TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fqx8-v33p-4qcc
Summary: Cross-site Scripting in enshrined/svg-sanitize
Aliases: CVE-2022-23638
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-79
Published: 2022-02-14T22:54:18Z

### Impact
SVG sanitizer library before version `0.15.0` did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML (fetched as `text/html`) was susceptible to cross-site scripting. Plain SVG files (fetched as `image/svg+xml`) were not affected.

### Patches
This issue is fixed in `0.15.0` and higher.

### Workarounds
There is currently no workaround available without upgrading.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Github](https://github.com/darylldoyle/svg-sanitizer/issues)
* Email us at [daryll@enshrined.co.uk](mailto:daryll@enshrined.co.uk)
Vulnerability: GHSA-6xp6-fmc8-pmmr
Summary: Temporary Directory Hijacking Vulnerability in Keycloak
Aliases: CVE-2021-20202
Severity: HIGH
CVSS score: 7.3
CWE: CWE-377
Published: 2022-03-18T17:50:45Z

A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.
Vulnerability: GHSA-cr56-66mx-293v
Summary: Cross-Site Scripting in @toast-ui/editor
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T15:53:50Z

Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS).  There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.

## Recommendation

Upgrade to version 2.2.0 or later.
Vulnerability: GHSA-333x-9vgq-v2j4
Summary: Directory Traversal in geddy
Aliases: CVE-2015-5688
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors.

### Proof of Concept
```
http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
```


## Recommendation

Update geddy to version >= 13.0.8
Vulnerability: GHSA-32x6-qvw6-mxj4
Summary: Forwarding of confidentials headers to third parties in fluture-node
Aliases: CVE-2022-24719
Severity: LOW
CVSS score: 2.6
CWE: CWE-200, CWE-359, CWE-601
Published: 2022-03-01T22:14:57Z

### Impact

Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing.

### Patches

The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin.

### Workarounds

Use a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.

### References

- This vulnerability was discovered after the announcement of similar vulnerabilities in the `follow-redirects` package. There is more information there: https://github.com/advisories/GHSA-74fj-2j2h-c42q and https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db/
- Fixed in 125e4474f910c1507f8ec3232848626fbc0f55c4 and 0c99bc511533d48be17dc6bfe641f7d0aeb34d77
Vulnerability: GHSA-6chw-6frg-f759
Summary: Regular Expression Denial of Service in Acorn
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-04-03T21:48:38Z

Affected versions of acorn are vulnerable to Regular Expression Denial of Service.
A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop.
The string is not valid UTF16 which usually results in it being sanitized before reaching the parser.
If an application processes untrusted input and passes it directly to acorn,
attackers may leverage the vulnerability leading to Denial of Service.
Vulnerability: GHSA-2p82-v77v-mppr
Summary: Airbrake
Aliases: CVE-2019-16060
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-200
Published: 2019-09-11T23:05:57Z

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
Vulnerability: GHSA-gv3v-92v6-m48j
Summary: Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)
Aliases: CVE-2020-7622
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-444
Published: 2020-04-03T15:23:30Z

### Impact

 - Cross Site Scripting
 - Cache Poisoning
 - Page Hijacking

### Patches

This was fixed in version `2.2.1`.

### Workarounds

If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters.

### References

##### [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)

I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability.

### Root Cause

This roots cause back to this line in the Jooby codebase:

https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102

The `DefaultHttpHeaders` takes a parameter `validate` which, when `true` (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting.

### Reported By

This vulnerability was reported by @JLLeitschuh ([Twitter](https://twitter.com/JLLeitschuh))

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jooby-project/jooby](https://github.com/jooby-project/jooby/issues)
Vulnerability: GHSA-fp4w-jxhp-m23p
Summary: Dependency Confusion in Bundler
Aliases: CVE-2020-36327
Severity: HIGH
CVSS score: 8.8
Published: 2021-05-24T18:12:33Z

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.
Vulnerability: GHSA-rwgm-f83r-v3qj
Summary: Improper Certificate Validation in WP-CLI framework
Aliases: CVE-2021-29504
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-295
Published: 2021-05-19T23:03:11Z

### Impact
An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself.

### Patches
The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request.

The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages.

https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change.

