TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-qpg4-4w7w-2mq5
Summary: Authentication and extension bypass in Faye
Aliases: CVE-2020-11020
Severity: HIGH
CVSS score: 8.5
CWE: CWE-287
Published: 2020-04-29T17:41:15Z

On 20 April 2020 it was reported to me that the potential for authentication
bypass exists in [Faye][1]'s extension system. This vulnerability has existed in
the Node.js and Ruby versions of the server since version 0.5.0, when extensions
were first introduced, in July 2010. It is patched in versions 1.0.4, 1.1.3 and
1.2.5, which we are releasing today.

The vulnerability allows any client to bypass checks put in place by server-side
extensions, by appending extra segments to the message channel. For example, the
Faye [extension docs][2] suggest that users implement access control for
subscriptions by checking incoming messages for the `/meta/subscribe` channel,
for example:

```js
server.addExtension({
  incoming: function(message, callback) {
    if (message.channel === '/meta/subscribe') {
      if (message.ext.authToken !== 'my super secret password') {
        message.error = 'Invalid auth token';
      }
    }
    callback(message);
  }
});
```

A bug in the server's code for recognising the special `/meta/*` channels, which
trigger connection and subscription events, means that a client can bypass this
check by sending a message to `/meta/subscribe/x` rather than `/meta/subscribe`:

```json
{
  "channel": "/meta/subscribe/x",
  "clientId": "3jrc6602npj4gyp6bn5ap2wqzjtb2q3",
  "subscription": "/foo"
}
```

This message will not be checked by the above extension, as it checks the
message's channel is exactly equal to `/meta/subscribe`. But it will still be
processed as a subscription request by the server, so the client becomes
subscribed to the channel `/foo` without supplying the necessary credentials.

The vulnerability is caused by the way the Faye server recognises meta channels.
It will treat a message to any channel that's a prefix-match for one of the
special channels `/meta/handshake`, `/meta/connect`, `/meta/subscribe`,
`/meta/unsubscribe` or `/meta/disconnect`, as though it were an exact match for
that channel. So, a message to `/meta/subscribe/x` is still processed as a
subscription request, for example.

An authentication bypass for subscription requests is the most serious effect of
this but all other meta channels are susceptible to similar manipulation.

This parsing bug in the server is fixed in versions 1.0.4, 1.1.3 and 1.2.5.
These should be drop-in replacements for prior versions and you should upgrade
immediately if you are running any prior version.

If you are unable to install one of these versions, you can make your extensions
catch all messages the server would process by checking the channel _begins_
with the expected channel name, for example:

```js
server.addExtension({
  incoming: function(message, callback) {
    if (message.channel.startsWith('/meta/subscribe')) {
      // authentication logic
    }
    callback(message);
  }
});
```

[1]: https://faye.jcoglan.com/
[2]: https://faye.jcoglan.com/node/extensions.html
Vulnerability: GHSA-h6q6-9hqw-rwfv
Summary: Misinterpretation of malicious XML input
Aliases: CVE-2021-21366
Severity: LOW
CVSS score: 0
CWE: CWE-115, CWE-436
Published: 2021-03-12T22:39:39Z

### Impact

xmldom versions 0.4.0 and older do not correctly preserve [system identifiers](https://www.w3.org/TR/2008/REC-xml-20081126/#d0e4313), [FPIs](https://en.wikipedia.org/wiki/Formal_Public_Identifier) or [namespaces](https://www.w3.org/TR/xml-names11/) when repeatedly parsing and serializing maliciously crafted documents.

This may lead to unexpected syntactic changes during XML processing in some downstream applications.

### Patches

Update to 0.5.0 (once it is released)

### Workarounds

Downstream applications can validate the input and reject the maliciously crafted documents.

