TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-vg27-hr3v-3cqv
Summary: open redirect in pollbot
Aliases: CVE-2022-0637
Severity: HIGH
CVSS score: 0
CWE: CWE-601
Published: 2022-02-16T23:02:09Z

(From https://bugzilla.mozilla.org/show_bug.cgi?id=1753838)

Summary:
There was an open redirection vulnerability in the path of:

https://pollbot.services.mozilla.com/ and https://pollbot.stage.mozaws.net/

Description:
An attacker can redirect anyone to malicious sites.

Steps To Reproduce:
Type in this URL:

https://pollbot.services.mozilla.com/%0a/evil.com/

It redirects to that website

evil.com

evil.com was used as an example but this could be any website. Note, the /%0a/ and trailing / are required.

Supporting Material/References:
https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

Impact

Attackers can serve malicious websites that steal passwords or download ransomware to their victims machine due to a redirect and there are a heap of other attack vectors.
Vulnerability: GHSA-gwfj-pw2x-h6c2
Summary: Out of bounds read in simd-json
Aliases: CVE-2019-15550
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2021-08-25T20:43:56Z

An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page boundary.
Vulnerability: GHSA-3x58-xr87-2fcj
Summary: Cross-site scripting in bluemonday
Aliases: CVE-2021-29272
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-18T21:07:37Z

bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string.
Vulnerability: GHSA-8vj3-jgcf-77jv
Summary: Malicious Package in requeest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:26:49Z

All versions of `requeest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-h2fw-93qx-vrcq
Summary: SQL Injection in Moodle
Aliases: CVE-2022-0983
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2022-03-26T00:00:29Z

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
Vulnerability: GHSA-8cw5-rv98-5c46
Summary: Arbitrary PHP code execution in Drupal
Aliases: CVE-2019-6339
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2022-01-06T22:30:06Z

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6, and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in
PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.
Vulnerability: GHSA-rcp4-jm2v-mr3f
Summary: Cross-site scripting in Shopizer
Aliases: CVE-2021-33561
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-06-08T23:10:24Z

A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.
Vulnerability: GHSA-3jxh-789f-p7m6
Summary: Cross-site Scripting
Aliases: CVE-2021-27902
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-07-02T18:36:31Z

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
Vulnerability: GHSA-3c6g-pvg8-gqw2
Summary: Command injection in json
Aliases: CVE-2020-7712
Severity: HIGH
CVSS score: 7.2
CWE: CWE-78
Published: 2021-05-06T18:11:21Z

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Vulnerability: GHSA-82j4-vr25-x394
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0940
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-15T00:01:01Z

ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-p523-jrph-qjc6
Summary: Insufficient Session Expiration in shopware
Aliases: CVE-2022-21652
Severity: LOW
CVSS score: 3.5
CWE: CWE-613
Published: 2022-01-06T23:49:17Z

### Impact

Automatically invalidate sessions upon password change

### Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Vulnerability: GHSA-36cg-4jff-5863
Summary: Data races in signal-simple
Aliases: CVE-2020-36446
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:13Z

An issue was discovered in the signal-simple crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for SyncChannel<T>.
Vulnerability: GHSA-c66w-hq56-4q97
Summary: Network policy may be bypassed by some ICMP Echo Requests
Severity: LOW
CVSS score: 0
Published: 2021-05-21T14:32:37Z

## Impact

Under certain conditions, ICMP Echo Request sent to a Cilium endpoint from an actor may bypass a network policy which _disallows_ access from the actor to the endpoint, but _allows_ from the endpoint to the actor. This does _NOT_ apply to UDP and TCP traffic.

The actor is either a pod or a cluster host or a remote host.

The following conditions must be met:
1. Network policies have been created which:
  a) do not allow access from the actor to the endpoint;
  b) allow access from the endpoint to the actor and does not specify neither protocol nor port. 
2. The endpoint has sent ICMP Echo Request to the actor with the ICMP identifier X.
3. The actor sends ICMP Echo Request to the endpoint with the same ICMP identifier X.
4. The request from the actor (3.) is sent before the Cilium's conntrack GC has removed the previously created conntrack entry (2.).

