TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-gw5h-h6hj-f56g
Summary: Improper Authorization in Gogs
Severity: HIGH
CVSS score: 8.2
CWE: CWE-285
Published: 2022-03-14T22:58:37Z

### Impact

Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.

### Patches

Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. 

### References

https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
Vulnerability: GHSA-frqg-7g38-6gcf
Summary: Improper escaping of command arguments on Windows leading to command injection
Aliases: CVE-2021-41116
Severity: HIGH
CVSS score: 8.2
CWE: CWE-77
Published: 2021-10-05T20:23:18Z

### Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. 

### Patches
1.10.23 and 2.1.9 fix the issue

### Workarounds
None
Vulnerability: GHSA-rp63-jfmw-532w
Summary: High severity vulnerability that affects mail
Aliases: CVE-2012-2140
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.
Vulnerability: GHSA-c5hm-xc74-pqrg
Summary: OS Command Injection in jscover
Aliases: CVE-2020-7623
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:37:22Z

jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.
Vulnerability: GHSA-hjgp-8ffr-hwwr
Summary: Downloads Resources over HTTP in closurecompiler
Aliases: CVE-2016-10582
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:51:19Z

Affected versions of `closurecompiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closurecompiler`.


## Recommendation

Update to version 1.6.1 or later.
Vulnerability: GHSA-49qr-xh3w-h436
Summary: Moderate severity vulnerability that affects notebook
Aliases: CVE-2018-19351
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-21T22:15:47Z

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.
Vulnerability: GHSA-gr4c-5rq6-cgh3
Summary: OPC UA applications can allow a remote attacker to determine a Server's private key 
Aliases: CVE-2018-7559
Severity: MODERATE
CVSS score: 5.3
Published: 2018-10-16T19:58:42Z

An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.
Vulnerability: GHSA-vjg4-v33c-ggc4
Summary: Out of bounds read in Tensorflow
Aliases: CVE-2022-21730
Severity: HIGH
CVSS score: 8.1
CWE: CWE-125
Published: 2022-02-09T18:29:45Z

### Impact 
The [implementation of `FractionalAvgPoolGrad`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_avg_pool_op.cc#L209-L360) does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:

```python
import tensorflow as tf

@tf.function
def test():
  y = tf.raw_ops.FractionalAvgPoolGrad(
    orig_input_tensor_shape=[2,2,2,2],
    out_backprop=[[[[1,2], [3, 4], [5, 6]], [[7, 8], [9,10], [11,12]]]],
    row_pooling_sequence=[-10,1,2,3],
    col_pooling_sequence=[1,2,3,4],
    overlapping=True)
  return y
    
test()
```

### Patches
We have patched the issue in GitHub commit [002408c3696b173863228223d535f9de72a101a9](https://github.com/tensorflow/tensorflow/commit/002408c3696b173863228223d535f9de72a101a9).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-fvgf-6h6h-3322
Summary: Improper Limitation of a Pathname to a Restricted Directory
Aliases: CVE-2021-3281
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2021-03-18T20:29:49Z

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments.
Vulnerability: GHSA-8434-v7xw-8m9x
Summary: Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks
Aliases: CVE-2021-21386
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-88, CWE-78
Published: 2022-01-21T23:03:39Z

APKLeaks prior to v2.0.4 allows remote authenticated attackers to execute arbitrary OS commands via package name inside application manifest.

### Impact
An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name.

### Patches
The problem is fixed in version v2.0.4 and above.

### Workarounds

```bash
> git fetch --tags; git checkout v2.0.6-dev
```

Or pull to the latest version:
```bash
> git pull origin master
```

### References
- a966e781499ff6fd4eea66876d7532301b13a382

### For more information
If you have any questions or comments about this advisory:
* Email me at [me@dw1.io](mailto:me@dw1.io)
Vulnerability: GHSA-v6wp-4m6f-gcjg
Summary: Open redirect vulnerability in `aiohttp` (`normalize_path_middleware` middleware)
Aliases: CVE-2021-21330
Severity: LOW
CVSS score: 3.1
CWE: CWE-601
Published: 2021-02-26T02:11:57Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.