### References

Similar to this one reported on the Go standard library:

- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`xmldom/xmldom`](https://github.com/xmldom/xmldom)
* Email us: send an email to **all** addresses that are shown by `npm owner ls xmldom`
Vulnerability: GHSA-74cv-f58x-f9wf
Summary: XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
Aliases: CVE-2021-21343
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-502, CWE-73
Published: 2021-03-22T23:28:13Z

### Impact
The processed stream at unmarshalling time contains type information to recreate the formerly written objects.  XStream creates therefore new instances based on these type information.  An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21343](https://x-stream.github.io/CVE-2021-21343.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-85p9-j7c9-v4gr
Summary: Insufficiently Protected Credentials
Aliases: CVE-2019-10214
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-522
Published: 2022-02-15T01:57:18Z

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
Vulnerability: GHSA-wmj9-xh24-j4gx
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0558
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-11T00:00:47Z

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-29gp-92wp-94q8
Summary: Remote Code Execution in react-dev-utils
Aliases: CVE-2018-6342
Severity: HIGH
CVSS score: 0
CWE: CWE-78
Published: 2019-01-04T17:41:20Z

`react-dev-utils` on Windows is vulnerable to remote code execution.


## Recommendation

Update to one of the follow versions, depending on the release line that you are using.
- 1.0.4
- 2.0.2
- 3.1.2
- 4.2.2
- 5.0.2
- 6.0.0-next.a671462c
Vulnerability: GHSA-m9r7-q9fc-qwx5
Summary: Malicious Package in maybemaliciouspackage
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:22:24Z

All versions of `maybemaliciouspackage` contain malicious code. The package prints the system's SSH keys to the console as a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.
Vulnerability: GHSA-6c7v-2f49-8h26
Summary: Cleartext Transmission of Sensitive Information in Django
Aliases: CVE-2019-12781
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-319
Published: 2019-07-03T20:37:25Z

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
Vulnerability: GHSA-683w-6h9j-57wq
Summary: Moderate severity vulnerability that affects org.owasp.antisamy:antisamy
Aliases: CVE-2016-10006
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-18T17:21:47Z

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
Vulnerability: GHSA-hqv3-qq72-78cv
Summary: Directory Traversal in startserver
Aliases: CVE-2021-23430
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-09-02T17:09:40Z

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.
Vulnerability: GHSA-jxqq-cqm6-pfq9
Summary: Regular Expression Denial of Service in slug
Aliases: CVE-2017-16117
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:06:45Z

Affected versions of `slug` are vulnerable to a regular expression denial of service when parsing untrusted user input.

The issue is low severity, as it takes 50,000 characters to cause the event loop to block for 2 seconds,

About 50k characters can block the event loop for 2 seconds.


## Recommendation

Update to version 0.9.2 or later.
Vulnerability: GHSA-g87g-4x3w-f8jp
Summary: Directory Traversal in serverwzl
Aliases: CVE-2017-16105
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:51:28Z

Affected versions of `serverwzl` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-mg5p-95m9-rmfp
Summary: Arbitrary file write in actionpack-page_caching gem
Aliases: CVE-2020-8159
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2020-05-13T16:28:46Z

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.
Vulnerability: GHSA-qxrj-x7rm-2h49
Summary: Malicious Package in dhkey
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:05:59Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-pc3m-v286-2jwj
Summary: Moderate severity vulnerability that affects actionview
Aliases: CVE-2016-6316
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:35Z

Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Vulnerability: GHSA-8c6g-4xc5-w96c
Summary: Uninitialized memory exposure in claxon
Aliases: CVE-2018-20992
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-908
Published: 2021-08-25T20:43:52Z

An issue was discovered in the claxon crate before 0.4.1 for Rust. Uninitialized memory can be exposed because certain decode buffer sizes are mishandled.
Vulnerability: GHSA-q492-f7gr-27rp
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow
Aliases: CVE-2018-10055
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119
Published: 2019-04-30T15:37:31Z

Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
Vulnerability: GHSA-pq37-4c4g-v38c
Summary: Cross-site Scripting in vditor
Aliases: CVE-2022-0341
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-15T00:01:02Z

vditor prior to version 3.8.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-jh6m-3pqw-242h
Summary: Authentication Bypass by Primary Weakness in keycloak
Aliases: CVE-2020-14359
Severity: HIGH
CVSS score: 7.3
CWE: CWE-305
Published: 2022-02-09T00:56:04Z