## Detailed description

See https://github.com/cilium/cilium/commit/dfb008a9099c4da1e0fd964c899c43ee13280b0e (v1.9.x), https://github.com/cilium/cilium/commit/ff6ebae6efca1bd991302b464dea428512823e79 (v1.8.x), https://github.com/cilium/cilium/commit/472bbeff75161979c317ab21d563f826291b5f37 (v1.7.x).

## Example

```
$ kubectl run server --image=quay.io/cilium/net-test:v1.0.0 --restart=Never -- sleep 3600
$ kubectl run client --image=quay.io/cilium/net-test:v1.0.0 --restart=Never -- sleep 3600
$ cat <<EOF | kubectl apply -f
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: server-netpol # allow client->server
spec:
  podSelector:
    matchLabels:
      run: server
  ingress:
  - from:
    - podSelector:
        matchLabels:
          run: client
  policyTypes:
  - Ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: client-netpol # deny any->client
spec:
  podSelector:
    matchLabels:
      run: client
  policyTypes:
  - Ingress
EOF

$ kubectl exec -ti server -- xping -c1 -x666 $CLIENT_POD_IP
PING 10.154.0.50 (10.154.0.50): 56 data bytes
^C
--- 10.154.0.50 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss   <--- "client-netpol" policy denied
command terminated with exit code 1

$ kubectl exec -ti client -- xping -c1 -x666 $SERVER_POD_IP
PING 10.154.1.16 (10.154.1.16): 56 data bytes
64 bytes from 10.154.1.16: seq=0 ttl=60 time=0.822 ms

--- 10.154.1.16 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss   <--- "server-netpol" policy allowed
round-trip min/avg/max = 0.822/0.822/0.822 ms

$ kubectl exec -ti server -- xping -c1 -x666 $CLIENT_POD_IP
PING 10.154.0.50 (10.154.0.50): 56 data bytes
64 bytes from 10.154.0.50: seq=0 ttl=60 time=0.527 ms

--- 10.154.0.50 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss   <--- "client-netpol" policy bypassed
round-trip min/avg/max = 0.527/0.527/0.527 ms
```

## For more information

If you have any questions or comments about this advisory:

- Open an issue in [Cilium Issues](https://github.com/cilium/cilium/issues)
- Email us at security@cilium.io
Vulnerability: GHSA-vqcj-wrf2-7v73
Summary: Out-of-bounds Write
Aliases: CVE-2020-35654
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-03-18T19:55:27Z

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
Vulnerability: GHSA-58w4-w77w-qv3w
Summary: Reflected XSS with parameters in PostComment
Aliases: CVE-2020-26225
Severity: MODERATE
CVSS score: 8.7
CWE: CWE-79
Published: 2020-11-16T21:23:29Z

### Impact
An attacker could inject malicious web code into the users' web browsers by creating a malicious link.

### Patches
The problem is fixed in 4.2.0

### References
[Cross-site Scripting (XSS) - Reflected (CWE-79) ](https://cwe.mitre.org/data/definitions/79.html)
Vulnerability: GHSA-2cv6-6437-39p2
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0930
Severity: HIGH
CVSS score: 4.8
CWE: CWE-79
Published: 2022-03-13T00:00:53Z

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-533p-g2hq-qr26
Summary: Command Injection in treekill
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T17:16:35Z

All versions of `treekill` are vulnerable to Command Injection. The package fails to sanitize values passed to the  `kill` function. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-wgx7-jwwm-cgjv
Summary: Improper Authentication in Apache Spark
Aliases: CVE-2020-9480
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287, CWE-306
Published: 2022-02-10T23:05:20Z

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Vulnerability: GHSA-45hw-29x7-9x95
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7651
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-22
Published: 2020-06-03T22:02:11Z

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.
Vulnerability: GHSA-7v2r-wxmg-mgvc
Summary: HTTP Request smuggling in tiny_http
Aliases: CVE-2020-35884
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-444
Published: 2021-08-25T20:48:56Z

An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header.
Vulnerability: GHSA-79rg-7mv3-jrr5
Summary: Rating Script Service expose XWiki to SQL injection
Aliases: CVE-2021-21380
Severity: HIGH
CVSS score: 7.7
CWE: CWE-89
Published: 2021-03-23T22:48:01Z

### Impact
This issue impacts only XWiki with the Ratings API installed.
The Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. 
This might lead to an SQL script injection quite easily for any user having Script rights on XWiki.

