TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-vhr6-pvjm-9qwf
Summary: User passwords are stored in clear text in the Django session
Aliases: CVE-2020-15105
Severity: HIGH
CVSS score: 5.4
CWE: CWE-312
Published: 2020-07-10T20:55:00Z

### Impact

django-two-factor-auth versions 1.11 and before store the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password, and then leaves before entering their two-factor authentication code.

The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' password are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of using Django's cache session store, the users' password are stored in clear text in whatever cache storage you have configured (typically Memcached or Redis).

### Patches

Upgrade to version 1.12 to resolve this issue.

After upgrading, users should be sure to delete any clear text passwords that have been stored. For example, if you're using the database session backend, you'll likely want to delete any session record from the database and purge that data from any database backups or replicas.

In addition, affected organizations who have suffered a database breach while using an affected version should inform their users that their clear text passwords have been compromised. All organizations should encourage users whose passwords were insecurely stored to change these passwords on any sites where they were used.

### Workarounds

Switching Django's session storage to use signed cookies instead of the database or cache lessens the impact of this issue, but should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than a server-side session storage. There is no way to fully mitigate the issue without upgrading.

### References

For an explanation of why storing cleartext password is a substantial vulnerability: [Hashing Passwords: One-Way Road to Security](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/).  
For documentation on configuring the Django session storage engine: [Django session documentation](https://docs.djangoproject.com/en/3.0/topics/http/sessions/).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the repo](https://github.com/Bouke/django-two-factor-auth)
Vulnerability: GHSA-jcmh-9fvm-j39w
Summary: Malicious Package in body-parse-xml
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:42:23Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-wh8g-3j2c-rqj5
Summary: Serialization gadgets exploit in jackson-databind
Aliases: CVE-2020-35490
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:15:00Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
Vulnerability: GHSA-f7qw-5fgj-247x
Summary: Cross-site Scripting and Open Redirect in plone.app.contenttypes
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-601, CWE-79
Published: 2022-02-01T00:48:35Z

### Impact
Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.
The technique is known as cache poisoning.
Any later visitor can get redirected when clicking on a link on this page.
Usually only anonymous users are affected, but this depends on your cache settings.

### Patches
New versions of plone.app.contenttypes have been released.
Version 2.2.3 works on Plone 5.2 and will be included in Plone 5.2.7.
Version 3.0.0a9 works on Plone 6 and will be included in Plone 6.0.0a3.

Note that the Products.CMFPlone package has the same problem in the 4.3 series.
In Plone 5.0-5.2, the default Products.ATContentTypes version has the same problem. See [advisory](https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh).
For all unpatched versions of the three packages, you can use the following workaround.

### Workaround
Make sure the image_view_fullscreen page is not stored in the cache.
In Plone:

* Login as Manager and go to Site Setup.
* Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable.
* Click on the tab 'Caching operations'.
* Under 'Legacy template mappings' locate the ruleset 'Content item view'.
* From the last column ('Templates')  remove 'image_view_fullscreen'.
* Click on Save.

### Reporter
This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!

### For more information
If you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org)
This is also the correct address to use when you want to report a possible vulnerability.
See [our security report policy](https://plone.org/security/report).
Vulnerability: GHSA-xpm8-98mx-h4c5
Summary: Critical severity vulnerability that affects MLAlchemy
Aliases: CVE-2017-16615
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-07-13T16:01:07Z

An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Vulnerability: GHSA-g8q7-xv52-hf9f
Summary: Feedgen Vulnerable to XML Denial of Service Attacks
Aliases: CVE-2020-5227
Severity: HIGH
CVSS score: 4.4
CWE: CWE-776
Published: 2020-01-28T22:37:50Z

### Impact

The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to [XML Denial of Service Attacks](https://docs.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-service-attacks-and-defenses) (e.g. XML Bomb).

This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only.

### Patches

This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources.

### Workarounds

Updating is strongly recommended and should not be problematic. Nevertheless, as a workaround, avoid providing XML directly to feedgen or ensure that no entity expansion is part of the XML. 