Subsequent PRs on the command repositories have added an `--insecure` flag to the appropriate commands on the following repositories to counter the breaking change:

* https://github.com/wp-cli/config-command/pull/128
* https://github.com/wp-cli/core-command/pull/186
* https://github.com/wp-cli/extension-command/pull/287
* https://github.com/wp-cli/checksum-command/pull/86
* https://github.com/wp-cli/package-command/pull/138

### Workarounds
There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0.

The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.

### References
* [CWE: Improper Certificate Validation](https://cwe.mitre.org/data/definitions/295.html)

### For more information
If you have any questions or comments about this advisory:
* Join the `#cli` channel in the [WordPress.org Slack](https://make.wordpress.org/chat/) to ask questions or provide feedback.
Vulnerability: GHSA-8xwg-wv7v-4vqp
Summary: Code Execution by Re-enabling Node.js integration in electron
Aliases: CVE-2018-1000136
Severity: HIGH
CVSS score: 8.1
CWE: CWE-20
Published: 2018-03-26T16:41:17Z

Versions of electron 
A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it.

For the application to be impacted by this vulnerability it must meet all of these conditions

- Runs on Electron 1.7, 1.8, or a 2.0.0-beta
- Allows execution of arbitrary remote code
- Disables Node.js integration
- Does not explicitly declare webviewTag: false in its webPreferences
- Does not enable the nativeWindowOption option
- Does not intercept new-window events and manually override event.newGuest without using the supplied options tag


## Recommendation

Update to `electron` version 1.7.13, 1.8.4, or 2.0.0.beta.5 or later

If you are unable to update your Electron version can mitigate the vulnerability with the following code.

```
app.on('web-contents-created', (event, win) => {
  win.on('new-window', (event, newURL, frameName, disposition,
                        options, additionalFeatures) => {
    if (!options.webPreferences) options.webPreferences = {};
    options.webPreferences.nodeIntegration = false;
    options.webPreferences.nodeIntegrationInWorker = false;
    options.webPreferences.webviewTag = false;
    delete options.webPreferences.preload;
  })
})

// and *IF* you don't use WebViews at all,
// you might also want
app.on('web-contents-created', (event, win) => {
  win.on('will-attach-webview', (event, webPreferences, params) => {
    event.preventDefault();
  })
})
```
Vulnerability: GHSA-mgh8-hcwj-h57v
Summary: Improper Restriction of XML External Entity Reference in Apache Olingo
Aliases: CVE-2019-17554
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-611
Published: 2020-02-04T22:37:43Z

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.
Vulnerability: GHSA-574q-fxfj-wv6h
Summary: High severity vulnerability that affects puppet
Aliases: CVE-2013-1655
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
Vulnerability: GHSA-75qf-wgfj-v652
Summary: Arbitrary File Write via Archive Extraction (Zip Slip)
Aliases: CVE-2020-7669
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-18T18:28:03Z

This affects all versions up to and including version 7.0.0 of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.
Vulnerability: GHSA-7v35-qwwj-p98g
Summary: Improper Restriction of XML External Entity Reference in DiffPlug Spotless
Aliases: CVE-2019-9843
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2019-07-05T21:07:40Z

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Vulnerability: GHSA-qh32-6jjc-qprm
Summary: Null pointer dereference in tensorflow-lite
Aliases: CVE-2020-15209
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-476
Published: 2020-09-25T18:28:46Z

### Impact
A crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with `nullptr`:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/core/subgraph.cc#L1224-L1227

However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference.

### Patches
We have patched the issue in 0b5662bc and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360 but was also discovered through variant analysis of [GHSA-cvpc-8phh-8f45](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cvpc-8phh-8f45).
Vulnerability: GHSA-3qh4-r86r-grvm
Summary: Arbitrary JavaScript Execution in typed-function
Aliases: CVE-2017-1001004
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2020-09-02T18:24:39Z

Versions of `typed-function` prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.


## Recommendation

Upgrade to version 0.10.6 or later.
Vulnerability: GHSA-3r7g-wrpr-j5g4
Summary: Improper Authentication in django-mfa3
Aliases: CVE-2022-24857
Severity: HIGH
CVSS score: 7.3
CWE: CWE-287
Published: 2022-04-22T20:48:28Z

### Impact

django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be bypassed.