### Patches
The problem has been patched in XWiki 12.9RC1.

### Workarounds
The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.

### References
https://jira.xwiki.org/browse/XWIKI-17662

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](http://jira.xwiki.org)
* Email us at our [security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-p33m-7w7f-gmj8
Summary: Uncontrolled Resource Consumption in fun-map
Aliases: CVE-2020-7644
Severity: HIGH
CVSS score: 8.1
CWE: CWE-915
Published: 2021-12-10T20:05:07Z

fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Vulnerability: GHSA-59c7-4xj2-hgvw
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Aliases: CVE-2015-7578
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
Vulnerability: GHSA-6fw4-hr69-g3rv
Summary: Prototype Pollution in property-expr
Aliases: CVE-2020-7707
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-05-06T17:29:47Z

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.
Vulnerability: GHSA-ggxm-pgc9-g7fp
Summary: Arbitrary Code Execution in rdoc
Aliases: CVE-2021-31799
Severity: HIGH
CVSS score: 7
CWE: CWE-74, CWE-77
Published: 2021-09-01T18:53:15Z

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.
Vulnerability: GHSA-c99h-fgqm-6679
Summary: UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow
Aliases: CVE-2018-11778
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2018-10-17T17:22:23Z

UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0
Vulnerability: GHSA-xgf5-5gjr-4hjq
Summary: Directory Traversal in zjjserver
Aliases: CVE-2017-16201
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:15:20Z

Affected versions of `zjjserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6m93-343m-3jrc
Summary: Cross-site Scripting in HTML2PDF
Aliases: CVE-2021-45394
Severity: HIGH
CVSS score: 8.8
CWE: CWE-79, CWE-918
Published: 2022-01-21T23:29:48Z

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
Vulnerability: GHSA-xrmp-99wj-p6jc
Summary: Prototype Pollution in deap
Severity: HIGH
CVSS score: 7.3
CWE: CWE-400
Published: 2019-05-31T23:43:09Z

Versions of `deap` before 1.0.1 are vulnerable to prototype pollution.


## Recommendation

Update to version 1.0.1 or later.
Vulnerability: GHSA-97mp-9g5c-6c93
Summary: Malicious Package in bs58chcek
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:50:48Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-48ww-j4fc-435p
Summary: Command injection in nodemailer
Aliases: CVE-2020-7769
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-88
Published: 2021-05-10T19:16:52Z

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Vulnerability: GHSA-c6p9-24rc-jr5h
Summary: Remote Code Execution and download tracking in Mintegral SDK
Aliases: CVE-2020-7744
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-319
Published: 2021-04-22T16:15:15Z

"This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background)."
Vulnerability: GHSA-pq6v-x7gp-7776
Summary: Source code is downloaded over cleartext HTTP in portaudio
Aliases: CVE-2016-10933
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-319
Published: 2021-08-25T20:43:09Z

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
Vulnerability: GHSA-5v5h-4w2g-gxxc
Summary: SQL Injection in t3/dce
Aliases: CVE-2021-31777
Severity: HIGH
CVSS score: 7.6
CWE: CWE-89
Published: 2021-06-08T20:12:23Z

The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
Vulnerability: GHSA-958r-g534-ccmr
Summary: Moderate severity vulnerability that affects MadsKristensen.AspNetCore.Miniblog
Aliases: CVE-2019-9845
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2019-07-05T21:11:13Z

madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension.
Vulnerability: GHSA-wf5p-c75w-w3wh
Summary: Null pointer dereference in TFLite MLIR optimizations
Aliases: CVE-2021-37689
Severity: HIGH
CVSS score: 7.8
CWE: CWE-476
Published: 2021-08-25T14:39:36Z

### Impact
An attacker can craft a TFLite model that would trigger a null pointer dereference, which would result in a crash and denial of service:

This is caused by the MLIR optimization of `L2NormalizeReduceAxis` operator. The [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/compiler/mlir/lite/transforms/optimize.cc#L67-L70) unconditionally dereferences a pointer to an iterator to a vector without checking that the vector has elements:

```cc
bool L2NormalizeReduceAxis(Value sq_op, DenseElementsAttr axis) {
  if (sq_op.getType().cast<ShapedType>().getRank() - 1 ==
          *axis.getValues<int>().begin() ||
      *axis.getValues<int>().begin() == -1) {
      // ...
  }
  // ...
}
```

