TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-77mr-wc79-m8j3
Summary: A validation function with the same name as a built-in validator can be called
Aliases: CVE-2021-3603
Severity: LOW
CVSS score: 0
CWE: CWE-74
Published: 2021-06-22T15:18:02Z

If a function is defined that has the same name as the default built-in email address validation scheme (`php`), it will be called in default configuration as when no validation scheme is provided, the default scheme's callable `php` was being called. If an attacker is able to inject such a function into the application (a much bigger issue), it will be called whenever an email address is validated, such as when calling `validateAddress()`.

### Impact
Low impact – exploitation requires that an attacker can already inject code into an application, but it provides a trigger pathway.

### Patches
This is patched in PHPMailer 6.5.0 by denying the use of simple strings as validator function names, which is a very minor BC break.

### Workarounds
Inject your own email validator function.

### References
Reported by [Vikrant Singh Chauhan](mailto:vi@hackberry.xyz) via [huntr.dev](https://www.huntr.dev/).
[CVE-2021-3603](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
* [Email us](mailto:phpmailer@synchromedia.co.uk).
Vulnerability: GHSA-hx78-272p-mqqh
Summary: Authorization Bypass in graphql-shield
Severity: LOW
CVSS score: 0
CWE: CWE-285
Published: 2020-09-03T19:21:11Z

Versions of `graphql-shield` prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option `no_cache` relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.


## Recommendation

Upgrade to version 6.0.6 or later.
Vulnerability: GHSA-wrvw-hg22-4m67
Summary: A potential Denial of Service issue in protobuf-java
Aliases: CVE-2021-22569
Severity: HIGH
CVSS score: 7.5
CWE: CWE-696
Published: 2022-01-07T22:31:44Z

## Summary

A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data.

Reporter: [OSS-Fuzz](https://github.com/google/oss-fuzz)

Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below. Protobuf "javalite" users (typically Android) are not affected.

## Severity

[CVE-2021-22569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22569) **High** - CVSS Score: 7.5,  An implementation weakness in how unknown fields are parsed in Java. A small (~800 KB) malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses.

## Proof of Concept

For reproduction details, please refer to the oss-fuzz issue that identifies the specific inputs that exercise this parsing weakness.

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

- protobuf-java (3.16.1, 3.18.2, 3.19.2) 
- protobuf-kotlin (3.18.2, 3.19.2)
- google-protobuf [JRuby  gem only] (3.19.2)
Vulnerability: GHSA-r96p-v3cr-gfv8
Summary: Cross-site Scripting (XSS) in @scullyio/scully
Aliases: CVE-2020-28470
Severity: HIGH
CVSS score: 7.3
CWE: CWE-79
Published: 2021-04-13T15:28:01Z

This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.
Vulnerability: GHSA-5vm8-hhgr-jcjp
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-05-28T19:18:53Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser for `form` elements. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs, and then submitting the form. However, as TinyMCE does not allow forms to be submitted while editing, the vulnerability could only be triggered when the content was previewed or rendered outside of the editor. This impacts all users who are using TinyMCE 5.7.0 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.7.1 by improved URL sanitization logic.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.7.1 or higher
- Manually sanitize `form` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter).
- Disable `form` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.

#### Example: Sanitizing using a node filter
```js
editor.parser.addNodeFilter('form', function(nodes) {
  nodes.forEach(function(node) {
    if (node.attributes) {
      node.attributes.forEach(function(attr) {
        var name = attr.name;
        var value = attr.value;
        // Sanitize the attribute value here or remove it entirely
        var sanitizedValue = ...;
        node.attr(name, santizedValue);
      });
    }
  });
});
```

#### Example: Using invalid_elements
```js
invalid_elements: 'form'
```

### Acknowledgements
Tiny Technologies would like to thank Mikhail Khramenkov at Solar Security Research Team for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes571/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-5p34-5m6p-p58g
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-9546
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-04-23T21:08:40Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
Vulnerability: GHSA-gwfq-qwmp-x9xg
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-10087
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-10-11T18:41:50Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-q4qv-fmwc-qxpx
Summary: SQL Injection in NukeViet
Aliases: CVE-2019-7726
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-06-22T15:24:55Z

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).
Vulnerability: GHSA-5gvm-hrw5-h6xf
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2015-1772
Severity: HIGH
CVSS score: 7.3
CWE: CWE-287
Published: 2019-03-14T15:40:44Z