You are affected if you have activated both django-mfa3 (< 0.5.0) and django.contrib.admin and have not taken any other measures to prevent users from accessing the admin login view.

### Patches

The issue has been fixed in django-mfa3 0.5.0.

### Workarounds

It is possible to work around the issue by overwriting the admin login route, e.g. by adding the following URL definition *before* the admin routes:

    url('admin/login/', lambda request: redirect(settings.LOGIN_URL)

### References

- [django-mfa3 changelog](https://github.com/xi/django-mfa3/blob/main/CHANGES.md#050-2022-04-15)
Vulnerability: GHSA-gx8x-g87m-h5q6
Summary: Denial of Service (DoS) in Nokogiri on JRuby
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-04-11T21:38:11Z

## Summary

Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).

See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.


## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Impact

### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml

- **Severity**: High 7.5
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
Vulnerability: GHSA-368f-29c3-4f2r
Summary: Data race in conqueue
Aliases: CVE-2020-36437
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:58:50Z

Affected versions of this crate unconditionally implemented `Send`/`Sync` for `QueueSender<T>`,
allowing to send non-Send `T` to other threads by invoking `(&QueueSender<T>).send()`.

This fails to prevent users from creating data races by sending types like `Rc<T>` or `Arc<Cell<T>>` to other threads, which can lead to memory corruption.

The flaw was corrected in commit 1e462c3 by imposing `T: Send` to both `Send`/`Sync` impls for `QueueSender<T>`/`QueueReceiver<T>`.
Vulnerability: GHSA-77rc-x84q-pv4f
Summary: Low severity vulnerability that affects apache-airflow
Aliases: CVE-2018-20245
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2019-01-25T16:19:19Z

The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.
Vulnerability: GHSA-9g2w-5f3v-mfmm
Summary: Insecure default config of Celery worker in Apache Airflow
Aliases: CVE-2020-11982
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-07-27T16:57:33Z

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Vulnerability: GHSA-vrcf-g539-x6h3
Summary: Uncontrolled deserialization of a pickled object in rediswrapper allows attackers to execute arbitrary scripts
Aliases: CVE-2019-17206
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-11-20T01:37:13Z

Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts.
Vulnerability: GHSA-59g4-hpg3-3gcp
Summary: Files Accessible to External Parties in Opencast
Aliases: CVE-2021-43821
Severity: CRITICAL
CVSS score: 9.9
CWE: CWE-552
Published: 2021-12-14T21:44:03Z

Opencast before version 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface.

### Impact

Before Opencast 10.6, Opencast would [open and include local files during ingests](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587). Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine.

For example, to expose the `custom.properties` of develop.opencast.org via the asset manager, an attacker could have run:

```
curl -f -i -u admin:opencast \
  https://develop.opencast.org/ingest/addMediaPackage/fast \
  -F 'flavor=presenter/source'\
  -F mediaUri=file:///srv/opencast/opencast-dist-allinone/etc/custom.properties\
  -F title="custom.properties"  
```

An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given.


### Patches

The issue has been fixed in Opencast 10.6 and 11.0.

### Workarounds

You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.

### References

-  [Example of problematic code](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587).
- [Patch fixing the issue](https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
Vulnerability: GHSA-9r3m-mhfm-39cm
Summary: Incorrect Calculation in bigint-money
Severity: LOW
CVSS score: 0
CWE: CWE-682
Published: 2020-09-11T21:10:29Z

Versions of `bigint-money` prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to its usage in financial systems.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability: GHSA-vmf7-hmh6-vv57
Summary: Denial of Service in Go-Ethereum
Aliases: CVE-2022-23328
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-03-05T00:00:46Z

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).
Vulnerability: GHSA-33rv-m2gp-mm2r
Summary: Prototype pollution in safe-flat
Aliases: CVE-2021-25927
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-06-21T17:18:29Z

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-9pp4-8p8v-g78w
Summary: Data races in lever
Aliases: CVE-2020-36457
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:57:26Z

An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T. This allows non-Send types such as Rc and non-Sync types such as Cell to be used across thread boundaries which can trigger undefined behavior and memory corruption.
Vulnerability: GHSA-535v-4x9q-446c
Summary: Moderate severity vulnerability that affects org.apache.hbase:hbase
Aliases: CVE-2019-0212
Severity: HIGH
CVSS score: 7.5
CWE: CWE-285
Published: 2019-04-02T15:47:00Z

