TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-49c6-3wr4-8jr4
Summary: Malicious Package in malicious-npm-package
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-04T15:05:26Z

All versions of `malicious-npm-package` contain malicious code. The malware targets Windows systems. It runs a powershell command that downloads an executable file from a remote server and runs it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4w2q-9hp2-vxj5
Summary: Path Traversal in Caucho Resin
Aliases: CVE-2021-44138
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-04-05T00:00:28Z

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.
Vulnerability: GHSA-hxxf-q3w9-4xgw
Summary: Malicious Package in eslint-scope
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2018-07-12T19:52:02Z

Version 3.7.2 of `eslint-scope` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to 2 remote servers.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Vulnerability: GHSA-xjp4-6w75-qrj7
Summary: Remote CLI Command Execution Vulnerability in CodeIgniter4
Aliases: CVE-2022-24711
Severity: CRITICAL
CVSS score: 9.4
CWE: CWE-94, CWE-20
Published: 2022-03-01T21:44:13Z

### Impact
This vulnerability allows attackers to execute CLI routes via HTTP request.

### Patches
Upgrade to v4.1.9 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-8g4m-cjm2-96wq
Summary: Sandbox escape in notevil and argencoders-notevil
Aliases: CVE-2021-23771
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878). This package has been deprecated.
Vulnerability: GHSA-6jmr-jfh7-xg3h
Summary: False-positive validity for NFT1 genesis transactions
Aliases: CVE-2020-15131
Severity: CRITICAL
CVSS score: 7.5
CWE: CWE-697
Published: 2020-07-30T14:58:53Z

### Impact
In the npm package named "slp-validate", versions prior to 1.2.2 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

### Patches
npm package "slp-validate" has been patched and is published and tagged as version 1.2.2.

### Workarounds
Upgrade to slp-validate 1.2.2.

### References
* Package location: https://www.npmjs.com/package/slp-validate
* SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
* Git commit hash fixing this issue: https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c
* Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7

### For more information
If you have any questions or comments about this advisory please open an issue in the [slp-validate](https://github.com/simpleledger/slp-validate.js/issues) repository.
Vulnerability: GHSA-j59f-6m4q-62h6
Summary: Improper Key Verification in ipns
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2019-05-30T17:28:48Z

Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid.


## Recommendation

Update to version 0.1.3 or later.
Vulnerability: GHSA-w6gv-3r3v-gwgj
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-2585
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2018-10-18T16:47:41Z

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
Vulnerability: GHSA-x6fg-f45m-jf5q
Summary: Regular Expression Denial of Service in semver
Aliases: CVE-2015-8855
Severity: HIGH
CVSS score: 7.5
Published: 2017-10-24T18:33:36Z

Versions 4.3.1 and earlier of `semver` are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.



## Recommendation

Update to version 4.3.2 or later
Vulnerability: GHSA-c3xq-cj8f-7829
Summary: Inadequate Encryption Strength in python-keystoneclient
Aliases: CVE-2013-2166
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-326
Published: 2021-10-12T16:31:43Z

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass
Vulnerability: GHSA-p33q-w45h-2hcj
Summary: Malicious Package in 4equest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:30:03Z

All versions of `4equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-55r9-7mf8-m382
Summary: Cross-site Scripting in edge.js
Aliases: CVE-2021-23443
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79, CWE-843
Published: 2021-09-22T20:36:46Z

Edge is a logical and batteries included template engine for Node.js. This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.
Vulnerability: GHSA-pfr3-87q3-65rc
Summary: Cross-site Scripting in vmd
Aliases: CVE-2021-33041
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T23:46:28Z

vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').execSync('calc.exe') on Windows and a similar attack on macOS.
Vulnerability: GHSA-8w94-cf6g-c8mg
Summary: Man-in-the-Middle (MitM)
Aliases: CVE-2014-5277
Severity: MODERATE
CVSS score: 5.3
Published: 2022-02-15T01:57:18Z

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
Vulnerability: GHSA-rv6r-3f5q-9rgx
Summary: Twisted SSH client and server deny of service during SSH handshake.
Aliases: CVE-2022-21716
Severity: HIGH
CVSS score: 7.5
CWE: CWE-120
Published: 2022-03-03T19:02:08Z

### Impact

The Twisted SSH client and server implementation naively accepted an infinite amount of data for the  peer's SSH version identifier.