It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

This security problem has been fixed in v3.7.4. Upgrade your dependency as follows:
[`pip install aiohttp >= 3.7.4`]

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.

### References
_Are there any links users can visit to find out more?_

* [aiohttp @ PyPI]
* [GHSA-v6wp-4m6f-gcjg]
* [OWASP page on open redirects]

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [aiohttp repo](https://github.com/aio-libs/aiohttp/issues/new/choose)
* Email us at wk+aio-libs-security@sydorenko.org.ua and/or andrew.svetlov+aio-libs-security@gmail.com

Credit: [Jelmer Vernooĳ] and [Beast Glatisant].

[aiohttp @ PyPI]: https://pypi.org/p/aiohttp
[`pip install aiohttp >= 3.7.4`]: https://pypi.org/project/aiohttp/3.7.4/
[GHSA-v6wp-4m6f-gcjg]: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg
[OWASP page on open redirects]:
https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

[Jelmer Vernooĳ]: https://jelmer.uk
[Beast Glatisant]: https://github.com/g147
Vulnerability: GHSA-6xq8-pvg4-3mf3
Summary: Moderate severity vulnerability that affects org.eclipse.rdf4j:rdf4j-runtime
Aliases: CVE-2018-1000644
Severity: CRITICAL
CVSS score: 10
CWE: CWE-611
Published: 2018-10-19T16:54:11Z

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
Vulnerability: GHSA-ghhm-xrwp-75m9
Summary: bookstack is vulnerable to Improper Access Control
Aliases: CVE-2021-4194
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-668, CWE-284
Published: 2022-01-08T00:34:12Z

bookstack is vulnerable to Improper Access Control
Vulnerability: GHSA-762c-v946-pf25
Summary: Malicious Package in bpi39
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:47:33Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-vf7h-6246-hm43
Summary: The disqualify lead action may be executed without CSRF token check
Aliases: CVE-2021-39198
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-352
Published: 2021-11-19T20:18:54Z

### Summary
The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack.

### Workarounds
There are no workarounds that address this vulnerability.
Vulnerability: GHSA-w8qp-hmh5-4v9v
Summary: Object state limitation has no effect
Severity: CRITICAL
CVSS score: 0
CWE: CWE-281
Published: 2022-04-29T16:22:58Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Vulnerability: GHSA-r3x4-wr4h-pw33
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Aliases: CVE-2019-10759
Severity: CRITICAL
CVSS score: 9.9
CWE: CWE-94
Published: 2019-10-21T21:58:34Z

Versions of `safer-eval` prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. For example, evaluating he string `console.constructor.constructor('return process')().env` prints `process.env` to the console.


## Recommendation

Upgrade to version 1.3.4 or later.
Vulnerability: GHSA-455m-q3h9-34pf
Summary: Downloads Resources over HTTP in windows-seleniumjar-mirror
Aliases: CVE-2016-10670
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:29Z

Affected versions of `windows-seleniumjar-mirror` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-seleniumjar-mirror`.


## Recommendation

No patch is currently available for this vulnerability.

Currently, the best mitigation is to download the selenium jar file manually from [seleniumHQ](https://www.seleniumhq.org/download/).

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rfgg-vccr-m46m
Summary: Missing release of memory in sized-chunks
Aliases: CVE-2020-25794
Severity: HIGH
CVSS score: 7.5
CWE: CWE-401
Published: 2021-08-25T20:45:58Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, clone can have a memory-safety issue upon a panic.
Vulnerability: GHSA-mc7w-4cjf-c973
Summary: OS Command Injection in node-opencv
Aliases: CVE-2019-10061
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-10-12T22:06:57Z

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
Vulnerability: GHSA-36hp-jr8h-556f
Summary: Authentication Bypass
Aliases: CVE-2021-29441
Severity: HIGH
CVSS score: 0
CWE: CWE-290
Published: 2021-04-27T20:09:17Z

When configured to use authentication (`-Dnacos.core.auth.enabled=true`) Nacos uses the `AuthFilter` servlet filter to enforce authentication. This filter has a [backdoor](https://github.com/alibaba/nacos/blob/5fa05aef52f7432aeab19fe53035431b9d8c91d9/core/src/main/java/com/alibaba/nacos/core/auth/AuthFilter.java#L78-L81) that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the `user-agent` HTTP header so it can be easily spoofed.