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
Vulnerability: GHSA-w4x5-jqq4-qc8x
Summary: SQL Injection in Cloud Native Computing Foundation Harbor
Aliases: CVE-2019-19026
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-89
Published: 2021-05-18T18:27:43Z

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability: GHSA-6226-h7ff-ch6c
Summary: Widget feature vulnerability allowing to execute JavaScript code using undo functionality
Aliases: CVE-2021-32808
Severity: HIGH
CVSS score: 7.6
CWE: CWE-79
Published: 2021-08-23T19:40:48Z

### Affected packages
The vulnerability has been discovered in [Widget](https://ckeditor.com/cke4/addon/clipboard) plugin if used alongside [Undo](https://ckeditor.com/cke4/addon/undo) feature.

### Impact
A potential vulnerability has been discovered in CKEditor 4 [Widget](https://ckeditor.com/cke4/addon/widget) package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-8jf2-cq6v-w234
Summary: Malicious Package in uglyfi.js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:10:53Z

Version 0.17.3 of `uglyfi.js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-f5f7-6478-qm6p
Summary: Files or Directories Accessible to External Parties in kubernetes
Aliases: CVE-2021-25741
Severity: HIGH
CVSS score: 8.1
CWE: CWE-552, CWE-20
Published: 2021-11-01T17:32:28Z

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
Vulnerability: GHSA-g4vj-x7v9-h82m
Summary: Overflow in libsecp256k1
Aliases: CVE-2021-38195
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347, CWE-190
Published: 2021-08-25T20:56:03Z

An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
Vulnerability: GHSA-c9h6-xhg9-xxrv
Summary: Low severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
Aliases: CVE-2019-0200
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-03-07T18:48:08Z

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
Vulnerability: GHSA-hhfg-6hfc-rvxm
Summary: Regular Expression Denial of Service in jsoneditor
Aliases: CVE-2021-3822
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400, CWE-697, CWE-1333
Published: 2021-09-29T17:15:55Z

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.
Vulnerability: GHSA-p9m8-27x8-rg87
Summary: Critical vulnerability found in cron-utils
Aliases: CVE-2021-41269
Severity: CRITICAL
CVSS score: 10
CWE: CWE-94
Published: 2021-11-15T23:27:11Z

### Impact
A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

### Patches
The issue was patched and a new version was released. Please upgrade to version 9.1.6.

### Workarounds
There are no known workarounds up to this moment.

### References
A description of the issue is provided in [issue 461](https://github.com/jmrozanec/cron-utils/issues/461)

### For more information
If you have any questions or comments about this advisory:

Open an issue in the [cron-utils Github repository](https://github.com/jmrozanec/cron-utils)
Vulnerability: GHSA-f6pc-crhh-cp96
Summary: Privilege escalation in Presto
Aliases: CVE-2020-15087
Severity: HIGH
CVSS score: 7.4
CWE: CWE-285
Published: 2020-06-30T16:33:23Z

### Affected
This affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver.

### Impact
Authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured.

This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure.

### Patches
This issue has been fixed starting with PrestoSQL version 337.

### Workarounds
This issue can be mitigated by blocking network access to internal APIs on the coordinator and workers. 

### References
See the Presto documentation for [Secure Internal Communication](https://trino.io/docs/current/security/internal-communication.html).

### For more information
If you have any questions or comments about this advisory:
* Join the **#security** channel on [Slack](https://trino.io/slack.html).
* Contact the security team at [security@trino.io](mailto:security@trino.io).
Vulnerability: GHSA-hvgc-mggg-pxr2
Summary: Malicious Package in js-sha7
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:02:33Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-gjwp-7v3g-99pj
Summary: Cross-site Request Forgery (CSRF) in joplin
Aliases: CVE-2021-23431
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-352
Published: 2021-09-02T17:09:05Z

The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
Vulnerability: GHSA-4xg9-g7qj-jhg4
Summary: Malicious Package in comander
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T20:46:36Z

All versions of `comander` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-5qjq-69w6-fg57
Summary: XSS vulnerability with translator
Aliases: CVE-2021-32671
Severity: CRITICAL
CVSS score: 10
CWE: CWE-79
Published: 2021-06-07T21:48:17Z

Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or documented.