### Patches
We have patched the issue in GitHub commit [d6b57f461b39fd1aa8c1b870f1b974aac3554955](https://github.com/tensorflow/tensorflow/commit/d6b57f461b39fd1aa8c1b870f1b974aac3554955).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
          
### Attribution              
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-c2vx-49jm-h3f6
Summary: Pysaml2 does not sanitize XML responses
Aliases: CVE-2016-10149
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-07-16T16:50:12Z

XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Vulnerability: GHSA-fw5q-j9p4-3vxg
Summary: Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
Aliases: CVE-2020-15276
Severity: LOW
CVSS score: 7.7
CWE: CWE-79
Published: 2020-10-30T19:10:20Z

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

Impact: XSS via Arbitrary script execution.
Components are: Blog comment posting
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by yama
Vulnerability: GHSA-h5rh-w6vm-9ghc
Summary: Denial of service in Grafana
Aliases: CVE-2021-27358
Severity: HIGH
CVSS score: 6.9
CWE: CWE-306, CWE-400
Published: 2022-02-15T01:57:18Z

The snapshot feature in Grafana before 7.4.2 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
Vulnerability: GHSA-qf9q-q4hh-qph3
Summary: SQL injection in blazer
Aliases: CVE-2022-29498
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2022-04-22T00:00:36Z

Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run.
Vulnerability: GHSA-xvm2-9xvc-hx7f
Summary: Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer
Aliases: CVE-2022-23640
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2022-03-02T21:30:54Z

### Impact
Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.

### Patches
Upgrade to version 2.1.0.

### Workarounds
No known workaround.

### References
https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [monitorjbl/excel-streaming-reader](https://github.com/monitorjbl/excel-streaming-reader)
Vulnerability: GHSA-mp78-r56v-45qc
Summary: Moderate severity vulnerability that affects ember-source
Aliases: CVE-2015-1866
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-08-28T22:34:31Z

Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Vulnerability: GHSA-c7fm-jx59-wjf6
Summary: Authorization Bypass Through User-Controlled Key in LiveHelperChat
Aliases: CVE-2022-0266
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-639
Published: 2022-01-21T18:50:58Z

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
Vulnerability: GHSA-p49h-hjvm-jg3h
Summary: PCX P mode buffer overflow in Pillow
Aliases: CVE-2020-5312
Severity: HIGH
CVSS score: 9.8
CWE: CWE-120
Published: 2021-11-03T18:05:04Z

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
Vulnerability: GHSA-g94p-h263-c26q
Summary: Cross Site Request Forgery in Mingsoft MCMS
Aliases: CVE-2022-27340
Severity: HIGH
CVSS score: 0
CWE: CWE-352
Published: 2022-04-23T00:03:01Z

MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
Vulnerability: GHSA-g36h-6r4f-3mqp
Summary: Regular Expression Denial of Service in string
Aliases: CVE-2017-16116
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:16:11Z

Affected versions of `string` are vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the `underscore` or `unescapeHTML` methods.


## Recommendation

There is currently no direct patch for this vulnerability. 

Currently, the best solution is to avoid passing user input to the `underscore` and `unescapeHTML` methods.

Alternatively, a user provided patch is available in [Pull Request #217]( https://github.com/jprichardson/string.js/pull/217/commits/eab9511e4efbc8c521e18b6cf2e8565ae50c5a16), however this patch has not been tested, nor has it been merged by the package author.
Vulnerability: GHSA-44vf-8ffm-v2qh
Summary: Sensitive Data Exposure in rails-session-decoder
Severity: HIGH
CVSS score: 0
Published: 2020-09-02T15:42:47Z

All versions of `rails-session-decoder` are missing verification of the Message Authentication Code appended to the cookies. This may lead to decryption of cipher text thus exposing encrypted information.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-p66x-2cv9-qq3v
Summary: Arbitrary code execution in Apache Commons BeanUtils
Aliases: CVE-2014-0114
Severity: HIGH
CVSS score: 0
Published: 2020-06-10T23:38:01Z

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Vulnerability: GHSA-jr3j-whm4-9wwm
Summary: Reflected XSS when using flashMessages or languageDictionary
Aliases: CVE-2021-32641
Severity: HIGH
CVSS score: 8.1
CWE: CWE-79
Published: 2021-06-04T19:10:34Z

### Overview

Versions before and including `11.30.0` are vulnerable to reflected XSS.  An attacker can execute arbitrary code when the library's
- `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage`.
- `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`.