A vulnerability was found in all versions of keycloak, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
Vulnerability: GHSA-4j54-mmmv-hjpm
Summary: Malicious Package in slush-fullstack-framework
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:17:51Z

Version 0.9.2 of `slush-fullstack-framework` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qf8x-vqjv-92gr
Summary: Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter 
Aliases: CVE-2022-24901
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-295
Published: 2022-05-04T18:59:46Z

Weak validation of the Apple certificate URL in the Apple Game Center authentication adapter allows to bypass authentication and makes the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
Vulnerability: GHSA-pv6r-vchh-cxg9
Summary: Denial of Service in apostrophe
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2020-09-03T20:42:09Z

Versions of `apostrophe` prior to 2.97.1 are vulnerable to Denial of Service. The `apostrophe-jobs` module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.


## Recommendation

Upgrade to version 2.97.1 or later.
Vulnerability: GHSA-9p8q-j6q5-mjw8
Summary: Buffer Overflow in galois_2p8
Aliases: CVE-2022-24988
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-120
Published: 2022-02-15T00:02:45Z

In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.
Vulnerability: GHSA-vp5x-3v8r-qprw
Summary: Deserialization of Untrusted Data in Dubbo
Aliases: CVE-2021-43297
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-01-12T22:51:04Z

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Vulnerability: GHSA-j57w-3c39-gpp5
Summary: Improper Privilege Management in Snipe-IT
Aliases: CVE-2022-0611
Severity: HIGH
CVSS score: 8.8
CWE: CWE-269
Published: 2022-02-17T00:00:35Z

An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.
Vulnerability: GHSA-jhq9-wm9m-cf89
Summary: CHECK-failure in `UnsortedSegmentJoin`
Aliases: CVE-2021-29552
Severity: LOW
CVSS score: 2.5
CWE: CWE-617
Published: 2021-05-21T14:23:48Z

### Impact
An attacker can cause a denial of service by controlling the values of `num_segments` tensor argument for `UnsortedSegmentJoin`:

```python
import tensorflow as tf

inputs = tf.constant([], dtype=tf.string)
segment_ids = tf.constant([], dtype=tf.int32)
num_segments = tf.constant([], dtype=tf.int32)
separator = ''

tf.raw_ops.UnsortedSegmentJoin(
  inputs=inputs, segment_ids=segment_ids,
  num_segments=num_segments, separator=separator)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/a2a607db15c7cd01d754d37e5448d72a13491bdb/tensorflow/core/kernels/unsorted_segment_join_op.cc#L92-L93) assumes that the `num_segments` tensor is a valid scalar:

```cc
const Tensor& num_segments_tensor = context->input(2);
auto num_segments = num_segments_tensor.scalar<NUM_SEGMENTS_TYPE>()();
```

Since the tensor is empty the `CHECK` involved in `.scalar<T>()()` that checks that the number of elements is exactly 1 will be invalidated and this would result in process termination.

### Patches
We have patched the issue in GitHub commit [704866eabe03a9aeda044ec91a8d0c83fc1ebdbe](https://github.com/tensorflow/tensorflow/commit/704866eabe03a9aeda044ec91a8d0c83fc1ebdbe).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-238x-q7xf-p4xw
Summary: Downloads Resources over HTTP in arrayfire-js
Aliases: CVE-2016-10598
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:50:32Z

Affected versions of `arrayfire-js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `arrayfire-js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-8474-rc7c-wrhp
Summary: High severity vulnerability that affects safemode
Severity: HIGH
CVSS score: 0
Published: 2018-08-08T22:29:10Z

Withdrawn, accidental duplicate publish.

The safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
Vulnerability: GHSA-fxwm-rx68-p5vx
Summary: XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-12-01T18:28:29Z

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Vulnerability: GHSA-98gj-wwxm-cj3h
Summary: Moderate severity vulnerability that affects mistune
Aliases: CVE-2017-16876
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-04T17:47:50Z

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
Vulnerability: GHSA-m8xj-5v73-3hh8
Summary: curlrequest allows execution of arbitrary commands
Aliases: CVE-2020-7646
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-05-13T16:29:43Z

curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the `options` values.
Vulnerability: GHSA-2v5j-q74q-r53f
Summary: django-helpdesk is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3994
Severity: HIGH
CVSS score: 8.8
CWE: CWE-79
Published: 2021-12-03T20:42:26Z

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-mj2c-5mjv-gmmj
Summary: SQL Injection in Pimcore
Aliases: CVE-2022-1339
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2022-04-14T00:00:19Z

Pimcore prior to version 10.3.5 is vulnerable to SQL injection in ElementController.php. This vulnerability causes loss of data confidentiality.
Vulnerability: GHSA-gm9g-2g8v-fvxj
Summary: Prototype Pollution in upmerge
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-400, CWE-345
Published: 2019-06-06T15:32:28Z

All versions of `upmerge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-9cw2-jqp5-7x39
Summary: Multiple Content Injection Vulnerabilities in marked
Aliases: CVE-2014-3743
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-08-31T22:52:52Z

Versions 0.3.0 and earlier of `marked` are affected by two cross-site scripting vulnerabilities, even when `sanitize: true` is set.

The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.


## Recommendation

Upgrade to version 0.3.1 or later.
Vulnerability: GHSA-27v7-qhfv-rqq8
Summary: Insecure Credential Storage in web3
Severity: LOW
CVSS score: 3.3
Published: 2019-05-30T17:26:30Z

All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this vulnerability likely requires a Cross-Site Scripting vulnerability to access the private key.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-86wm-rrjm-8wh8
Summary: Buffer not correctly recycled in Gzip Request inflation
Aliases: CVE-2020-27218
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-226
Published: 2020-12-02T18:28:18Z

### Impact
If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection and if an 
attacker can send a request with a body that is received entirely by not consumed by the application, then a subsequent request
on the same connection will see that body prepended to it's body.

The attacker will not see any data, but may inject data into the body of the subsequent request

CVE score is [4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L&version=3.1)

### Workarounds
The problem can be worked around by either:
- Disabling compressed request body inflation by GzipHandler.
- By always fully consuming the request content before sending a response.
- By adding a `Connection: close` to any response where the servlet does not fully consume request content.
Vulnerability: GHSA-jxhw-mg8m-2pj8
Summary: Moderate severity vulnerability that affects devise
Aliases: CVE-2013-0233
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:37Z

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Vulnerability: GHSA-j33j-fg2g-mcv2
Summary: Cross-Site Request Forgery in CakePHP
Aliases: CVE-2020-15400
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352, CWE-79
Published: 2022-02-10T22:27:58Z

CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
Vulnerability: GHSA-pxcc-hj8w-fmm7
Summary: Command injection vulnerability in @prisma/sdk in getPackedPackage function
Aliases: CVE-2021-21414
Severity: HIGH
CVSS score: 7.7
CWE: CWE-78
Published: 2021-04-06T17:25:12Z

### Impact

As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who are affected by this security vulnerability.

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

It only affects the `getPackedPackage` function and this function is not advertised and only used for tests & building our CLI, no malicious code was found after checking our codebase.

### Patches

Fixed in 
- @prisma/sdk@2.20.0 (latest channel)
- @prisma/sdk@2.20.0-dev.29 (dev channel)

Pull Request closing this vulnerability [https://github.com/prisma/prisma/pull/6245](https://github.com/prisma/prisma/pull/6245)

### Acknowledgements

This issue was discovered and reported by GitHub Engineer [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).

### For more information

If you have any questions or comments about this advisory:

- Create a discussion in [the Prisma repository](https://github.com/prisma/prisma/discussions)
- Email us at security@prisma.io
Vulnerability: GHSA-663j-rjcr-789f
Summary: CSV injection in shuup
Aliases: CVE-2021-25962
Severity: HIGH
CVSS score: 8
CWE: CWE-1236
Published: 2021-09-30T20:50:07Z

“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.
Vulnerability: GHSA-6pqm-xvfc-w7p4
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3993
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2021-12-03T20:42:35Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-7f42-p84j-f58p
Summary: Moderate severity vulnerability that affects sanitize
Aliases: CVE-2018-3740
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-03-21T11:56:32Z

When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.

This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.
Vulnerability: GHSA-73v8-v6g4-vrpm
Summary: Arbitrary File Overwrite in decompress-zip
Severity: HIGH
CVSS score: 0
Published: 2020-09-02T15:58:13Z

Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.



## Recommendation

For `decompress-zip` 0.2.x upgrade to 0.2.2 or later.
For `decompress-zip` 0.3.x upgrade to 0.3.2 or later.
Vulnerability: GHSA-8pp6-8x4q-c5mx
Summary: Server side request forgery in C1 CMS
Aliases: CVE-2022-24789
Severity: HIGH
CVSS score: 7.6
CWE: CWE-918
Published: 2022-03-30T00:00:31Z

C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist.
Vulnerability: GHSA-q9h2-4xhf-23xx
Summary: Data races in im
Aliases: CVE-2020-36204
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-662
Published: 2021-08-25T20:51:36Z

An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
Vulnerability: GHSA-v8j6-6c2r-r27c
Summary: Expression Language Injection in Apache Struts
Aliases: CVE-2021-31805
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-917
Published: 2022-04-13T00:00:30Z

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
Vulnerability: GHSA-23x4-m842-fmwf
Summary: Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator
Aliases: CVE-2021-21428
Severity: HIGH
CVSS score: 9.3
CWE: CWE-379, CWE-378, CWE-377, CWE-269
Published: 2021-05-11T00:04:40Z

### Impact

On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory.

This vulnerability is local privilege escalation because the contents of the outputFolder can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled.

openapi-generator-online creates insecure temporary folders with `File.createTempFile` during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system.

### Vulnerable Code

https://github.com/OpenAPITools/openapi-generator/blob/c6530519975341d7784a252132b2f0854f488901/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java#L184-L187

This vulnerability exists due to a race condition between the deletion of the randomly generated temporary file and the creation of the temporary directory.