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
Vulnerability: GHSA-9cc3-5w85-pxvx
Summary: Cross Site Request Forgery in intelliants/subrion
Aliases: CVE-2020-18326
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-03-05T00:00:45Z

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user.
Vulnerability: GHSA-6g8v-hpgw-h2v7
Summary: Prototype pollution in gsap
Aliases: CVE-2020-28478
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-01-20T21:21:50Z

There is a prototype pollution vulnerability in gsap which affects all versions before 3.6.0.
Vulnerability: GHSA-78hj-86cr-6j2v
Summary: Improper Access Control in Lightning Network Daemon
Aliases: CVE-2019-12999
Severity: HIGH
CVSS score: 7.5
CWE: CWE-284
Published: 2021-05-18T15:30:22Z

Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.
Vulnerability: GHSA-c5qq-g673-5p49
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-1989
Severity: LOW
CVSS score: 0
Published: 2017-10-24T18:33:38Z

telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
Vulnerability: GHSA-hpmr-prr2-cqc4
Summary: Remote Code Execution
Aliases: CVE-2019-11229
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94
Published: 2022-02-15T01:57:18Z

models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.
Vulnerability: GHSA-jggw-2q6g-c3m6
Summary: Out-of-bounds Read in OpenCV
Aliases: CVE-2019-19624
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-125
Published: 2021-10-12T22:22:58Z

An out-of-bounds read was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.0.25). Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.
Vulnerability: GHSA-jvx5-rm6q-gx7p
Summary: Lack of access control on upoaded files
Aliases: CVE-2019-12245
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-732
Published: 2019-11-12T23:01:50Z

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Vulnerability: GHSA-wp3c-xw9g-gpcg
Summary: Lack of validation in `SparseDenseCwiseMul`
Aliases: CVE-2021-29567
Severity: LOW
CVSS score: 2.5
CWE: CWE-617
Published: 2021-05-21T14:25:16Z

### Impact
Due to lack of validation in `tf.raw_ops.SparseDenseCwiseMul`, an attacker can trigger denial of service via `CHECK`-fails or accesses to outside the bounds of heap allocated data:

```python
import tensorflow as tf

indices = tf.constant([], shape=[10, 0], dtype=tf.int64)
values = tf.constant([], shape=[0], dtype=tf.int64)
shape = tf.constant([0, 0], shape=[2], dtype=tf.int64)
dense = tf.constant([], shape=[0], dtype=tf.int64)
  
tf.raw_ops.SparseDenseCwiseMul(
    sp_indices=indices, sp_values=values, sp_shape=shape, dense=dense)
```

Since the [implementation](https://github.com/tensorflow/tensorflow/blob/38178a2f7a681a7835bb0912702a134bfe3b4d84/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L68-L80) only validates the rank of the input arguments but no [constraints between dimensions](https://www.tensorflow.org/api_docs/python/tf/raw_ops/SparseDenseCwiseMul), an attacker can abuse them to trigger internal `CHECK` assertions (and cause program termination, denial of service) or to write to memory outside of bounds of heap allocated tensor buffers.

### Patches
We have patched the issue in GitHub commit [7ae2af34087fb4b5c8915279efd03da3b81028bc](https://github.com/tensorflow/tensorflow/commit/7ae2af34087fb4b5c8915279efd03da3b81028bc).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-9pr6-grf4-x2fr
Summary: Omniauth allows POST parameters to be stored in session
Aliases: CVE-2017-18076
Severity: HIGH
CVSS score: 7.5
Published: 2018-01-29T15:45:28Z

In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become available in the environment of the callback phase.
Vulnerability: GHSA-xvwv-6wvx-px9x
Summary: Moderate severity vulnerability that affects plone
Aliases: CVE-2017-1000484
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2019-01-04T17:47:21Z

By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
Vulnerability: GHSA-m4jx-6526-vvhm
Summary: Denial of service in github.com/nats-io/nats-server/server
Aliases: CVE-2020-28466
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-15T01:57:18Z

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers - Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
Vulnerability: GHSA-c84h-w6cr-5v8q
Summary: Markdown-supplied Shell Command Execution
Aliases: CVE-2020-15271
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-78
Published: 2020-10-27T17:59:54Z

### Impact

lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.

### Patches

Users should upgrade to lookatme versions 2.3.0 or above.

### Workarounds

The `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.