### Am I affected?
You are affected by this vulnerability if you are using `auth0-lock` version `11.30.0` or lower and all of the following conditions apply:

- You are utilizing `flashMessage` feature.
- User input or data from URL parameters is incorporated into the `flashMessage`.

An example of a vulnerable snippet where query parameters are used to populate the `text` property of a `flashMessage`.
```js
var params = new URLSearchParams(location.search);
var errorMessage = params.get('error__message');
var showParams = {};

if (!!errorMessage === true) {
  showParams.flashMessage = {
    type: 'error',
    text: 'We were unable to log you in. ' + errorMessage,
  };
}

lock.show(showParams);
```

OR

- You are utilizing `languageDictionary` feature.
- User input or data from URL parameters is used in `languageDictionary` properties.

An example of a vulnerable snippet where query parameters are used to populate the `socialLoginInstructions` property of a `languageDictionary`.
```js
var params = new URLSearchParams(location.search);
var instruction = params.get('instruction');

var options = {
  languageDictionary: {
    emailInputPlaceholder: "something@youremail.com",
    title: "title",
    socialLoginInstructions: instruction
  },
};

var lock = new Auth0LockPasswordless(
    CLIENT_ID,
    DOMAIN,
    options
);

lock.show()
```

### How to fix that?
Upgrade to version `11.30.1`.

### Will this update impact my users?
The fix uses [DOMPurify](https://github.com/cure53/DOMPurify) to sanitise the `flashMessage` and `languageDictionary` inputs. If you are including inline JavaScript in these fields, like `script` tags or `onclick` attributes, these will be removed.
Vulnerability: GHSA-r7cj-8hjg-x622
Summary: DBAL 3 SQL Injection Security Vulnerability
Aliases: CVE-2021-43608
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-11-16T17:25:57Z

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.

We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.

The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling `AbstractPlatform::modifyLimitQuery`. 

As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.

This vulnerability has been assigned [CVE-2021-43608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43608).
Vulnerability: GHSA-2828-9vh6-9m6j
Summary: Client Denial of Service on TUF
Aliases: CVE-2020-6173
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2020-08-21T16:25:48Z

### Impact
An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.

The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.

### Patches
No fix exists for this issue. 

### Workarounds
No workarounds are known for this issue.

### References
* [CVE-2020-6173](https://nvd.nist.gov/vuln/detail/CVE-2020-6173)
* [Issue #973](https://github.com/theupdateframework/tuf/issues/973)
Vulnerability: GHSA-3p85-p4qg-hcrp
Summary: pimcore is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4081
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-16T14:27:58Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-g8vp-6hv4-m67c
Summary: Command Injection in entitlements
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-11T21:23:29Z

Versions of `entitlements` prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the `entitlements` function  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.3.0 or later.
Vulnerability: GHSA-3xxv-p78r-4fc6
Summary: Cross-site Scripting in apache-airflow
Aliases: CVE-2021-28359
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-18T18:43:42Z

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and 2.x series. This is the same as CVE-2020-13944 & CVE-2020-17515 but the implemented fix did not fix the issue completely. Update to Airflow 1.10.15 or 2.0.2. Please also update your Python version to the latest available PATCH releases of the installed MINOR versions, example update to Python 3.6.13 if you are on Python 3.6. (Those contain the fix for CVE-2021-23336 https://nvd.nist.gov/vuln/detail/CVE-2021-23336).
Vulnerability: GHSA-vrw4-w73r-6mm8
Summary: TimelockController vulnerability in OpenZeppelin Contracts
Aliases: CVE-2021-39168
Severity: CRITICAL
CVSS score: 10
CWE: CWE-269
Published: 2021-08-30T16:12:49Z

### Impact

A vulnerability in `TimelockController` allowed an actor with the executor role to take immediate control of the timelock, by resetting the delay to 0 and escalating privileges, thus gaining unrestricted access to assets held in the contract. Instances with the executor role set to "open" allow anyone to use the executor role, thus leaving the timelock at risk of being taken over by an attacker.