```java
File outputFolder = File.createTempFile("codegen-", "-tmp"); // Attacker knows the full path of the file that will be generated
// delete the file that was created
outputFolder.delete(); // Attacker sees file is deleted and begins a race to create their own directory before the code generator
// and make a directory of the same name
// SECURITY VULNERABILITY: Race Condition! - Attacker beats the code generator and now owns this directory
outputFolder.mkdir();
```

### Patches
The issue has been patched by changing the underlying logic to use `Files.createTempFile` and has been released in the v5.1.0 stable version.

This vulnerability has the same root cause as CVE-2021-21363 from the `swagger-api/swagger-codegen` project as this project and that one both share the same original source tree.
See: https://github.com/swagger-api/swagger-codegen/security/advisories/GHSA-pc22-3g76-gm6j

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [OpenAPI Generator Github repo](https://github.com/openAPITools/openapi-generator/)
* Email us at [security@openapitools.org](mailto:security@openapitools.org)
Vulnerability: GHSA-79jw-6wg7-r9g4
Summary: Use of Potentially Dangerous Function in mixme
Aliases: CVE-2021-29491
Severity: HIGH
CVSS score: 7.1
CWE: CWE-913
Published: 2021-05-06T15:45:39Z

### Impact

In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

### Patches
The problem is corrected starting with version 0.5.1.

### References
Issue: https://github.com/adaltas/node-mixme/issues/1
Commit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028
Vulnerability: GHSA-r773-pmw3-f4mr
Summary: Open Redirect in koa-remove-trailing-slashes
Aliases: CVE-2021-23384
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-601
Published: 2022-02-10T23:47:27Z

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::removeTrailingSlashes(), as the web server uses relative URLs instead of absolute URLs.
Vulnerability: GHSA-fm7r-2pr7-rw2p
Summary: Malicious Package in yeoman-genrator
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:45:02Z

Version 3.1.1 of `yeoman-genrator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-vvw4-rfwf-p6hx
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Aliases: CVE-2020-17527
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-02-09T22:58:06Z

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Vulnerability: GHSA-p6h4-93qp-jhcm
Summary: Command injection in Parse Server through prototype pollution
Aliases: CVE-2022-24760
Severity: CRITICAL
CVSS score: 10
CWE: CWE-74, CWE-1321
Published: 2022-03-11T23:53:23Z

### Impact
This is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows.

### Patches
Upgrade to Parse Server >=4.10.7. If you are using a prerelease version of Parse Server 5.0 (alpha, beta) we will publish a timely fix for these. However, as a general reminder we do not consider prerelease versions to be suitable for production deployment.

Note that as part of the fix a new security feature scans for sensitive keywords in request data to prevent JavaScript prototype pollution. If such a keyword is found, the request is rejected with HTTP response code `400` and Parse Error `105` (`INVALID_KEY_NAME`). By default these keywords are: `{_bsontype: "Code"}`, `constructor`, `__proto__`. If you are using any of these keywords in your request data, you can override the default keywords by setting the new Parse Server option `requestKeywordDenylist` to `[]` and specify your own keywords as needed.

### Workarounds
Although the fix is more broad and includes several aspects of the vulnerability, a quick and targeted fix can be achieved by patching the MongoDB Node.js driver and disable BSON code execution. To apply the patch, add the following code to be executed before starting Parse Server, for example in `index.js`.

