z

Versions of `loopback-connector-mongodb` prior to 3.6.0 are vulnerable to NoSQL Injection. Filters passed to the database query are not properly sanitized which leads to execution of code on the database driver and data leak.


## Recommendation

Upgrade to version 3.6.0 or later.
Vulnerability: GHSA-2xpg-3hx4-fm9r
Summary: Out of bounds read in xcb
Aliases: CVE-2021-26957
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-125
Published: 2021-08-25T20:53:20Z

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.
Vulnerability: GHSA-q35p-chc6-7x57
Summary: Moderate severity vulnerability that affects org.apache.storm:storm-core
Aliases: CVE-2018-1332
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2018-10-17T19:48:18Z

Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another user when communicating with some Storm Daemons.
Vulnerability: GHSA-hwcx-9p4j-7hwj
Summary: XML Entity Expansion in Pippo
Aliases: CVE-2019-5442
Severity: HIGH
CVSS score: 7.5
CWE: CWE-776
Published: 2019-06-13T20:22:30Z

XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.
Vulnerability: GHSA-xhcq-fv7x-grr2
Summary: Critical severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2019-0192
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-03-14T15:39:45Z

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
Vulnerability: GHSA-4fqx-74rv-638w
Summary: SQL Injection
Aliases: CVE-2019-3792
Severity: HIGH
CVSS score: 5.6
CWE: CWE-89
Published: 2022-02-15T01:57:18Z

Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a SQL injection payload to the Concourse server, allowing the attacker to read privileged data.
Vulnerability: GHSA-45j8-pm75-5v8x
Summary: Path Traversal in simplehttpserver
Aliases: CVE-2018-16493
Severity: HIGH
CVSS score: 0
CWE: CWE-548
Published: 2019-02-07T18:18:04Z

Versions of `simplehttpserver` prior to 0.2.1 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 0.2.1 or later.
Vulnerability: GHSA-v2r2-7qm7-jj6v
Summary: Moderate severity vulnerability that affects org.springframework.security:spring-security-core
Aliases: CVE-2019-3795
Severity: MODERATE
CVSS score: 3.8
CWE: CWE-330, CWE-332
Published: 2019-04-16T15:10:59Z

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
Vulnerability: GHSA-4p9g-qgx9-397p
Summary: Denial of Service in Page Error Handling
Aliases: CVE-2021-21359
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-674, CWE-405
Published: 2021-03-23T01:54:09Z

> ### Meta
> * CVSS:  `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C` (5.5)
> * CWE-405, CWE-674
> * Status: **DRAFT**

### Problem
Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content  to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.

### Solution
Update to TYPO3 versions 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Paul Keller, Mathias Bolt Lesniak and Kay Strobach who reported this issue and to TYPO3 framework merger Frank Nägler and to TYPO3 security team member Torben Hansen who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005)
Vulnerability: GHSA-w69w-jvc7-wjgv
Summary: Missing Authorization in undertow
Aliases: CVE-2019-10184
Severity: HIGH
CVSS score: 7.5
CWE: CWE-862
Published: 2019-08-01T19:18:16Z

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Vulnerability: GHSA-65hp-4vxr-c356
Summary: Arbitrary code execution in Magnolia CMS
Aliases: CVE-2021-46363
Severity: HIGH
CVSS score: 7.8
Published: 2022-02-12T00:00:37Z

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted CSV/XLS file.
Vulnerability: GHSA-8c56-cpmw-89x7
Summary: Out-of-bounds read in nokogiri
Aliases: CVE-2017-9050
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2017-12-13T21:38:24Z

libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. This vulnerability exists because of an incomplete fix for CVE-2016-1839.  GitHub is notifying on nokogiri as uses libxml2.
Vulnerability: GHSA-4r64-wf76-c53p
Summary: In blynk-server a Directory Traversal exists
Aliases: CVE-2018-17785
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-10-17T19:52:52Z

In blynk-server in Blynk before 0.39.7, Directory Traversal exists via a ../ in a URI that has /static or /static/js at the beginning, as demonstrated by reading the /etc/passwd file.
Vulnerability: GHSA-68hw-vfh7-xvg8
Summary: Forced Logout in keycloak-connect
Aliases: CVE-2019-10157
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-287, CWE-345
Published: 2019-06-13T20:38:09Z

Versions of `keycloak-connect` prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the `/k_logout` route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.