A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 < /dev/zero`.

### Patches

The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1

A fix is available in Twisted 22.2.0.

### Workarounds

* Limit access to the SSH server only to trusted source IP addresses.
* Connect over SSH only to trusted destination IP addresses.

### References

Reported at https://twistedmatrix.com/trac/ticket/10284
Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx

### For more information

Found by vin01
Vulnerability: GHSA-g8rg-7rpr-cwr2
Summary: Information Disclosure in TYPO3 extension sf_event_mgt
Aliases: CVE-2020-25026
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-863
Published: 2020-09-02T18:03:26Z

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. 

Another missing access check in the backend module allows an authenticated backend user to send emails to event participants for events which the user does not have access to, resulting in Broken Access Control.

External reference: [https://typo3.org/security/advisory/typo3-ext-sa-2020-017](https://typo3.org/security/advisory/typo3-ext-sa-2020-017)
Vulnerability: GHSA-9vpm-rcf4-9wqw
Summary: Division by 0 in `MaxPoolGradWithArgmax`
Aliases: CVE-2021-29573
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:26:07Z

### Impact
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` is vulnerable to a division by 0:

```python
import tensorflow as tf

input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
grad = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
argmax = tf.constant([], shape=[0], dtype=tf.int64)
ksize = [1, 1, 1, 1]
strides = [1, 1, 1, 1]

tf.raw_ops.MaxPoolGradWithArgmax(
  input=input, grad=grad, argmax=argmax, ksize=ksize, strides=strides,
  padding='SAME', include_batch_in_index=False)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/279bab6efa22752a2827621b7edb56a730233bd8/tensorflow/core/kernels/maxpooling_op.cc#L1033-L1034) fails to validate that the batch dimension of the tensor is non-zero, before dividing by this quantity.

### Patches
We have patched the issue in GitHub commit [376c352a37ce5a68b721406dc7e77ac4b6cf483d](https://github.com/tensorflow/tensorflow/commit/376c352a37ce5a68b721406dc7e77ac4b6cf483d).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-vp77-fqqp-79j8
Summary: Prototype Pollution in decal
Aliases: CVE-2020-28449
Severity: HIGH
CVSS score: 8.6
CWE: CWE-400, CWE-1321
Published: 2021-04-13T15:20:27Z

This affects all versions of package decal. The vulnerability is in the set function.
Vulnerability: GHSA-8jxj-9r5f-w3m2
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-3866
Severity: LOW
CVSS score: 0
Published: 2017-10-24T18:33:37Z

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Vulnerability: GHSA-hv53-vf5m-8q94
Summary: Validation bypass vulnerability 
Severity: LOW
CVSS score: 0
Published: 2022-02-11T23:28:20Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-874w-m2v2-mj64
Summary: Double Free in Adplug
Aliases: CVE-2019-15151
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-03-29T20:48:45Z

AdPlug 2.3.1 has a double free in the Cu6mPlayer class in u6m.h.
Vulnerability: GHSA-mgv2-57vj-99xc
Summary: Low severity vulnerability that affects eye.js
Severity: LOW
CVSS score: 0
Published: 2019-10-07T16:54:24Z

## Test breaking

### Impact
In v1.2.0, tests are broken: all tests are always succeeding. If tests are looking for security vulnerabilities, these were compromised.

### Patches
Users should upgrade to `v1.2.1`

### Workarounds
Users who don't use eye.js for looking for vulnerabilities are safe. Upgrading will just fix some bugs.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [EyeJS](https://github.com/arguiot/EyeJS)
* Email us at [arguiot@gmail.com](mailto:arguiot@gmail.com)
Vulnerability: GHSA-5mj6-3cmq-fh34
Summary: showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
Aliases: CVE-2022-0079
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-209
Published: 2022-01-06T22:22:46Z

showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
Vulnerability: GHSA-2wpq-vvw6-67wr
Summary: Hijacked Environment Variables in nodecaffe
Aliases: CVE-2017-16070