### References

- [Security Briefs - XML Denial of Service Attacks and Defenses](https://docs.microsoft.com/en-us/archive/msdn-magazine/2009/november/xml-denial-of-service-attacks-and-defenses)
- [Billion laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack#cite_note-2)

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [lkiesow/python-feedgen](https://github.com/lkiesow/python-feedgen/issues)
- Send an email to security@lkiesow.de
Vulnerability: GHSA-6xx3-rg99-gc3p
Summary: Timing based private key exposure in Bouncy Castle
Aliases: CVE-2020-15522
Severity: MODERATE
CVSS score: 5.1
CWE: CWE-362, CWE-203
Published: 2021-08-13T15:22:31Z

Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.2.1, BC before 1.66, BC-FNA before 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.
Vulnerability: GHSA-j3g2-m5jj-6336
Summary: Unsafe Merging of CORS Configuration Conflict in hapi
Aliases: CVE-2015-9243
Severity: MODERATE
CVSS score: 0
CWE: CWE-284
Published: 2020-09-01T15:20:00Z

Versions of `hapi` prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended.




## Recommendation

Update hapi to version 11.1.4 or later.
Vulnerability: GHSA-9q2p-fj49-vpxj
Summary: In marshmallow library the schema "only" option treats an empty list as implying no "only" option
Aliases: CVE-2018-17175
Severity: MODERATE
CVSS score: 5.3
Published: 2018-10-10T16:10:46Z

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").
Vulnerability: GHSA-7q4h-pj78-j7vg
Summary: Authorization service vulnerable to DDos attacks in Apache CFX
Aliases: CVE-2021-22696
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-918
Published: 2021-05-13T22:31:05Z

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from which to retrieve a JWT token from via the "request_uri" parameter. CXF was not validating the "request_uri" parameter (apart from ensuring it uses "https) and was making a REST request to the parameter in the request to retrieve a token. This means that CXF was vulnerable to DDos attacks on the authorization server, as specified in section 10.4.1 of the spec. This issue affects Apache CXF versions prior to 3.4.3; Apache CXF versions prior to 3.3.10.
Vulnerability: GHSA-hjg4-8q5f-x6fm
Summary: Information Disclosure / Unintended Method Execution in Action Pack
Aliases: CVE-2021-22885
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-209
Published: 2021-05-05T19:49:02Z

Impact
------
There is a possible information disclosure / unintended method execution
vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url`
helper with untrusted user input.

Vulnerable code will look like this.

```
redirect_to(params[:some_param])
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases
--------
The FIXED releases are available at the normal locations.

Workarounds
-----------
To work around this problem, it is recommended to use an allow list for valid
parameters passed from the user.  For example,

```
private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end
```

Or force the user input to be cast to a string like this,

```
def index
  redirect_to(params[:some_param].to_s)
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 5-2-information-disclosure.patch - Patch for 5.2 series
* 6-0-information-disclosure.patch - Patch for 6.0 series
* 6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.

Credits
-------

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.
Vulnerability: GHSA-wq8f-wvqp-xvvm
Summary: Integer Overflow or Wraparound in OpenCV
Aliases: CVE-2017-12863
Severity: HIGH
CVSS score: 8.8
CWE: CWE-190
Published: 2021-10-12T22:02:35Z

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
Vulnerability: GHSA-4jp3-q2qm-9fmw
Summary: Improper Restriction of Rendered UI Layers or Frames in Sylius
Aliases: CVE-2022-24733
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-1021
Published: 2022-03-14T21:55:33Z

### Impact

It is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker

### Patches

The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2, and above.

### Workarounds

Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that you just need to add a new **subscriber** in your app. 

```php
<?php

// src/EventListener/XFrameOptionsSubscriber.php

namespace App\EventListener

final class XFrameOptionsSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::RESPONSE => 'onKernelResponse',
        ];
    }

    public function onKernelResponse(ResponseEvent $event): void
    {
        if (!$this->isMainRequest($event)) {
            return;
        }

        $response = $event->getResponse();

        $response->headers->set('X-Frame-Options', 'sameorigin');
    }

    private function isMainRequest(ResponseEvent $event): bool
    {
        if (\method_exists($event, 'isMainRequest')) {
            return $event->isMainRequest();
        }

        return $event->isMasterRequest();
    }
}