### References

* https://github.com/d0c-s4vage/lookatme/pull/110
* https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [d0c-s4vage/lookatme](https://github.com/d0c-s4vage/lookatme)
Vulnerability: GHSA-2qgv-2cv4-g4cg
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0832
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:57:27Z

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-5gwh-g79j-vh4q
Summary: Command Injection in pdf-image
Aliases: CVE-2018-3757
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-09-01T20:44:52Z

Versions of `pdf-image` before 2.0.0 are vulnerable to command injection. This vulnerability is exploitable if the attacker has control over the `pdfFilePath` variable passed into `pdf-image`.


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-x5rq-j2xg-h7qm
Summary: Regular Expression Denial of Service (ReDoS) in lodash
Aliases: CVE-2019-1010266
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-07-19T16:13:07Z

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.
Vulnerability: GHSA-89ch-hqf9-rgp3
Summary: Outdated versions of JS libraries used with known security vulnerabilities
Aliases: CVE-2019-8121
Severity: HIGH
CVSS score: 0
Published: 2019-11-12T22:59:28Z

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.
Vulnerability: GHSA-r5hc-wm3g-hjw6
Summary: Server-Side Request Forgery (SSRF) in rudloff/alltube
Aliases: CVE-2022-0768
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-918
Published: 2022-03-01T22:01:30Z

### Impact
Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname.

### Patches
3.0.2 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

Part of the fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/148a171b240e7ceb076b9e198bef412de14ac55d/patches/youtube-dl-redirect.diff) to youtube-dl to prevent it from following HTTP redirects. If you are using the version of youtube-dl bundled with 3.0.2, it is already patched.
However, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.

### References
* https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d
* https://github.com/Rudloff/alltube/commit/1b099bb9836a3ce7c427a41722a7ab5a3d1c1b2d
* https://huntr.dev/bounties/9b14cc46-ec08-4940-83cc-9f986b2a5903/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0768
* https://github.com/ytdl-org/youtube-dl/issues/30691
Vulnerability: GHSA-4ffq-6g62-j4v4
Summary: Cross-Site Request Forgery in the Jenkins Claim plugin
Aliases: CVE-2021-21620
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-06-16T17:29:43Z

A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims.
Vulnerability: GHSA-qjg4-w4c6-f6c6
Summary: Command injection in mversion
Aliases: CVE-2020-4059
Severity: HIGH
CVSS score: 7.3
CWE: CWE-77
Published: 2020-06-18T19:23:17Z

### Impact
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

### Patches
Patched by version 2.0.0. Previous releases are deprecated in npm.

### Workarounds
Make sure to escape git commit messages when using the commitMessage option for the update function.
Vulnerability: GHSA-5hx2-qx8j-qjqm
Summary: Overflow/crash in `tf.image.resize` when size is large
Aliases: CVE-2021-41199
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-190
Published: 2021-11-10T19:33:24Z

### Impact
If `tf.image.resize` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow.

```python
import tensorflow as tf
import numpy as np

tf.keras.layers.UpSampling2D(
  size=1610637938,
  data_format='channels_first',
  interpolation='bilinear')(np.ones((5,1,1,1)))
```

The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process.

### Patches
We have patched the issue in GitHub commit [e5272d4204ff5b46136a1ef1204fc00597e21837](https://github.com/tensorflow/tensorflow/commit/e5272d4204ff5b46136a1ef1204fc00597e21837) (merging [#51497](https://github.com/tensorflow/tensorflow/pull/51497)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46914).
Vulnerability: GHSA-mvr2-9pj6-7w5j
Summary: Denial of Service in Google Guava
Aliases: CVE-2018-10237
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-502, CWE-770
Published: 2020-06-15T20:35:11Z

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
Vulnerability: GHSA-45hc-r4fj-qj89
Summary: SQL injection in pagekit/pagekit
Aliases: CVE-2021-44135
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-04-02T00:00:15Z

Pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. The configAction in SettingsController allow user to set the order of comments listing. The allowed options are ASC and DESC. That config then get concatenated directly to the SQL query. Due to the fact that there wasnt any sanitizion before saving that config, it can lead to the SQL Injection vulnerability.
Vulnerability: GHSA-8mrf-g42m-5qc8
Summary: Downloads Resources over HTTP in dalek-browser-chrome-canary
Aliases: CVE-2016-10584
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:51:14Z

Affected versions of `dalek-browser-chrome-canary` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-chrome-canary`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m3ww-7hrp-gw9w
Summary: Drop of uninitialized memory in Ozone
Aliases: CVE-2020-35878
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119, CWE-908
Published: 2021-08-25T20:47:41Z