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506, CWE-433
Published: 2018-08-29T23:38:35Z

The `nodecaffe` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-p7w2-mc6m-mfx2
Summary: Malicious Package in scroool
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:22:25Z

Version 0.1.7 of `scroool` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-v84g-cf5j-xjqx
Summary: Path Traversal in Apache James Server
Aliases: CVE-2022-22931
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2022-02-08T00:00:34Z

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
Vulnerability: GHSA-rmh2-65xw-9m6q
Summary: Infinite Loop in jsonparser
Aliases: CVE-2020-10675
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-835
Published: 2021-05-18T18:26:25Z

The Library API in buger jsonparser through 2019-12-04 allows attackers to cause a denial of service (infinite loop) via a Delete call.
Vulnerability: GHSA-g5rr-p69h-7v3g
Summary: Insufficient type validation in pocketmine/pocketmine-mp
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-1287
Published: 2022-04-22T20:57:12Z

When an inventory interaction is performed (e.g. moving an item around an inventory), the client sends a serialized version of the itemstack to the server, which the server then deserializes and compares against its own copy. If the copies don't match, the transaction is invalid. This involves deserializing item NBT from the client, which allows for bogus data to be provided. Usually, this is harmless, but in this particular case, it could result in crashes on certain types of bad data (e.g. incorrect ListTag type provided for the `CanDestroy` tag). This is fixed in 4.2.9 by commit 5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2. It's non-trivial to workaround this, but can be done by handling `InventoryTransactionPacket` and `PlayerAuthInputPacket` to scrub inbound transaction data of bogus NBT that would cause these crashes.
Vulnerability: GHSA-m8h6-m9p5-p2f8
Summary: Moderate severity vulnerability that affects activerecord
Severity: MODERATE
CVSS score: 0
Published: 2018-08-13T20:49:01Z

Withdrawn, accidental duplicate publish.

Active Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.
Vulnerability: GHSA-cr5j-953j-xw5p
Summary: Arbitrary execution of code in Nokogiri
Aliases: CVE-2019-5477
Severity: HIGH
CVSS score: 0
CWE: CWE-78
Published: 2019-08-19T19:27:23Z

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
Vulnerability: GHSA-f2c5-997w-7f5c
Summary: Cross-site Scripting in peertube
Aliases: CVE-2021-3780
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-09-20T20:42:41Z

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers.
Vulnerability: GHSA-qjf4-7642-c57p
Summary: Downloads Resources over HTTP in unicode
Aliases: CVE-2016-10578
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:51:52Z

Affected versions of `unicode` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 9.0.0 or later.
Vulnerability: GHSA-h6xx-pmxh-3wgp
Summary: Improper Authentication in etcd
Aliases: CVE-2018-16886
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287, CWE-285
Published: 2022-02-15T01:57:18Z

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
Vulnerability: GHSA-488m-6gh8-9j36
Summary: Moderate severity vulnerability that affects bracket-template
Aliases: CVE-2018-3735
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-27T17:05:06Z

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template
Vulnerability: GHSA-h9q8-5gv2-v6mg
Summary: Potential Session Hijacking
Severity: LOW
CVSS score: 0
CWE: CWE-613
Published: 2021-03-12T23:09:08Z

### Impact
Potential session hijacking of store customers.

### Patches
We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021
Vulnerability: GHSA-mx3x-ghqm-r43h
Summary: Prototype pollution vulnerability in 'predefine'
Aliases: CVE-2020-28280
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-10-12T16:27:18Z

Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-95rw-fx8r-36v6
Summary: Cross-site Scripting in Django
Aliases: CVE-2022-22818
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-04T00:00:33Z

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