```

And register it in the container:

```yaml
# config/services.yaml
services:
    # ...
    App\EventListener\XFrameOptionsSubscriber:
        tags: ['kernel.event_subscriber']
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-23fp-fmrv-f5px
Summary: Uncontrolled Resource Consumption in strapi
Aliases: CVE-2020-8123
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-400
Published: 2021-12-10T17:22:01Z

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
Vulnerability: GHSA-q6h7-4qgw-2j9p
Summary: Server side request forgery in Hashicorp Consul
Aliases: CVE-2022-29153
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2022-04-20T00:00:33Z

 A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.
Vulnerability: GHSA-w68r-5p45-5rqp
Summary: Improper Input Validation in Laravel
Aliases: CVE-2020-24941
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863
Published: 2021-05-06T18:54:20Z

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.
Vulnerability: GHSA-7xr3-rgwh-pw22
Summary: Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Aliases: CVE-2018-8030
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-10-16T19:50:39Z

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 are not affected.
Vulnerability: GHSA-mh82-55cm-6gfh
Summary: Prototype pollution vulnerability in js-extend
Aliases: CVE-2021-25945
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321, CWE-915
Published: 2021-06-08T23:16:03Z

Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-cmcx-xhr8-3w9p
Summary: Denial of Service in uap-core when processing crafted User-Agent strings
Aliases: CVE-2020-5243
Severity: HIGH
CVSS score: 5.7
CWE: CWE-20
Published: 2020-02-20T23:26:10Z

### Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

### Patches

Please update uap-core to &amp;amp;gt;= v0.7.3

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

### Details

Each vulnerable regular expression reported here contains 3 overlapping capture groups. Backtracking has approximately cubic time complexity with respect to the length of the user-agent string.

#### Regex 1:

```
\bSmartWatch *\( *([^;]+) *; *([^;]+) *;
```

is vulnerable in portion ` *([^;]+) *` and can be attacked with

```python
&amp;amp;quot;SmartWatch(&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```
e.g.
```
SmartWatch(                                   z
```


#### Regex 2:

```
; *([^;/]+) Build[/ ]Huawei(MT1-U06|[A-Z]+\d+[^\);]+)[^\);]*\)
```

is vulnerable in portion `\d+[^\);]+[^\);]*` and can be attacked with

```python
&amp;amp;quot;;A Build HuaweiA&amp;amp;quot; + (&amp;amp;quot;4&amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```


#### Regex 3:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(LG)E *; *([^;]*) *;[^;]*;[^;]*;\)
```

is vulnerable in portion ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;LGE;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

#### Regex 4:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(?:CUS:([^;]*)|([^;]+)) *; *([^;]*) *;.*;
```

is vulnerable in portions ` *(?:CUS:([^;]*)|([^;]+)) *` and ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;CUS:;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;z;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

Reported by Ben Caller @bcaller
Vulnerability: GHSA-hjmq-236j-8m87
Summary: Denial of service in tensorflow-lite
Aliases: CVE-2020-15213
Severity: MODERATE
CVSS score: 4
CWE: CWE-119, CWE-770
Published: 2020-09-25T18:28:53Z

### Impact
In TensorFlow Lite models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor, attackers can use a very large value to trigger a large allocation:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/segment_sum.cc#L39-L44

### Patches
We have patched the issue in 204945b and will release patch releases for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to limit the maximum value in the segment ids tensor. This only handles the case when the segment ids are stored statically in the model, but a similar validation could be done if the segment ids are generated at runtime, between inference steps.

However, if the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered from a variant analysis of [GHSA-p2cq-cprg-frvm](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p2cq-cprg-frvm).
Vulnerability: GHSA-549f-73hh-mj38
Summary: Command Injection in gitlabhook
Aliases: CVE-2019-5485
Severity: CRITICAL
CVSS score: 0
CWE: CWE-78
Published: 2019-09-16T22:24:02Z

All versions of `gitlabhook` are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-r67m-m8c7-jp83
Summary: Forced reinstall
Aliases: CVE-2021-39173
Severity: HIGH
CVSS score: 8.8
CWE: CWE-704
Published: 2021-08-30T16:11:33Z

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can trick Cachet and install the instance again, leading to arbitrary code execution on the server.

### Patches

This issue was addressed by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. 

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-rgr4-9jh5-j4j6
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2015-3225
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Vulnerability: GHSA-c4qr-gmr9-v23w
Summary: Prefix escape
Aliases: CVE-2021-21322
Severity: LOW
CVSS score: 10
CWE: CWE-20
Published: 2021-03-03T02:18:08Z

### Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is.

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

### Patches

All releases after v4.3.1 include the fix.

### Workarounds

There are no workaround available.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-reply-from](https://github.com/fastify/fastify-reply-from)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-8r7c-3cm2-3h8f
Summary: Memory leak in Tensorflow
Aliases: CVE-2022-23578
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-401
Published: 2022-02-10T00:33:13Z

### Impact
If a graph node is invalid, TensorFlow can leak memory in the [implementation of `ImmutableExecutorState::Initialize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/common_runtime/immutable_executor_state.cc#L84-L262):