This allowed for any user to type malicious HTML markup within certain user input fields and have this execute on client browsers. The example which led to the discovery of this vulnerability was in the forum search box. Entering faux-malicious HTML markup, such as <script>alert('test')</script> resulted in an alert box appearing on the forum. This attack could also be modified to perform AJAX requests on behalf of a user, possibly deleting discussions, modifying their settings or profile, or even modifying settings on the Admin panel if the attack was targetted towards a privileged user.

### Impact

All Flarum communities that run flarum v1.0.0 or v1.0.1 are impacted.

### Patches

The vulnerability has been fixed and published as flarum/core v1.0.2. All communities running Flarum v1.0 have to upgrade as soon as possible to v1.0.2 using:

```
composer update --prefer-dist --no-dev -a -W
```

You can then confirm you run the latest version using:

```
composer show flarum/core
```

### Workarounds

__None.__

### For more information

For any questions or comments on this vulnerability please visit https://discuss.flarum.org/d/27558.

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing security@flarum.org, and we will address it promptly.
Vulnerability: GHSA-3837-87vh-xq3w
Summary: Data race in v9
Aliases: CVE-2020-36447
Severity: HIGH
CVSS score: 8.1
CWE: CWE-77
Published: 2021-08-25T20:57:07Z

v9 is a slim data engine for Data Oriented Design. An issue was discovered in the v9 crate through 2020-12-18 for Rust. There is an unconditional implementation of Sync for SyncRef<T>.
Vulnerability: GHSA-mgjw-2wrp-r535
Summary: Remote code execution in xwiki-platform
Aliases: CVE-2022-23616
Severity: HIGH
CVSS score: 8.8
CWE: CWE-74
Published: 2022-02-09T21:32:10Z

### Impact
It's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki.

### Patches
The problem has been patched in XWiki 13.1RC1 with a complete refactoring of the Reset password feature.

### Workarounds
There's different possible workarounds, all consisting in modifying the XWiki/ResetPassword page.
  - the Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page
  - the script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password. 

### References
https://jira.xwiki.org/browse/XWIKI-16661

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](https://jira.xwiki.org)
* Email us at [Security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-4r62-v4vq-hr96
Summary: Regular Expression Denial of Service (REDoS) in Marked
Aliases: CVE-2021-21306
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-02-08T21:17:58Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

[Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)

A Denial of Service attack can affect anyone who runs user generated code through `marked`.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

patched in v2.0.0

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

None.

### References
_Are there any links users can visit to find out more?_

https://github.com/markedjs/marked/issues/1927
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [marked](https://github.com/markedjs/marked/issues)
Vulnerability: GHSA-4p55-xj37-fx7g
Summary: Improper Authorization in Strapi
Aliases: CVE-2020-27665
Severity: MODERATE
CVSS score: 0
CWE: CWE-276
Published: 2020-10-29T18:29:31Z

In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
Vulnerability: GHSA-28xh-wpgr-7fm8
Summary: Command Injection in open
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2019-06-20T15:35:49Z

Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.

The package does come with the following warning in the readme:

```
The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.
```


## Recommendation

`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.
Vulnerability: GHSA-fvq6-55gv-jx9f
Summary: SQL Injection in mysql
Aliases: CVE-2015-9244
Severity: MODERATE
CVSS score: 0
CWE: CWE-89
Published: 2020-09-01T15:21:05Z

Versions of `mysql` prior to 2.0.0-alpha8 are affected by a SQL Injection vulnerability in the `mysql.escape()` function, which does not properly escape object keys.


## Recommendation

Update to version 2.0.0-alpha8 or later.
Vulnerability: GHSA-gc45-j3m5-8qfq
Summary: Server-Side Request Forgery in Feehi CMS
Aliases: CVE-2021-30108
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-918
Published: 2021-06-08T20:12:32Z

Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
Vulnerability: GHSA-6c3j-c64m-qhgq
Summary: XSS in jQuery as used in Drupal, Backdrop CMS, and other products
Aliases: CVE-2019-11358
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79, CWE-1321
Published: 2019-04-26T16:29:11Z

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Vulnerability: GHSA-77rv-6vfw-x4gc
Summary: Critical severity vulnerability that affects org.springframework.security.oauth:spring-security-oauth and org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2019-3778
Severity: CRITICAL
CVSS score: 0
CWE: CWE-601
Published: 2019-03-14T15:39:30Z

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.