Vulnerability: GHSA-gx73-2498-r55c
Summary: Unsound casting in flatbuffers
Aliases: CVE-2019-25004
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-704
Published: 2021-08-25T20:46:49Z

An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. Arbitrary bytes can be reinterpreted as a bool, defeating soundness.
Vulnerability: GHSA-2x7v-w2mv-f3rx
Summary: Improper Authentication in Atlassian Connect Spring Boot
Aliases: CVE-2021-26077
Severity: HIGH
CVSS score: 8.8
CWE: CWE-287
Published: 2021-06-16T17:23:12Z

Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
Vulnerability: GHSA-v569-g72v-q434
Summary: Low severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-1296
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2019-02-12T17:26:12Z

In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Vulnerability: GHSA-m22m-h4rf-pwq3
Summary: Path Traversal in SharpZipLib
Aliases: CVE-2021-32840
Severity: HIGH
CVSS score: 7.3
CWE: CWE-22
Published: 2022-02-01T16:22:50Z

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
Vulnerability: GHSA-p82g-2xpp-m5r3
Summary: Cross-Site Scripting in dojo
Aliases: CVE-2015-5654
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-09-11T21:18:05Z

Versions of `dojo` prior to 1.2.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize HTML code in user-controlled input, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-4gp3-p7ph-x2jr
Summary: OS Command Injection in devcert-sanscache
Aliases: CVE-2019-10778
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-04-14T23:09:00Z

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.
Vulnerability: GHSA-hvpr-9cr6-q5v7
Summary: High severity vulnerability that affects org.apache.camel:camel-snakeyaml
Aliases: CVE-2017-3159
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-16T17:21:42Z

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
Vulnerability: GHSA-33wf-4crm-2322
Summary: Improper Access Control in librenms
Aliases: CVE-2022-0580
Severity: HIGH
CVSS score: 7.1
CWE: CWE-284
Published: 2022-02-16T00:01:58Z

Improper Access Control in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-7hjp-97g3-rq93
Summary: Moderate severity vulnerability that affects net.mingsoft:ms-mcms
Aliases: CVE-2018-18831
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-11-01T14:47:04Z

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter.
Vulnerability: GHSA-3h5r-928v-mxhh
Summary: Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Severity: LOW
CVSS score: 2.6
CWE: CWE-754
Published: 2021-04-19T14:49:13Z

Missing check in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

- https://vaadin.com/security/cve-2018-25007
Vulnerability: GHSA-3mpr-hq3p-49h9
Summary: Prototype Pollution in mixin-deep
Aliases: CVE-2018-3719
Severity: LOW
CVSS score: 0
CWE: CWE-471
Published: 2018-07-26T15:10:54Z

Versions of `mixin-deep` before 1.3.1 are vulnerable to prototype pollution via merging functions.


## Recommendation

Update to version 1.3.1 or later.
Vulnerability: GHSA-wph3-44rj-92pr
Summary: Multiple vulnerabilities leading to RCE
Aliases: CVE-2021-32682
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-918, CWE-22, CWE-78
Published: 2021-06-16T17:04:29Z

### Impact

We recently fixed several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with the minimal configuration. 

### Patches

The issues were addressed in our last release, 2.1.59. 

### Workarounds

If you can't update to 2.1.59, make sure your connector is not exposed without authentication.

### Reference

Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
    - The original reporters, by sending an email to vulnerability.research@sonarsource.com;
    - The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-636j-7x7r-gvw2
Summary: Old sessions not blocked by login enable function in Snipe-IT
Aliases: CVE-2022-1155
Severity: HIGH
CVSS score: 7.4
CWE: CWE-613
Published: 2022-03-31T00:00:22Z

Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using the KillAllSessions console command, clearing the contents of the storage/framework/sessions directory, or changing the cookie name, but all of those options logout ALL users, which could be kind of annoying. This issue is fixed in versions 6.0.0-RC-6 and 5.4.2.