An issue was discovered in the ozone crate through 2020-07-04 for Rust. Memory safety is violated because of the dropping of uninitialized memory.
Vulnerability: GHSA-rhh9-cm65-3w54
Summary: Improper Authentication in Apache Hadoop
Aliases: CVE-2018-11765
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2021-04-30T17:29:30Z

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Vulnerability: GHSA-prr5-pfr8-q9f3
Summary: Moderate severity vulnerability that affects Plone
Aliases: CVE-2012-5503
Severity: MODERATE
CVSS score: 0
Published: 2018-07-23T19:52:35Z

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.
Vulnerability: GHSA-87xh-9q6h-r5cc
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45715
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:00:49Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free.
Vulnerability: GHSA-3fv6-q5xv-fhpw
Summary: Malicious Package in coffee-project
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T19:50:23Z

Version 1.7.5 of `coffee-project` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.7.5 of this module is found installed you will want to replace it with a version before or after 1.7.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-254q-rqmw-vx45
Summary: Exposure of Sensitive Information to an Unauthorized Actor in librenms
Aliases: CVE-2022-0588
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2022-02-16T00:01:52Z

Exposure of Sensitive Information to an Unauthorized Actor in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-35vc-w93w-75c2
Summary: JWT leak via Open Redirect in Programmatic access
Aliases: CVE-2021-29651
Severity: HIGH
CVSS score: 6.3
CWE: CWE-200, CWE-601
Published: 2021-05-21T16:24:34Z

### Impact
Using programmatic access on protected sites, one can get a signed login URL with pomerium_redirect_uri set to an arbitrary URL. Then, if the user has already logged into Pomerium, they will be redirected to the specified pomerium_redirect_uri with a JWT attached. This allows an outside attacker to get a signed login URL that, upon visiting it, will redirect a victim to the attacker’s site. This creates an issue of Open Redirect and, more seriously, JWT leakage.

With a leaked JWT, the attacker will be able to unveil the victim’s identity (.e.g. email address) by supplying the JWT to the authenticate service or verify.pomerium.com. In addition, if an application integrating Pomerium only verifies the iss claim and others but not the aud claim, the attacker will be able to access it as the victim.

### Patches
Patched in Pomerium v0.13.4

### For more information
If you have any questions or comments about this advisory
* Open an issue in [pomerium](http://github.com/pomerium/pomerium)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-j85f-xw9x-ffwp
Summary: yetiforcecrm is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4121
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2021-12-17T20:00:12Z

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-8rhc-48pp-52gr
Summary: High severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2017-12612
Severity: HIGH
CVSS score: 7.8
CWE: CWE-502
Published: 2018-11-09T17:43:25Z

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.1.2, 2.2.0 or later.
Vulnerability: GHSA-m6gj-h9gm-gw44
Summary: Incorrect Default Permissions
Aliases: CVE-2020-24583
Severity: HIGH
CVSS score: 7.5
CWE: CWE-276
Published: 2021-03-18T20:30:13Z

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). FILE_UPLOAD_DIRECTORY_PERMISSIONS mode was not applied to intermediate-level directories created in the process of uploading files. It was also not applied to intermediate-level collected static directories when using the collectstatic management command.
Vulnerability: GHSA-xhqq-x44f-9fgg
Summary: Authentication Bypass in github.com/russellhaering/gosaml2
Aliases: CVE-2020-29509
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-115
Published: 2022-02-11T23:58:09Z

### Impact
Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed.

Depending on the implementation of the Service Provider this enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the Identity Provider, or full authentication bypass.

### Patches
Service Providers utilizing gosaml2 should upgrade to v0.6.0 or greater.
Vulnerability: GHSA-gwc9-348x-qwv2
Summary: Use after free in Wasmtime
Aliases: CVE-2022-24791
Severity: HIGH
CVSS score: 8.1
CWE: CWE-416
Published: 2022-04-01T13:36:12Z

There is a use after free vulnerability in Wasmtime when both running Wasm that uses `externref`s and enabling [epoch interruption](https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.epoch_interruption) in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected.

The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-early references, which is a use after free.

This bug was discovered while extending our fuzz targets for `externref`s and GC in Wasmtime. The updated fuzz target thoroughly exercises these code paths and feature combinations now. We have also added a regression test for this bug. Released versions 0.34.2 and 0.35.2, which fix the vulnerability. We recommend all Wasmtime users upgrade to these patched versions. If upgrading is not an option for you at this time, you can avoid the vulnerability by either disabling the Wasm reference types proposal or by disabling epoch interruption if you were previously enabling it.
Vulnerability: GHSA-qq5v-f4c3-395c
Summary: Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2
Aliases: CVE-2021-23347
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-79
Published: 2021-05-21T14:31:41Z

### Impact

When using SSO with the Argo CD CLI, a malicious SSO provider could have sent specially crafted error message that would result in XSS on the client by means of executing arbitrary JavaScript code.