The following request to the `configuration` endpoint gets rejected as we are not providing any credentials:
```
❯ curl -X POST "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld"
{"timestamp":"2020-12-02T14:33:57.154+0000","status":403,"error":"Forbidden","message":"unknown user!","path":"/nacos/v1/cs/configs"}                                                                                                       
```

However the following one gets accepted by using the `Nacos-Server` user-agent header:
```
❯ curl -X POST -A Nacos-Server "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld"
true 
```

#### Impact

This issue may allow any user to carry out any administrative tasks on the Nacos server.
Vulnerability: GHSA-fw4p-36j9-rrj3
Summary: Denial of Service in sequelize
Severity: MODERATE
CVSS score: 0
Published: 2020-09-03T20:25:33Z

Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process.  

The following proof-of-concept crashes the Node process:  
```
const Sequelize = require('sequelize');

const sequelize = new Sequelize({
	dialect: 'sqlite',
	storage: 'database.sqlite'
});

const TypeError = sequelize.define('TypeError', {
	name: Sequelize.STRING,
});

TypeError.sync({force: true}).then(() => {
	return TypeError.create({name: "SELECT tbl_name FROM sqlite_master"});
});
```


## Recommendation

Upgrade to version 4.44.4 or later.
Vulnerability: GHSA-xwg3-qrcg-w9x6
Summary: Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Aliases: CVE-2021-31404
Severity: MODERATE
CVSS score: 4
CWE: CWE-208, CWE-203
Published: 2021-04-19T14:51:25Z

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 through 13), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

- https://vaadin.com/security/cve-2021-31404
Vulnerability: GHSA-jppx-hw2f-8gx4
Summary: Downloads Resources over HTTP in chromedriver126
Aliases: CVE-2016-10609
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:33:30Z

Affected versions of `chromedriver126` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `chromedriver126`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-mfv8-q39f-mgfg
Summary: Cross-site Scripting in invenio-communities
Aliases: CVE-2019-1020005
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2019-07-16T00:52:26Z

## Cross-Site Scripting (XSS) vulnerability in Jinja templates

### Impact
A Cross-Site Scripting (XSS) vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and page fields. 

### Patches
The problem has been patched in v1.0.0a20.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
Vulnerability: GHSA-7rg4-266c-jqw6
Summary: Predictable CSRF tokens in centreon/centreon
Aliases: CVE-2021-28055
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352, CWE-330
Published: 2021-06-08T20:12:56Z

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.
Vulnerability: GHSA-99ch-8mvp-g7m5
Summary: Critical severity vulnerability that affects md2pdf
Aliases: CVE-2013-1948
Severity: CRITICAL
CVSS score: 0
Published: 2017-10-24T18:33:37Z

converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Vulnerability: GHSA-c6j7-4fr9-c76p
Summary: Incorrect permissions in Apache Ozone
Aliases: CVE-2021-39235
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-732
Published: 2021-11-23T18:17:41Z

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Vulnerability: GHSA-m9hw-7xfv-wqg7
Summary: Prototype Pollution in json-logic-js
Severity: HIGH
CVSS score: 0
CWE: CWE-471
Published: 2020-11-12T19:36:14Z

Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Code Execution.

The following rule creates a popup when run from a browser:
```
{
  "method": [
    {
      "method": [
        {
          "var": "__proto__.constructor.is.__proto__"
        },
        "constructor",
        [
          "var x = 'SECURITY!'; console.log(x, window.fetch); alert(x)"
        ]
      ]
    },
    "call"
  ]
}
```
Vulnerability: GHSA-wm2r-rp98-8pmh
Summary: Exposure of SSH credentials in Rancher/Fleet
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2022-04-27T21:09:13Z

### Impact
This vulnerability only affects customers using Fleet for continuous delivery with authenticated Git and/or Helm repositories.

A security vulnerability ([CVE-2022-29810](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29810)) was discovered in `go-getter` library in versions prior to [`v1.5.11`](https://github.com/hashicorp/go-getter/releases/tag/v1.5.11) that exposes SSH private keys in base64 format due to a failure in redacting such information from error messages. The vulnerable version of this library is used in Rancher through Fleet in versions of Fleet prior to [`v0.3.9`](https://github.com/rancher/fleet/releases/tag/v0.3.9). This issue affects Rancher versions 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3.