Vulnerability: GHSA-ww4j-c2rq-47q8
Summary: Command injection in ts-process-promises
Aliases: CVE-2020-7784
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2021-01-13T18:22:28Z

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js.
Vulnerability: GHSA-ww4x-rwq6-qpgf
Summary: Cross-site Request Forgery in OmniAuth
Aliases: CVE-2015-9284
Severity: HIGH
CVSS score: 0
CWE: CWE-352
Published: 2019-05-29T19:11:31Z

The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.

There is currently no fixed version of this package, however there is a recommended remediation described [here](https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284).
Vulnerability: GHSA-xx68-jfcg-xmmf
Summary: High severity vulnerability that affects commons-fileupload:commons-fileupload
Aliases: CVE-2014-0050
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2018-12-21T17:51:42Z

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Vulnerability: GHSA-4x25-f45x-grv5
Summary: Missing encryption in Apache Directory Studio
Aliases: CVE-2021-33900
Severity: HIGH
CVSS score: 7.5
CWE: CWE-311
Published: 2021-08-09T20:40:53Z

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
Vulnerability: GHSA-5pv8-ppvj-4h68
Summary: Prevent user enumeration using Guard or the new Authenticator-based Security
Aliases: CVE-2021-21424
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-05-13T20:23:02Z

Description
-----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.

Resolution
----------

We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011) for branch 3.4.

Credits
-------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Vulnerability: GHSA-7vq3-wcjw-3fxh
Summary: Directory Traversal in lab6.brit95
Aliases: CVE-2017-16140
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:48:53Z

Affected versions of `lab6.brit95` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4v37-24gm-h554
Summary: Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
Aliases: CVE-2022-24712
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-352
Published: 2022-03-01T21:47:28Z

### Impact
This vulnerability might allow remote attackers to bypass the CodeIgniter4 CSRF protection mechanism. 

### Patches
Upgrade to v4.1.9 or later.

### Workarounds
These are workarounds for this vulnerability, but **you will still need to code as these after upgrading to v4.1.9**.
Otherwise, the CSRF protection may be bypassed.

#### When Auto-Routing is Enabled
1. Check the request method in the controller method before processing.

E.g.:
```php
        if (strtolower($this->request->getMethod()) !== 'post') {
            return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
        }
```

#### When Auto-Routing is Disabled
Do one of the following:
1. Do not use `$routes->add()`, and [use HTTP verbs in routes](https://codeigniter4.github.io/userguide/incoming/routing.html#using-http-verbs-in-routes).
2. Check the request method in the controller method before processing.

E.g.:
```php
        if (strtolower($this->request->getMethod()) !== 'post') {
            return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
        }
```

### References
- [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html#cross-site-request-forgery-csrf)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-83rx-c8cr-6j8q
Summary: Insecure Default Configuration in tesseract.js
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-829
Published: 2019-06-05T20:48:55Z

Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy.  Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations.


## Recommendation

Upgrade to version 1.0.19 or later.
Vulnerability: GHSA-27j5-4p9v-pp67
Summary: `std::abort` raised from `TensorListReserve`
Aliases: CVE-2021-37644
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-617
Published: 2021-08-25T14:43:40Z

### Impact
Providing a negative element to `num_elements` list argument of  `tf.raw_ops.TensorListReserve` causes the runtime to abort the process due to reallocating a `std::vector` to have a negative number of elements:

```python
import tensorflow as tf

tf.raw_ops.TensorListReserve(
  element_shape = tf.constant([1]),
  num_elements=tf.constant([-1]),
  element_dtype = tf.int32)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/list_kernels.cc#L312) calls `std::vector.resize()` with the new size controlled by input given by the user, without checking that this input is valid.

### Patches
We have patched the issue in GitHub commit [8a6e874437670045e6c7dc6154c7412b4a2135e2](https://github.com/tensorflow/tensorflow/commit/8a6e874437670045e6c7dc6154c7412b4a2135e2).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-37cf-r3w2-gjfw
Summary: django-nopassword stores secrets in cleartext 
Aliases: CVE-2019-10682
Severity: HIGH
CVSS score: 7.5
CWE: CWE-312, CWE-522
Published: 2020-06-05T16:09:19Z

django-nopassword before 5.0.0 stores cleartext secrets in the database.
Vulnerability: GHSA-rjqq-98f6-6j3r
Summary: Improper Input Validation in sanitize-html
Aliases: CVE-2021-26539
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-05-06T16:10:05Z

Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
Vulnerability: GHSA-g2c4-4m64-vxm3
Summary: Malicious Package in buffer-yor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:15:25Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-pfj7-w373-gqch
Summary: Cross-Site Request Forgery in firefly-iii
Aliases: CVE-2021-3900
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2021-10-28T23:14:21Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-p2q9-9cq6-h3jw
Summary: Out of bounds read in Ozone
Aliases: CVE-2020-35877
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2021-08-25T20:47:46Z

An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of out-of-bounds access.
Vulnerability: GHSA-8wx2-9q48-vm9r
Summary: RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
Aliases: CVE-2020-5398
Severity: HIGH
CVSS score: 7.5
CWE: CWE-79, CWE-494
Published: 2020-01-21T20:59:09Z

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Vulnerability: GHSA-c27r-x354-4m68
Summary: HMAC-SHA1 signatures can bypass validation via key confusion
Severity: HIGH
CVSS score: 0
CWE: CWE-287
Published: 2020-10-27T20:39:46Z

### Impact
An attacker can inject an HMAC-SHA1 signature that is valid using only knowledge of the RSA public key. This allows bypassing signature validation.

### Patches
Version 2.0.0 has the fix.

### Workarounds
The recommendation is to upgrade. In case that is not possible remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from SignedXml.SignatureAlgorithms.
Vulnerability: GHSA-8fqx-7pv4-3jwm
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2008-7248
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Vulnerability: GHSA-wrx7-qgmj-mf2q
Summary: Server-Side Request Forgery in Apache Kylin
Aliases: CVE-2021-27738
Severity: MODERATE
CVSS score: 0
CWE: CWE-918
Published: 2022-01-08T00:43:04Z

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.
Vulnerability: GHSA-9fcp-vcq9-9h2h
Summary: Moderate severity vulnerability that affects org.craftercms:crafter-studio
Aliases: CVE-2018-19907
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2018-12-19T19:24:18Z

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.
Vulnerability: GHSA-qmxf-fxq7-w59f
Summary: Malicious Package in angular-material-sidenav-rnd
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:43:53Z

Version 0.1.1 of `angular-material-sidenav-rnd` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 0.1.1 of this module is found installed you will want to replace it with a version before or after 0.1.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-x92h-wmg2-6hp7
Summary: Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
Aliases: CVE-2019-10913
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89, CWE-79
Published: 2019-12-02T18:10:24Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
Vulnerability: GHSA-jrmq-rv9w-63rv
Summary: Umbraco ApplicationURL Overwrite
Aliases: CVE-2022-22690
Severity: HIGH
CVSS score: 8.6
CWE: CWE-444
Published: 2022-01-21T23:34:24Z

Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the "UmbracoApplicationUrl" is used. For example, the attacker is able to change the URL users receive when resetting their password so that it points to the attackers server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.
Vulnerability: GHSA-27rq-4943-qcwp
Summary: Insertion of Sensitive Information into Log File in Hashicorp go-getter
Aliases: CVE-2022-29810
Severity: MODERATE
CVSS score: 0
CWE: CWE-532
Published: 2022-04-28T00:00:35Z

The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.
Vulnerability: GHSA-2467-h365-j7hm
Summary: Improper Input Validation in Apache Solr
Aliases: CVE-2020-13941
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-20
Published: 2022-02-10T00:31:31Z

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
Vulnerability: GHSA-h3cq-j957-vhxg
Summary: Cross-site Scripting in fullpage.js
Aliases: CVE-2022-1330
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-13T00:00:16Z

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element.
Vulnerability: GHSA-724c-6vrf-99rq
Summary: Sensitive Data Exposure in loopback
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2020-09-02T21:49:48Z

Versions of `loopback` prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.


## Recommendation

If you're using `loopback` 3.x upgrade to version 3.26.0 or later.
If you're using `loopback` 2.x upgrade to version 2.42.0 or later.
Vulnerability: GHSA-x6ch-c6rv-f7wh
Summary: Malicious Package in asymc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:34:22Z

All versions of `asymc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-4pf7-579w-f4gm
Summary: Downloads Resources over HTTP in dwebp-bin
Aliases: CVE-2016-10633
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:57:04Z

Affected versions of `dwebp-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dwebp-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.