```cc
Status s = params_.create_kernel(n->properties(), &item->kernel);
if (!s.ok()) {
  item->kernel = nullptr;
  s = AttachDef(s, *n);
  return s;           
}                     
```

Here, we set `item->kernel` to `nullptr` but it is a simple `OpKernel*` pointer so the memory that was previously allocated to it would leak.

### Patches
We have patched the issue in GitHub commit [c79ccba517dbb1a0ccb9b01ee3bd2a63748b60dd](https://github.com/tensorflow/tensorflow/commit/c79ccba517dbb1a0ccb9b01ee3bd2a63748b60dd).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-8j7x-pr59-m5h8
Summary: Malicious Package in whiteproject
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:31:18Z

All versions of `whiteproject` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-7696-qr5q-pg37
Summary: Malicious Package in zs-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:19:08Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-ff45-7prw-58vj
Summary: OS Command injection in docker-cli-js
Aliases: CVE-2021-23732
Severity: MODERATE
CVSS score: 0
CWE: CWE-78
Published: 2021-12-02T17:51:22Z

# Withdrawn

After reviewing this CVE, and [this response from the maintainer](https://github.com/Quobject/docker-cli-js/issues/22#issuecomment-967760940), we have withdrawn this advisory.

# Original CVE description

This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system.
Vulnerability: GHSA-4fq3-mr56-cg6r
Summary: High severity vulnerability that affects org.springframework.data:spring-data-commons
Aliases: CVE-2018-1273
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2018-10-17T17:23:24Z

Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
Vulnerability: GHSA-c566-2grg-mjwg
Summary: Serialization vulnerability in Apache Tapestry
Aliases: CVE-2020-17531
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-02-09T22:50:50Z

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Vulnerability: GHSA-9vjp-v76f-g363
Summary:  SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
Aliases: CVE-2021-37137
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-09-09T17:11:31Z

### Impact
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well.

This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

### Impact

All users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage.

### References
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185
Vulnerability: GHSA-q3cc-7p7g-392c
Summary: Use after free in rusqlite
Aliases: CVE-2020-35873
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:47:43Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because sessions.rs has a use-after-free.
Vulnerability: GHSA-7h43-gx24-p529
Summary: Prototype pollution in json8
Aliases: CVE-2020-7770
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-10T19:17:05Z

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Vulnerability: GHSA-pr3r-4wrp-r2pv
Summary: ActiveRecord in Ruby on Rails allows database-query bypass
Aliases: CVE-2016-6317
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476, CWE-284
Published: 2017-10-24T18:33:35Z

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Vulnerability: GHSA-jgqf-hwc5-hh37
Summary: Root Path Disclosure in send
Aliases: CVE-2015-8859
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.



## Recommendation

Update to version 0.11.1 or later.
Vulnerability: GHSA-hg4c-rgvm-964g
Summary: SQL Injection in pycsw
Aliases: CVE-2016-8640
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-89
Published: 2018-08-15T20:02:53Z

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
Vulnerability: GHSA-6vvh-5794-vpmj
Summary: An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
Aliases: CVE-2020-35216
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2021-12-17T20:40:58Z

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
Vulnerability: GHSA-4278-2v5v-65r4
Summary: Heap buffer overflow in `RaggedBinCount`
Aliases: CVE-2021-29512
Severity: LOW
CVSS score: 2.5
CWE: CWE-787, CWE-120
Published: 2021-05-21T14:20:40Z

### Impact
If the `splits` argument of `RaggedBincount` does not specify a valid [`SparseTensor`](https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow:

```python
import tensorflow as tf
tf.raw_ops.RaggedBincount(splits=[0], values=[1,1,1,1,1], size=5, weights=[1,2,3,4], binary_output=False)
```

This will cause a read from outside the bounds of the `splits` tensor buffer in the [implementation of the `RaggedBincount` op](https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L433):