### Patches

A fix is included in the following releases of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`:
- 4.3.1
- 3.4.2
- 3.4.2-solc-0.7

Deployed instances of `TimelockController` should be replaced with a fixed version by migrating all assets, ownership, and roles.

### Workarounds

Revoke the executor role from accounts not strictly under the team's control. We recommend revoking all executors that are not also proposers. When applying this mitigation, ensure there is at least one proposer and executor remaining.

### References

[Post-mortem](https://forum.openzeppelin.com/t/timelockcontroller-vulnerability-postmortem/14958).

### Credits

The issue was identified by an anonymous white hat hacker through [Immunefi](https://immunefi.com/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-g57j-q48p-9vm2
Summary: Command injection in Gerapy
Aliases: CVE-2020-7698
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2021-05-06T18:52:13Z

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
Vulnerability: GHSA-7h5v-85w9-pq6c
Summary: Denial of service (via resource exhaustion) due to improper input validation in third-party identifier endpoint
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2021-05-19T23:01:45Z

### Impact
Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.

### Patches
The issue is fixed by https://github.com/matrix-org/synapse/pull/9855.

### Workarounds
There are no known workarounds.

### References
n/a

### For more information
If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: GHSA-754h-5r27-7x3r
Summary: RCE in Symfony
Aliases: CVE-2020-15094
Severity: HIGH
CVSS score: 8
CWE: CWE-212
Published: 2020-09-02T17:29:56Z

Description
-----------

The `CachingHttpClient` class from the HttpClient Symfony component relies on the `HttpCache` class to handle requests. `HttpCache` uses internal headers like `X-Body-Eval` and `X-Body-File` to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by `CachingHttpClient` and if an attacker can control the response for a request being made by the `CachingHttpClient`, remote code execution is possible.

Resolution
----------

HTTP headers designed for internal use in `HttpCache` are now stripped from remote responses before being passed to `HttpCache`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78) for the 4.4 branch.

Credits
-------

I would like to thank Matthias Pigulla (webfactory GmbH) for reporting and fixing the issue.
Vulnerability: GHSA-hpr5-wp7c-hh5q
Summary: Cross-Site Scripting in mrk.js
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T19:37:29Z

Versions of `mrk.js` before 2.0.1 are vulnerable to cross-site scripting (XSS) when markdown is converted to HTML.


## Recommendation

Update to version 2.0.1 or later and use `mark.sanitizeURL()` for any `src` and `href` attributes when extending the markdown.
Vulnerability: GHSA-f39r-cpmj-whcg
Summary: Command Injection in ffmpegdotjs
Aliases: CVE-2021-23376
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-05-06T15:55:21Z

This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-x7j7-qp7j-hw3q
Summary: Cross-site scripting (XSS) from writer field content in the site frontend
Aliases: CVE-2021-41252
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-11-16T17:04:19Z

### Impact

Kirby's [writer field](https://getkirby.com/docs/reference/panel/fields/writer) stores its formatted content as HTML code. Unlike with other field types, it is not possible to [escape HTML special characters](https://getkirby.com/docs/guide/templates/escaping) against cross-site scripting (XSS) attacks, otherwise the formatting would be lost.

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

Because the writer field did not securely sanitize its contents on save, it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site.

This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

You are *not* affected if you don't use the writer field in any of your blueprints. The attack can only be performed by logged-in users and only surfaces in the site frontend (i.e. in your templates). The Panel itself is unaffected and will not execute JavaScript that was injected into writer field content.

### Patches

We have patched the vulnerability in [Kirby 3.5.8](https://github.com/getkirby/kirby/releases/tag/3.5.8) by sanitizing all writer field contents on the backend whenever the content is modified via Kirby's API. Please update to this or a [later version](https://github.com/getkirby/kirby/releases/) to fix the vulnerability.