When Git and/or Helm authentication is configured in [Fleet](https://rancher.com/docs/rancher/v2.6/en/deploy-across-clusters/fleet/) and Fleet is used to deploy a git repo through `Continuous Delivery`, the affected `go-getter` version will expose the configured SSH private key secret if Fleet fails to download the git repo due to a misconfigured URL. The exposed SSH key is logged in base64 format as a query parameter together with the git URL. The credentials can be seen in Rancher UI and in Fleet's deployment pod logs.

### Patches
Patched versions include releases 2.5.13, 2.6.4 and later versions.

### Workarounds
There is not a direct mitigation besides upgrading to the patched Rancher versions. Until you are able to upgrade, limit access in Rancher to trusted users and carefully validate the URLs you are using are correct. Please note that the SSH key might still be compromised in valid URLs if the service goes down or a connection error happens when pulling from the repos.

**Note:** If you believe that SSH keys might have been exposed in your environment, it's highly advised to rotate them.

### Credits
This issue was found and reported by Dagan Henderson from Raft Engineering.

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Vulnerability: GHSA-9p47-w5xp-f4xr
Summary: Downloads Resources over HTTP in windows-build-tools
Aliases: CVE-2017-16003
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-11-09T17:48:37Z

Affected versions of `windows-build-tools` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-build-tools`.


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-hjp8-2cm3-cc45
Summary: Cookie exposure in requestretry
Aliases: CVE-2022-0654
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-02-24T00:00:54Z

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0 via cookies being leaked to external sites.
Vulnerability: GHSA-w2f4-hxpm-mq98
Summary: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Aliases: CVE-2021-3915
Severity: HIGH
CVSS score: 7.6
CWE: CWE-434
Published: 2021-11-15T23:17:37Z

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability: GHSA-748f-wv76-x9hg
Summary: Arbitrary file upload in Fork CMS
Aliases: CVE-2021-28931
Severity: HIGH
CVSS score: 8.8
CWE: CWE-434
Published: 2021-09-08T17:26:26Z

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.
Vulnerability: GHSA-59q2-x2qc-4c97
Summary: Heap OOB access in unicode ops
Aliases: CVE-2021-29559
Severity: LOW
CVSS score: 2.5
CWE: CWE-125
Published: 2021-05-21T14:24:54Z

### Impact
An attacker can access data outside of bounds of heap allocated array in `tf.raw_ops.UnicodeEncode`:

```python
import tensorflow as tf

input_values = tf.constant([58], shape=[1], dtype=tf.int32)
input_splits = tf.constant([[81, 101, 0]], shape=[3], dtype=tf.int32)
output_encoding = "UTF-8"

tf.raw_ops.UnicodeEncode(
    input_values=input_values, input_splits=input_splits,
    output_encoding=output_encoding)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/472c1f12ad9063405737679d4f6bd43094e1d36d/tensorflow/core/kernels/unicode_ops.cc)
assumes that the `input_value`/`input_splits` pair specify a valid sparse tensor.

### Patches
We have patched the issue in GitHub commit [51300ba1cc2f487aefec6e6631fef03b0e08b298](https://github.com/tensorflow/tensorflow/commit/51300ba1cc2f487aefec6e6631fef03b0e08b298).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-f96g-24cg-f24w
Summary: SQL Injection in odata4j
Aliases: CVE-2016-11024
Severity: HIGH
CVSS score: 9.8
CWE: CWE-89
Published: 2021-05-07T15:52:41Z

odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
Vulnerability: GHSA-hwcf-pp87-7x6p
Summary: Moderate severity vulnerability that affects ejs
Aliases: CVE-2017-1000188
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-11-30T23:15:05Z

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
Vulnerability: GHSA-4vrf-ff7v-hpgr
Summary: Division by zero in TFLite's implementation of `EmbeddingLookup`
Aliases: CVE-2021-29596
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:27:51Z

The implementation of the `EmbeddingLookup` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/e4b29809543b250bc9b19678ec4776299dd569ba/tensorflow/lite/kernels/embedding_lookup.cc#L73-L74):