We believe the exploitation of this vulnerability is only be possible when Argo CD is connected to a compromised/malicious SSO provider.

### Patches

A patch for this vulnerability is available with the v1.8.7 and v1.7.14 releases of Argo CD.

### Workarounds

* Do not use SSO with the CLI when you don't trust your SSO provider


If you have any questions or comments about this advisory:

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`

### Credits

The issue was found during static code scanning with CodeQL and fixed by the Argo CD team. While we believed that a rogue SSO provider would pose a severe threat by itself, we fixed it like a regular bug.

The Argo CD team would like to thank Adam Gold of Snyk (https://snyk.io) for stepping up and classifying this correctly as a  security issue and for his help in determining its severity. Also, Snyk kindly reserved and provided the CVE for this vulnerability.

We fully agree with Adam that this bug is a security vulnerability and justifies publishing a SA, to provide our community and users full transparancy.
Vulnerability: GHSA-29v9-2fpx-j5g9
Summary: CSV Injection vulnerability with exported contact lists in Mautic
Aliases: CVE-2018-8092
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-1236
Published: 2021-01-19T21:16:29Z

### Impact
Mautic versions before 2.13.0 had a vulnerability that allowed a CSV injection with exported contact lists - https://www.owasp.org/index.php/CSV_Injection.

### Patches
Update to 2.13.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-3v56-q6r6-4gcw
Summary: Insecure Inherited Permissions in neoan3-apps/template
Aliases: CVE-2021-41170
Severity: HIGH
CVSS score: 7.5
CWE: CWE-732, CWE-74, CWE-277
Published: 2021-11-10T16:41:08Z

### Impact
Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously. 

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible. 


### Patches
Version 1.1.1 has addressed this vulnerability. 
```php
$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);
```

### Workarounds
Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

### References
As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [our repo](https://github.com/sroehrl/neoan3-template)
Vulnerability: GHSA-8jrj-525p-826v
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39145
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502
Published: 2021-08-25T14:48:12Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39145](https://x-stream.github.io/CVE-2021-39145.html).

### Credits
李安诺 (Li4n0) from Alibaba Cloud Security Team and Smi1e of DBAPPSecurity WEBIN Lab found and reported the issue independently to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-gh87-6jr3-8q47
Summary: Null pointer deference in cache
Aliases: CVE-2021-25903
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-08-25T20:52:57Z

An issue was discovered in the cache crate through 2021-01-01 for Rust. A raw pointer is dereferenced.
Vulnerability: GHSA-hwj9-h5mp-3pm3
Summary: Regular Expression Denial of Service in postcss
Aliases: CVE-2021-23368
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-05-10T15:29:24Z

The npm package `postcss` from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Vulnerability: GHSA-3j58-p785-f27x
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0378
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-28T22:15:24Z

There is a reflected cross sitem scripting attack in microweber via url parameters.
Vulnerability: GHSA-85cp-p426-42f5
Summary: Prototype Pollution in deep-get-set
Aliases: CVE-2020-7715
Severity: HIGH
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:12:59Z

All versions of package deep-get-set prior to version 1.1.1 are vulnerable to Prototype Pollution via the main function.
Vulnerability: GHSA-f5w6-r7rg-mcgq
Summary: Regular Expression Denial of Service in validator
Aliases: CVE-2014-8882
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-08-31T23:01:13Z

Versions of `validator` prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the `isURL` method.


## Recommendation

Update to version 3.22.1 or later.
Vulnerability: GHSA-45w7-7g63-2m5w
Summary: Drop of uninitialized memory in stack_dst
Aliases: CVE-2021-28035
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2021-09-01T18:30:55Z

Affected versions of stack_dst used a push_inner function that increased the internal length of the array and then called val.clone(). If the val.clone() call panics, the stack could drop an already dropped element or drop uninitialized memory. This issue was fixed in 2a4d538 by increasing the length of the array after elements are cloned.
Vulnerability: GHSA-38r5-34mr-mvm7
Summary: "catalog's registry v2 api exposed on unauthenticated path in Harbor"
Aliases: CVE-2020-29662
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-287, CWE-319
Published: 2022-02-12T00:01:51Z

### **Impact**
Javier Provecho, member of the TCCT (Telefonica Cloud & Cybersecurity Tech better known as ElevenPaths) SRE team discovered a vulnerability regarding Harbor’s v2 API.