## Recommendation

Upgrade to version 4.4.0 or later.
Vulnerability: GHSA-2452-3rwv-x89c
Summary: Out-of-bounds write
Aliases: CVE-2019-1298
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:56:01Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1300.
Vulnerability: GHSA-4v4g-726h-xvfv
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime
Aliases: CVE-2021-29445
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-208, CWE-696, CWE-203
Published: 2021-04-19T14:59:06Z

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-q5vh-6whw-x745
Summary: Improper Authorization and Origin Validation Error in OneFuzz
Aliases: CVE-2021-37705
Severity: CRITICAL
CVSS score: 10
CWE: CWE-346, CWE-285
Published: 2021-08-13T20:16:32Z

## Impact

Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance.

To be vulnerable, a OneFuzz deployment must be:
* Version 2.12.0 or greater
* Deployed with the non-default [`--multi_tenant_domain`](https://github.com/microsoft/onefuzz/blob/2.30.0/src/deployment/deploy.py#L1021) option

This can result in read/write access to private data such as:
* Software vulnerability and crash information
* Security testing tools
* Proprietary code and symbols

Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources.

## Patches

This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist.

## Workarounds

Users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.

## References

You can find an overview of the Microsoft Identity Platform [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview).  This vulnerability applies to the multi-tenant application pattern, as described [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant).

## For more information
If you have any questions or comments about this advisory:
* Open an issue in [OneFuzz](https://github.com/microsoft/onefuzz)
* Email us at [fuzzing@microsoft.com](mailto:fuzzing@microsoft.com)
Vulnerability: GHSA-4j54-mxf6-wxx2
Summary: OS Command Injection in pomelo-monitor
Aliases: CVE-2020-7620
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-10T18:37:16Z

pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.
Vulnerability: GHSA-33pp-3763-mrfp
Summary: Moderate severity vulnerability that affects sprockets
Aliases: CVE-2014-7819
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
Vulnerability: GHSA-w6rc-q387-vpgq
Summary: Moderate severity vulnerability that affects passenger
Aliases: CVE-2013-4136
Severity: MODERATE
CVSS score: 0
CWE: CWE-59
Published: 2017-10-24T18:33:37Z

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
Vulnerability: GHSA-mr8h-j9cv-4m8h
Summary: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Aliases: CVE-2021-31408
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-287, CWE-613
Published: 2021-04-22T16:11:17Z

`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

- https://vaadin.com/security/cve-2021-31408
Vulnerability: GHSA-mm7m-xg4h-6m52
Summary: Allocation of Resources Without Limits or Throttling in Apache Tika
Aliases: CVE-2019-10094
Severity: HIGH
CVSS score: 7.8
CWE: CWE-770
Published: 2019-08-06T01:43:35Z

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
Vulnerability: GHSA-99px-7724-484v
Summary: Remote Code Execution in Any23
Aliases: CVE-2021-40146
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-09-13T20:06:38Z

A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.
Vulnerability: GHSA-wcv5-vrvr-3rx2
Summary: Integer Overflow or Wraparound in TensorFlow
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-190
Published: 2022-02-09T23:34:06Z

### Impact
The Grappler component of TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) in [constant folding](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/constant_folding.cc#L963-L1035):

```cc
  for (const auto& output_prop : output_props) {
    const PartialTensorShape output_shape(output_prop.shape());
    // ...
  }
```
  
The `output_prop` tensor has a shape that is controlled by user input and this can result in triggering one of the `CHECK`s in the `PartialTensorShape` constructor. This is an instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197).

### Patches
We have patched the issue in GitHub commit [be7b286d40bc68cb0b56f702186cc4837d508058](https://github.com/tensorflow/tensorflow/commit/be7b286d40bc68cb0b56f702186cc4837d508058).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-878w-7gxp-mc63
Summary: SQL Injection in Spring Cloud Task
Aliases: CVE-2020-5428
Severity: MODERATE
CVSS score: 6
CWE: CWE-89
Published: 2022-02-09T22:16:53Z

In applications using Spring Cloud Task 2.2.4.RELEASE and below, may be vulnerable to SQL injection when exercising certain lookup queries in the TaskExplorer.
Vulnerability: GHSA-6x9x-8qw9-9pp6
Summary: High severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2017-7658
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-444
Published: 2018-10-19T16:16:38Z

In Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Vulnerability: GHSA-48vv-2pmq-9fvv
Summary: Moderate severity vulnerability that affects Plone and Zope2
Aliases: CVE-2012-6661
Severity: MODERATE
CVSS score: 0
CWE: CWE-336
Published: 2018-07-23T19:51:14Z

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors.  NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).
Vulnerability: GHSA-cchx-mfrc-fwqr
Summary: Improper authentication in Symfony
Aliases: CVE-2019-10911
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-287
Published: 2020-02-12T18:45:08Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Vulnerability: GHSA-h39q-95q5-9jfp
Summary: OS Command Injection in ansible
Aliases: CVE-2020-1734
Severity: MODERATE
CVSS score: 7.4
CWE: CWE-78
Published: 2022-02-09T00:11:19Z

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
Vulnerability: GHSA-p6rw-44q7-3fw4
Summary: Stored XSS in Jupyter nbdime
Aliases: CVE-2021-41134
Severity: HIGH
CVSS score: 8.7
CWE: CWE-79
Published: 2021-11-08T18:09:27Z

### Impact

Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.

### Patches

Security patches will be released for each of the major versions of the nbdime packages since version 1.x of the nbdime python package.

#### Python
- nbdime 1.x: Patched in v. 1.1.1
- nbdime 2.x: Patched in v. 2.1.1
- nbdime 3.x: Patched in v. 3.1.1

#### npm
- nbdime 6.x version: Patched in 6.1.2
- nbdime 5.x version: Patched in 5.0.2
- nbdime-jupyterlab 1.x version: Patched in 1.0.1
- nbdime-jupyterlab 2.x version: Patched in 2.1.1

### For more information
If you have any questions or comments about this advisory email us at [security@ipython.org](mailto:security@ipython.org).
Vulnerability: GHSA-36qh-35cm-5w2w
Summary: Authentication Bypass by Alternate Name in Apache Tomcat
Aliases: CVE-2021-30640
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-287, CWE-289
Published: 2021-08-13T15:21:24Z

A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
Vulnerability: GHSA-vhrp-8qx4-vr6c
Summary: Incorrect Access Control in Ignition
Aliases: CVE-2021-43996
Severity: HIGH
CVSS score: 9.8
CWE: CWE-284
Published: 2021-11-19T20:18:20Z

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.
Vulnerability: GHSA-fx95-883v-4q4h
Summary: Path traversal in github.com/valyala/fasthttp
Aliases: CVE-2022-21221
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-03-18T00:01:11Z

The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.
Vulnerability: GHSA-82x2-g7vr-39wq
Summary: Moderate severity vulnerability that affects web-console
Severity: MODERATE
CVSS score: 0
Published: 2018-08-13T20:48:09Z

Withdrawn, accidental duplicate publish.

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Vulnerability: GHSA-m4hg-5p2m-fm5m
Summary: Arbitrary code execution in Magnolia CMS
Aliases: CVE-2021-46361
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-02-12T00:00:37Z

An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
Vulnerability: GHSA-hgpg-593r-hhvp
Summary: Cross-site Scripting in Keycloak
Aliases: CVE-2020-10748
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-09T00:56:37Z

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.
Vulnerability: GHSA-5rwj-j5m3-3chj
Summary: Missing Release of Memory after Effective Lifetime in detect-character-encoding
Aliases: CVE-2021-39176
Severity: HIGH
CVSS score: 7.5
CWE: CWE-401
Published: 2021-09-01T18:25:16Z

### Impact

In detect-character-encoding v0.3.0 and earlier, allocated memory is not released.

### Patches

The problem has been patched in [detect-character-encoding v0.3.1](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1).

### CVSS score

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)

Base Score: 7.5 (High)
Temporal Score: 7.2 (High)

Since detect-character-encoding is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, using detect-character-encoding in a program accessible over the internet which becomes unavailable when running out of memory. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

### Proof of concept

```js
const express = require("express");
const detectCharacterEncoding = require("detect-character-encoding");

const app = express();

app.get("/", (req, res) => {
  detectCharacterEncoding(Buffer.from("foo"));

  res.end();
});

app.listen(3000);
```

`hey -n 1000000 http://localhost:3000` ([`hey`](https://github.com/rakyll/hey)) causes the Node.js process to consume more and more memory.