```
const BSON = require('bson');
 const internalDeserialize = BSON.prototype.deserialize;
 BSON.prototype.deserialize = (buffer, options = Object.create(null), ...others) => {
   if (options.constructor) {
     options = Object.assign(Object.create(null), options);
   }
   return internalDeserialize(buffer, options, ...others);
 };
 const internalDeserializeStream = BSON.prototype.deserializeStream;
 BSON.prototype.deserializeStream = (
   data,
   startIndex,
   numberOfDocuments,
   documents,
   docStartIndex,
   options = Object.create(null),
   ...others
 ) => {
   if (options.constructor) {
     options = Object.assign(Object.create(null), options);
   }
   return internalDeserializeStream(
     data,
     startIndex,
     numberOfDocuments,
     documents,
     docStartIndex,
     options,
     ...others
   );
 };
```

### References
- Original report on [huntr.dev](https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/)
Vulnerability: GHSA-hpfq-8wx8-cgqw
Summary: Cross-Site Scripting in ids-enterprise
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-06-13T18:59:18Z

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Vulnerability: GHSA-9pm8-xcj6-2m33
Summary: Missing Authorization in TYPO3 extension
Aliases: CVE-2020-12698
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2021-07-26T21:34:52Z

The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
Vulnerability: GHSA-fx8w-mjvm-hvpc
Summary: Path Traversal in Buildah
Aliases: CVE-2020-10696
Severity: HIGH
CVSS score: 8.8
CWE: CWE-22
Published: 2021-05-18T18:32:41Z

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
Vulnerability: GHSA-rmrm-75hp-phr2
Summary: Improper Input Validation in Hibernate Validator
Aliases: CVE-2020-10693
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-06-04T21:36:34Z

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
Vulnerability: GHSA-375m-5fvv-xq23
Summary: VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption
Severity: LOW
CVSS score: 0
CWE: CWE-20
Published: 2021-04-19T15:11:54Z

## Background

@tjayrush reported a data handling issue with certain Web3 libraries using Vyper-deploy forwarder proxy contracts using our Vyper's built-in `create_forwarder_to` function prior to our change to support EIP-1167 style forwarder proxies.

### Impact
If you are an end user of a forwarder-style proxy deployed using Vyper's built-in `create_forwarder_to` function AND you have a function that returns >4096 bytes AND you do no return data sanitation on the value returned, you could potentially see a data corruption issue.

Otherwise, if you are handling the result of a return call AND you expect a specific `RETURNDATASIZE` that is less than 4096 (such as `SafeERC20.safeTransfer`) then the call will fail that check.

### Patches
The issue was patched when we upgraded to EIP-1167 style forwarder proxies in #2281.

### Workarounds
If you are making a call to a contract method that is expected to return <= 4096 bytes, there is no issue as the ABI decoders in both Solidity and Vyper will truncate the data properly. Web3 libraries will also do this, unless you are doing `eth_call` or `eth_sendTransaction` directly.

If you are using a Solidity library that checks `RETURNDATASIZE` of an external call to a forwarder proxy deployed prior to this patch, it will fail on that assertion (such as `SafeERC20.safeTransfer`). The workaround is to always do a greater than or equal to check, rather than a strict equals to check.
Vulnerability: GHSA-fw2f-7f87-5r6c
Summary: Improper Input Validation in access-policy
Aliases: CVE-2020-7674
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-17T21:00:29Z

access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the `template` function is executed by the `eval` function resulting in code execution.
Vulnerability: GHSA-vfrc-7r7c-w9mx
Summary: Prototype Pollution in highlight.js
Aliases: CVE-2020-26237
Severity: LOW
CVSS score: 5.8
CWE: CWE-471
Published: 2020-11-24T22:58:41Z

### Impact

Affected versions of this package are vulnerable to Prototype Pollution.  A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting.  If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. 

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. 

_If your website or application does not render user provided data it should be unaffected._

### Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability.  If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

### Workarounds

#### Patch your library

Manually patch your library to create null objects for both `languages` and `aliases`:

```js
const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);
```

#### Filter out bad data from end users

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

### References

* [What is Prototype Pollution?](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)
* https://github.com/highlightjs/highlight.js/pull/2636

### For more information

If you have any questions or comments about this advisory:

* Please file an issue against [highlight.js](https://github.com/highlightjs/highlight.js/issues/)
Vulnerability: GHSA-xrr6-3pc4-m447
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2015-7577
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-284
Published: 2017-10-24T18:33:36Z

activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
Vulnerability: GHSA-p479-rwhp-rwjx
Summary: Cross-site scripting in Jenkins Scriptler Plugin
Aliases: CVE-2021-21667
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-06T18:45:29Z

Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
Vulnerability: GHSA-cf8j-64h9-6q58
Summary: CSRF in Play Framework
Aliases: CVE-2020-12480
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2020-08-18T17:30:25Z

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.
Vulnerability: GHSA-rh46-3fgc-mvrf
Summary: Validation bypass is possible in Json Pattern Validator
Aliases: CVE-2019-19507
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-287
Published: 2019-12-04T21:25:28Z

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Vulnerability: GHSA-hfwx-c7q6-g54c
Summary: Vulnerability allowing for reading internal HTTP resources
Severity: HIGH
CVSS score: 0
CWE: CWE-552
Published: 2021-03-12T23:04:46Z

### Impact

The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources.

The impact is limited to internal services that serve content via. HTTP(S), and requires the attacker to know internal hostnames/IP addresses.

The previous versions have been marked as deprecated on NPM.

### Patches

Version 2.1.0 released alongside this security advisory addresses the issue. **Please note that this release is not backwards compatible out of the box. See the [changelog](https://github.com/highcharts/node-export-server/blob/master/CHANGELOG.md) for details.**

Additionally, it's also recommended to upgrade to the latest version of Highcharts to get the added input sanitation implemented in version 9.0 and later. 

### Workarounds

There are no known workarounds to the issue - an upgrade to version 2.1.0 is required.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the export server issue tracker](https://github.com/highcharts/node-export-server/issues)
* Email us at [security@highsoft.com](mailto:security@highsoft.com)
Vulnerability: GHSA-w992-2gmj-9xxj
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:23:29Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the `swagger.apiInfo.description` value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.2.1 or later.
Vulnerability: GHSA-mg2g-8pwj-r2j2
Summary: Authentication bypass in SilverStripe GraphQL
Aliases: CVE-2020-26136
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-287, CWE-288
Published: 2021-06-10T17:21:33Z

The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though.

Basic-auth has been removed as a default authentication method. If desired, it can be re-enabled by adding it to the authenticators key of a schema, or on SilverStripe\Graphql\Auth\Handler