The catalog’s registry v2 api is exposed on an unauthenticated path. The current catalog API path is served at the following path and it requires to be authenticated as an admin.

"GET /v2/_catalog"

However, the authorization can be bypassed by using the following path

"GET /v2/_catalog/"

### **Patches**
If your product uses the affected releases of Harbor, update to either version v2.1.2 or v2.0.5 to fix this issue immediately

https://github.com/goharbor/harbor/releases/tag/v2.1.2
https://github.com/goharbor/harbor/releases/tag/v2.0.5

### **Workarounds**
If you cannot access a patched release, it can be mitigated by disabling that API. For example, redirecting it to a 404 sink hole in the ingress.

### **For more information**
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29662
Vulnerability: GHSA-vfj6-275q-4pvm
Summary: graphite.composer.views.send_email vulnerable to SSRF
Aliases: CVE-2017-18638
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2019-10-25T13:55:20Z

### Impact
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. Email will be send through SMTP server configured in Graphite, by default it's 'localhost'

### Patches
Problem was patched in Graphite-web 1.1.6. Also patches was released for graphite-web [1.0.x](https://github.com/graphite-project/graphite-web/pull/2501) and [0.9.x](https://github.com/graphite-project/graphite-web/pull/2500), and we'll discuss releases of non-supported branches later.

### Workarounds
You can manually remove function `send_email` from file `webapp/graphite/composer/views.py`. This function are not in use and will not affect your Graphite installation.

### References
For more information check this graphite-web Github issue #2008 

### For more information
If you have any questions or comments about this advisory:
* Add comment in [issue #2008](https://github.com/graphite-project/graphite-web/issues/2008)
Vulnerability: GHSA-xm3x-787m-p66r
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0964
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:46Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.webmv` file upload.
Vulnerability: GHSA-7ww4-c3mj-93cf
Summary: Downloads Resources over HTTP in pm2-kafka
Aliases: CVE-2016-10693
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:16:33Z

Affected versions of `pm2-kafka` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pm2-kafka`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-cpx9-4rwv-486v
Summary: Hessian protocol configuration vulnerability in Apache Dubbo
Aliases: CVE-2021-36163
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-09-08T20:14:14Z

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Vulnerability: GHSA-6v6p-g8cg-2hgg
Summary: Improper Certificate Validation in node-sass affects eZ Platform
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-295
Published: 2022-04-01T12:56:28Z

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects ezsystems/ezplatform and ezsystems/ezplatform-page-builder.
Vulnerability: GHSA-vxh4-x6gv-mphf
Summary: Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
Aliases: CVE-2022-0245
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2022-01-21T23:25:45Z

Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat.
Vulnerability: GHSA-9xgh-xgw5-p5cw
Summary: Hijacked Environment Variables in nodemssql
Aliases: CVE-2017-16057
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-11-09T17:42:54Z

The `nodemssql` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-7fpw-cfc4-3p2c
Summary: High severity vulnerability that affects passport-wsfed-saml2
Aliases: CVE-2017-16897
Severity: HIGH
CVSS score: 8.1
CWE: CWE-290
Published: 2017-12-28T22:51:45Z

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).
Vulnerability: GHSA-3988-h75v-hwf6
Summary: Arbitrary shell execution
Severity: HIGH
CVSS score: 0
Published: 2022-03-26T00:06:45Z

A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option
Vulnerability: GHSA-vh2r-x97c-2vpr
Summary: SQL Injection in Jeecg-boot
Aliases: CVE-2022-22880
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-02-17T00:00:26Z

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.
Vulnerability: GHSA-fr76-2wp8-fp92
Summary: Insecure template handling in Express-handlebars
Aliases: CVE-2021-32820
Severity: HIGH
CVSS score: 8.6
CWE: CWE-200
Published: 2022-02-10T23:35:21Z

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.

A fix is discussed in https://github.com/express-handlebars/express-handlebars/pull/163
Vulnerability: GHSA-jphm-g89m-v42p
Summary: Path traversal in Grafana Cortex
Aliases: CVE-2021-36157
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2021-09-02T21:59:50Z

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)
Vulnerability: GHSA-qr2j-wrhx-4829
Summary: Improper Input Validation
Aliases: CVE-2018-16733
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-20
Published: 2021-05-18T18:38:06Z

In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.