### References

- https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588
- https://github.com/sonicdoe/detect-character-encoding/pull/6
Vulnerability: GHSA-h3wv-47xm-4mg6
Summary: Moderate severity vulnerability that affects com.kitfox.svg:svg-salamander
Aliases: CVE-2017-5617
Severity: HIGH
CVSS score: 7.4
CWE: CWE-918
Published: 2018-10-19T16:51:25Z

The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
Vulnerability: GHSA-xw37-57qp-9mm4
Summary: Consensus flaw during block processing in github.com/ethereum/go-ethereum
Aliases: CVE-2020-26265
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-682
Published: 2021-06-29T21:14:16Z

### Impact

A consensus-vulnerability in Geth could cause a chain split, where vulnerable versions refuse to accept the canonical chain. 

### Description


A flaw was repoted at 2020-08-11 by John Youngseok Yang (Software Platform Lab), where a particular sequence of transactions could cause a consensus failure.

- Tx 1:
  - `sender` invokes `caller`.
  - `caller` invokes `0xaa`. `0xaa` has 3 wei, does a self-destruct-to-self
  - `caller` does a  `1 wei` -call to `0xaa`, who thereby has 1 wei (the code in `0xaa` still executed, since the tx is still ongoing, but doesn't redo the selfdestruct, it takes a different path if callvalue is non-zero)

- Tx 2:
  - `sender` does a 5-wei call to 0xaa. No exec (since no code). 

In geth, the result would be that `0xaa` had `6 wei`, whereas OE reported (correctly) `5` wei. Furthermore, in geth, if the second tx was not executed, the `0xaa` would be destructed, resulting in `0 wei`. Thus obviously wrong. 

It was determined that the root cause was this [commit](https://github.com/ethereum/go-ethereum/commit/223b950944f494a5b4e0957fd9f92c48b09037ad) from [this PR](https://github.com/ethereum/go-ethereum/pull/19953). The semantics of `createObject` was subtly changd, into returning a non-nil object (with `deleted=true`) where it previously did not if the account had been destructed. This return value caused the new object to inherit the old `balance`:

```golang
func (s *StateDB) CreateAccount(addr common.Address) {
	newObj, prev := s.createObject(addr)
	if prev != nil {
		newObj.setBalance(prev.data.Balance)
	}
}
```

It was determined that the minimal possible correct fix was

```diff
+++ b/core/state/statedb.go
@@ -589,7 +589,10 @@ func (s *StateDB) createObject(addr common.Address) (newobj, prev *stateObject)
                s.journal.append(resetObjectChange{prev: prev, prevdestruct: prevdestruct})
        }
        s.setStateObject(newobj)
-       return newobj, prev
+       if prev != nil && !prev.deleted {
+               return newobj, prev
+       }
+       return newobj, nil
```

### Patches

See above. The fix was included in Geth `v1.9.20` "Paragade".

### Credits

The bug was found by @johnyangk and reported via bounty@ethereum.org.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-62hc-f8qj-5xc3
Summary: Path traversal in Phoenix AutoTest Plugin
Aliases: CVE-2022-28157
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2022-03-30T00:00:22Z

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.
Vulnerability: GHSA-36hf-6hp2-9g4c
Summary: Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms
Aliases: CVE-2019-13237
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200, CWE-22
Published: 2019-11-12T22:58:14Z

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
Vulnerability: GHSA-3gg7-9q2x-79fc
Summary: Improper Restriction of Rendered UI Layers or Frames in Keycloak
Aliases: CVE-2020-1728
Severity: MODERATE
CVSS score: 0
CWE: CWE-1021
Published: 2020-04-15T21:09:40Z

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.
Vulnerability: GHSA-ggq8-j54v-54x8
Summary: Directory Traversal in sspa
Aliases: CVE-2017-16145
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:47:02Z

Affected versions of `sspa` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-2h3j-m7gr-25xj
Summary: Excessive Iteration Denial of Service in Apache PDFBox
Aliases: CVE-2021-27807
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-834
Published: 2021-06-16T17:56:46Z

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Vulnerability: GHSA-h73g-8g27-xxcx
Summary: Command injection in corenlp-js-prefab
Aliases: CVE-2020-28439
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:22:58Z

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.'