```cc
    for (int idx = 0; idx < num_values; ++idx) {
      while (idx >= splits(batch_idx)) {
        batch_idx++;
      }
      ...
    }
```

Before the `for` loop, `batch_idx` is set to 0. The user controls the `splits` array, making it contain only one element, 0. Thus, the code in the `while` loop would increment `batch_idx` and then try to read `splits(1)`, which is outside of bounds.

### Patches
We have patched the issue in GitHub commit [eebb96c2830d48597d055d247c0e9aebaea94cd5](https://github.com/tensorflow/tensorflow/commit/eebb96c2830d48597d055d247c0e9aebaea94cd5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-q3jg-4c82-j4xh
Summary: Moderate severity vulnerability that affects org.springframework.credhub:spring-credhub-core
Aliases: CVE-2018-15795
Severity: HIGH
CVSS score: 8.1
CWE: CWE-338
Published: 2018-11-29T21:30:30Z

Pivotal CredHub Service Broker, versions prior to 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.
Vulnerability: GHSA-fhvc-gp6c-h2wx
Summary: Read on uninitialized buffer in postscript
Aliases: CVE-2021-26953
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2021-08-25T20:52:23Z

An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation.
Vulnerability: GHSA-6cp7-g972-w9m9
Summary: Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server
Aliases: CVE-2022-24732
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-324, CWE-613
Published: 2022-03-07T16:59:31Z

### Impact

Any configuration on any maddy version <0.5.4 using auth.pam is affected.

No password expiry or account expiry checking is done when authenticating using PAM.

### Patches

Patch is available as part of the 0.5.4 release.

### Workarounds

If /etc/shadow authentication is used, it is possible to replace auth.pam with auth.shadow which is not affected.

It is possible to blacklist expired accounts via existing filtering mechanisms (e.g. auth_map to invalid accounts in storage.imapsql).

### References

* https://github.com/foxcpp/maddy/blob/3412e59a2c92106e194fa69f2f1017c020037c9c/internal/auth/pam/pam.c
* https://linux.die.net/man/3/pam_acct_mgmt

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/foxcpp/maddy
* Email fox.cpp@disroot.org
Vulnerability: GHSA-73wv-v82c-xmqv
Summary: Malicious Package in buffep-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:50:51Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-rfw2-x9f8-2f6m
Summary: Cross-Site Scripting
Aliases: CVE-2021-26722
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-04-30T17:27:53Z

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
Vulnerability: GHSA-rhc3-76jw-4f2x
Summary: Denial of Service in @commercial/ammo
Severity: HIGH
CVSS score: 0
Published: 2020-09-04T17:58:46Z

Versions of `@commercial/ammo` prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 2.1.1 or later.
Vulnerability: GHSA-px3r-jm9g-c8w8
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2018-3741
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-04-26T15:41:10Z

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.
Vulnerability: GHSA-m296-j53x-xv95
Summary: Data races in tiny_future
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:32Z

`tiny_future` contains a light-weight implementation of `Future`s. The `Future`
type it has lacked bound on its `Send` and `Sync` traits.

This allows for a bug where non-thread safe types such as `Cell` can be used in
`Future`s and cause data races in concurrent programs.

The flaw was corrected in commit `c791919` by adding trait bounds to `Future`'s
`Send` and `Sync`.
Vulnerability: GHSA-fg9w-g6m4-557j
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2009-3086
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2017-10-24T18:33:38Z

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
Vulnerability: GHSA-hfc6-79wv-5hpw
Summary: Malicious Package in blingjs
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:48:13Z

Version 0.0.4 of `blingjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.4 of this module is found installed you will want to replace it with a version before or after 0.0.4. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-fwf6-rw69-hhj4
Summary: Improper Neutralization of Formula Elements in a CSV File in html-2-csv
Aliases: CVE-2021-23654
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-1236
Published: 2021-11-30T22:22:16Z

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.
Vulnerability: GHSA-crjr-9rc5-ghw8
Summary: Inefficient Regular Expression Complexity in Nokogiri
Aliases: CVE-2022-24836
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-1333
Published: 2022-04-11T21:18:06Z

## Summary

Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.


## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity


## Credit

This vulnerability was reported by HackerOne user ooooooo_q (ななおく).
Vulnerability: GHSA-f4cj-3q3h-884r
Summary: Partial authorization bypass on document save in xwiki-platform
Aliases: CVE-2022-23615
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-863
Published: 2022-02-09T21:21:53Z