A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. 

This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Vulnerability: GHSA-43jf-985q-588j
Summary: Multiple `CHECK`-fails in `function.cc` in TensowFlow
Aliases: CVE-2022-23586
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-09T23:27:08Z

### Impact
A malicious user can cause a denial of service by altering a `SavedModel` such that [assertions in `function.cc`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/function.cc) would be falsified and crash the Python interpreter.
### Patches
We have patched the issue in GitHub commits [dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2](https://github.com/tensorflow/tensorflow/commit/dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2) and [3d89911481ba6ebe8c88c1c0b595412121e6c645](https://github.com/tensorflow/tensorflow/commit/3d89911481ba6ebe8c88c1c0b595412121e6c645).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-x5ph-4fr4-g7fw
Summary: Downloads Resources over HTTP in galenframework-cli
Aliases: CVE-2016-10560
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:21Z

Affected versions of `galenframework-cli` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `galenframework-cli`.


## Recommendation

Update to version 2.3.1 or later.
Vulnerability: GHSA-x3w4-mrmv-cw2x
Summary: Malicious Package in buffev-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:19:44Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-2v5f-23xc-v9qr
Summary: Cross-site scripting
Aliases: CVE-2021-3377
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-03-11T22:50:39Z

The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
Vulnerability: GHSA-cqr7-78pj-3g7j
Summary: File Descriptor Leak Can Cause DoS Vulnerability in hapi
Aliases: CVE-2014-3742
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:36Z

Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak. 

When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.



## Recommendation

- Please upgrade to version 2.2.x or above as soon as possible.
Vulnerability: GHSA-r6v3-hpxj-r8rv
Summary: Code Injection in PyXDG
Aliases: CVE-2019-12761
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94
Published: 2019-06-07T20:56:27Z

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.
Vulnerability: GHSA-xc6g-ggrc-qq4r
Summary: Cross-Site Scripting in sanitize-html
Aliases: CVE-2017-16016
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-09T17:47:23Z

Affected versions of `sanitize-html` are vulnerable to cross-site scripting when allowedTags includes at least one `nonTextTag`.

## Proof of Concept

```
var sanitizeHtml = require('sanitize-html');

var dirty = '!<textarea>&lt;/textarea&gt;<svg/onload=prompt`xs`&gt;</textarea>!';
var clean = sanitizeHtml(dirty, {
    allowedTags: [ 'textarea' ]
});

console.log(clean);

// !<textarea></textarea><svg/onload=prompt`xs`></textarea>!
```


## Recommendation

Update to version 1.11.4 or later.
Vulnerability: GHSA-5mhv-9qw8-j63g
Summary: Hijacked Environment Variables in mssql.js
Aliases: CVE-2017-16056
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-11-09T17:43:03Z

The `mssql.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-2h63-qp69-fwvw
Summary: Server-side request forgery (SSRF) in Apache Batik
Aliases: CVE-2020-11987
Severity: HIGH
CVSS score: 8.2
CWE: CWE-20, CWE-918
Published: 2022-01-06T20:35:54Z

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Vulnerability: GHSA-wj6h-7chw-x4h2
Summary: Command injection in get-git-data
Aliases: CVE-2020-7619
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-10T15:59:14Z

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.
Vulnerability: GHSA-j6wp-3859-vxfg
Summary: OIDC claims not updated from Identity Provider in Pomerium
Aliases: CVE-2021-41230
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-863
Published: 2021-11-10T16:52:24Z

### Impact
Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using [`allowed_idp_claims`](https://www.pomerium.com/reference/#allowed-idp-claims) as part of policy.  If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions.

### Patches
v0.15.6

### Workarounds
- Clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated

### References
https://github.com/pomerium/pomerium/pull/2724

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Pomerium](https://github.com/pomerium/pomerium)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-v89p-5hr2-4rh4
Summary: Out-of-bounds write
Aliases: CVE-2019-1197
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:56:15Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1140, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196.
Vulnerability: GHSA-46rx-6jg9-4fh8
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-43324
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-11-08T17:59:15Z

LibreNMS through 21.10.2 allows XSS via a widget title.