### Credits

Thanks to Azrul Ikhwan Zulkifli (@azrultech) from BAE Systems AI Vulnerability Research Team for responsibly reporting the identified issue.
Vulnerability: GHSA-3w5v-p54c-f74x
Summary: ejs is ivulnerable to remote code execution due to weak input validation
Aliases: CVE-2017-1000228
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2017-11-30T23:15:19Z

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
Vulnerability: GHSA-28xr-mwxg-3qc8
Summary: Command injection in simple-git
Aliases: CVE-2022-24066
Severity: HIGH
CVSS score: 8.1
CWE: CWE-74, CWE-77
Published: 2022-04-02T00:00:13Z

`simple-git` (maintained as [git-js](https://github.com/steveukx/git-js) named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.6.0.
Vulnerability: GHSA-568q-9fw5-28wf
Summary: Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
Aliases: CVE-2018-10936
Severity: MODERATE
CVSS score: 0
CWE: CWE-297
Published: 2018-10-19T16:53:33Z

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
Vulnerability: GHSA-jjx5-3f36-6927
Summary: Incorrect buffer size calculation in iced-x86
Aliases: CVE-2021-38188
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-131
Published: 2021-08-25T20:55:47Z

An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new(), slice.get_unchecked(slice.length()) is used unsafely.
Vulnerability: GHSA-h3gg-7wx2-cq3h
Summary: XSS in Flarum Sticky extension
Aliases: CVE-2021-21283
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-01-29T18:13:41Z

### Impact
A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit.

Any HTML would be injected through Mithril's `m.trust()` helper. This resulted in an HTML injection where `<script>` tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed.

Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned.

On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited.

Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted.

### Patches
The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension.

### Workarounds
Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.

### References

- [Release announcement](https://discuss.flarum.org/d/26042-security-update-to-flarum-sticky-010-beta151)
- [Pull Request](https://github.com/flarum/sticky/pull/24)

### For more information
If you have any questions or comments about this advisory, please start a new discussion on our [support forum](https://discuss.flarum.org/t/support).

If you discover a security vulnerability within Flarum, please send an e-mail to [security@flarum.org](mailto:security@flarum.org). All security vulnerabilities will be promptly addressed. More details can be found in our [security policy](https://github.com/flarum/core/security/policy).
Vulnerability: GHSA-jfmf-w293-8xr8
Summary: Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Severity: HIGH
CVSS score: 7.5
Published: 2021-10-13T18:55:52Z

Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Vulnerability: GHSA-5r9v-8w62-r26j
Summary: livehelperchat is vulnerable to Cross-site Scripting
Aliases: CVE-2022-0253
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-21T23:48:25Z

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-2pfh-q76x-gwvm
Summary: Improper Input Validation and Command Injection in Ansible
Aliases: CVE-2021-3583
Severity: HIGH
CVSS score: 7.1
CWE: CWE-20, CWE-77
Published: 2021-09-23T23:16:38Z

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Vulnerability: GHSA-63m4-fhf2-cmf7
Summary: Command Execution in windows-cpu
Aliases: CVE-2017-1000219
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-09-01T16:43:55Z

Version of `windows-cpu` before 0.1.5 will execute arbitrary code passed into the first argument of the `findLoad` method, resulting in remote code execution.

## Proof of Concept

```
var win = require('windows-cpu');
wind.findLoad('foo & calc.exe');
```


## Recommendation

Update to version 0.1.5 or later.
Vulnerability: GHSA-wgjx-hm34-qgf7
Summary: SQL injection in Centreon
Aliases: CVE-2019-16194
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2020-02-11T20:36:04Z

SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
Vulnerability: GHSA-xxxq-chmp-67g4
Summary: RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign
Aliases: CVE-2020-14967
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2020-06-26T16:27:08Z

### Impact
Jsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability.

- If you don't use RSA PKCS1-v1_5 or RSA-OAEP decryption, this vulnerability is not affected.
- Risk to forge contents of encrypted message is very low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.

### Patches
Users using RSA PKCS1-v1_5 or RSA-OAEP decryption should upgrade to 8.0.18.

### Workarounds
Reject RSA PKCS1-v1_5 or RSA-OAEP encrypted message with unnecessary prepending zeros.

### References
https://nvd.nist.gov/vuln/detail/CVE-2020-14967
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967
https://vuldb.com/?id.157124
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt
https://github.com/kjur/jsrsasign/issues/439
Vulnerability: GHSA-w6ww-fmfx-2x22
Summary: Misconfigured IP address field in ROA leads to OctoRPKI crash
Aliases: CVE-2021-3911
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-252, CWE-20
Published: 2021-11-10T19:56:04Z

If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com