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with SCRIPT right (EDIT right before XWiki 7.4) can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. It has been patched in XWiki 13.0. The only workaround is to give SCRIPT right only to trusted users.
Vulnerability: GHSA-5vf7-q87h-pg6w
Summary: Cross-Site Scripting in BookStack
Aliases: CVE-2020-11055
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2020-05-07T21:10:26Z

### Impact

A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines.

This most impacts scenarios where not-trusted users are given permission to create comments.

### Patches

The issue was addressed in BookStack v0.29.2.

After upgrading, The command `php artisan bookstack:regenerate-comment-content` should be ran to remove any pre-existing dangerous content. 

### Workarounds

Comments can be disabled in the system settings to prevent them being shown to users. Alternatively, comment creation permissions can be altered as required to only those who are trusted but this will not address existing exploitation of this vulnerability. 

### References

* [BookStack Beta v0.29.2](https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2)
* JVN#41035278
* [BookStack Blog Post](https://bookstackapp.com/blog/beta-release-v0-29-2/)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the BookStack GitHub repository](BookStackApp/BookStack/issues).
* Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).
* Follow the [BookStack Security Advice](https://github.com/BookStackApp/BookStack#-security) to contact someone privately.
Vulnerability: GHSA-6x77-rpqf-j6mw
Summary: High severity vulnerability that affects ejs
Aliases: CVE-2017-1000189
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-03-05T18:54:33Z

nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()
Vulnerability: GHSA-p788-rj37-357w
Summary: Insecure Defaults Leads to Potential MITM in ezseed-transmission
Aliases: CVE-2016-1000224
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-295, CWE-300
Published: 2020-09-01T15:26:35Z

Affected versions of `ezseed-transmission` download and run a script over an HTTP connection.

An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`.



## Recommendation

Update to version 0.0.15 or later.
Vulnerability: GHSA-8h4j-vm3r-vcq3
Summary: Use after free in rusqlite
Aliases: CVE-2020-35870
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:47:48Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via an Auxdata API use-after-free.
Vulnerability: GHSA-gq4h-f254-7cw9
Summary: Data races in ticketed_lock
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:34Z

Affected versions of this crate unconditionally implemented `Send` for `ReadTicket<T>` & `WriteTicket<T>`.
This allows to send non-Send `T` to other threads.

This can allows creating data races by cloning types with internal mutability and sending them to other threads (as `T` of `ReadTicket<T>`/`WriteTicket<T>`). Such data races can cause memory corruption or other undefined behavior.

The flaw was corrected in commit a986a93 by adding `T: Send` bounds to `Send` impls of `ReadTicket<T>`/`WriteTicket<T>`.
Vulnerability: GHSA-2v6v-q994-xvxx
Summary: Privilege escalation in beego
Aliases: CVE-2021-27117
Severity: HIGH
CVSS score: 7.8
CWE: CWE-59
Published: 2022-04-06T00:01:30Z

beego is an open-source, high-performance web framework for the Go programming language. An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
Vulnerability: GHSA-7vvr-h4p5-m7fh
Summary: NULL Pointer Dereference in aubio
Aliases: CVE-2018-19801
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2019-07-26T16:10:20Z

aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank
Vulnerability: GHSA-hmm9-r2m2-qg9w
Summary: Nil dereference in NATS JWT, DoS of nats-server
Severity: LOW
CVSS score: 7.5
CWE: CWE-476
Published: 2021-05-21T16:22:10Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2020-26521.txt>)

## Problem Description

The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account.  The Operator should be able to safely issue Accounts to other entities which it does not fully trust.

A malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.

The NATS Server is known to be impacted by this.


## Affected versions

#### JWT library

 * all versions prior to 1.1.0

#### NATS Server

 * Version 2 prior to 2.1.9


## Impact

#### JWT library

 * Programs would nil dereference and panic, aborting execution by default.

#### NATS server

 * Denial of Service caused by process termination


## Workaround

If your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.
Vulnerability: GHSA-gc9g-67cq-p7v4
Summary: Server-Side Request Forgery in Plone
Aliases: CVE-2021-33511
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2021-06-15T16:12:04Z

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
Vulnerability: GHSA-jjv7-qpx3-h62q
Summary: Denial-of-Service Memory Exhaustion in qs
Aliases: CVE-2014-7191
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:36Z

Versions prior to 1.0 of `qs` are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-r58x-wjg8-63m9
Summary: Denial of Service in Apache James
Aliases: CVE-2021-40110
Severity: HIGH
CVSS score: 0
Published: 2022-01-08T00:40:30Z

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.