```cc
const int row_size = SizeOfDimension(value, 0);
const int row_bytes = value->bytes / row_size;
```

An attacker can craft a model such that the first dimension of the `value` input is 0.

### Patches
We have patched the issue in GitHub commit [f61c57bd425878be108ec787f4d96390579fb83e](https://github.com/tensorflow/tensorflow/commit/f61c57bd425878be108ec787f4d96390579fb83e).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-66rh-8fw6-59q6
Summary: Prototype Pollution in assign-deep
Aliases: CVE-2019-10745
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-915
Published: 2019-08-21T16:15:13Z

Versions of `assign-deep` prior to 1.0.1 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

Upgrade to version 1.0.1 or later.
Vulnerability: GHSA-3wxm-m9m4-cprj
Summary: Import of incorrectly embargoed keys could cause early publication
Severity: MODERATE
CVSS score: 0
Published: 2021-05-21T16:24:44Z

### Impact

If your installation is using the `export-importer` service, there is potential impact.
If your installation is not importing keys via the `export-importer` services, your installation is not impacted.

In versions `0.19.1` and earlier, the `export-importer` service assumed that the server it was importing from had properly embargoed keys for at least 2 hours after their expiry time. There are now known instances of servers that did not properly embargo keys.

This could allow allow for imported keys to be re-published before they have expired, allowing for potential replay of RPIs.

### Patches

This is patched in `v0.18.3` and all versions `0.19.2` and later.

### Workarounds

Ensure that the servers you are importing export zip files from are not publishing keys too early. 

### References

n/a

### For more information

If you have any questions or comments about this advisory
* Open an issue in [exposure-notifications-server](https://github.com/google/exposure-notifications-server/)
* Email us at [exposure-notifications-feedback@google.com](mailto:exposure-notifications-feedback@google.com)
Vulnerability: GHSA-h676-pjr4-hgqx
Summary: Path Traversal in S-Cart
Aliases: CVE-2021-44111
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-22
Published: 2022-02-12T00:00:42Z

A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.
Vulnerability: GHSA-h9wr-xr4r-66fh
Summary: Cross-Site Scripting in dmn-js-properties-panel
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T18:20:20Z

Versions of `dmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.3.0 or later.
Vulnerability: GHSA-x3v8-c8qx-3j3r
Summary: Null pointer exception in `DeserializeSparse`
Aliases: CVE-2021-41215
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-476
Published: 2021-11-10T18:57:45Z

### Impact
The [shape inference code for `DeserializeSparse`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/sparse_ops.cc#L152-L168) can trigger a null pointer dereference:

```python
import tensorflow as tf

dataset = tf.data.Dataset.range(3)
  
@tf.function                 
def test():                  
  y = tf.raw_ops.DeserializeSparse(
    serialized_sparse=tf.data.experimental.to_variant(dataset),
    dtype=tf.int32)

test()
```

This is because the shape inference function assumes that the `serialize_sparse` tensor is a tensor with positive rank (and having `3` as the last dimension).  However, in the example above, the argument is a scalar (i.e., rank 0).

### Patches
We have patched the issue in GitHub commit [d3738dd70f1c9ceb547258cbb82d853da8771850](https://github.com/tensorflow/tensorflow/commit/d3738dd70f1c9ceb547258cbb82d853da8771850).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-fpqp-v323-44xv
Summary: Cross-site scripting in Apache Ranger
Aliases: CVE-2019-12397
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-16T14:01:35Z

Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
Vulnerability: GHSA-8xc6-g8xw-h2c4
Summary: YARP Denial of Service Vulnerability
Aliases: CVE-2022-26924
Severity: HIGH
CVSS score: 7.5
Published: 2022-04-22T20:23:44Z

### Impact

A denial of service vulnerability exists in how YARP processes input.

### Patches

If you're using YARP `1.0.0`, you should update to NuGet package version [`1.0.1`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.0.1).
If you're using YARP `1.1.0-RC.1`, you should update to NuGet package version [`1.1.0-rc.1.22211.2`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.0-rc.1.22211.2).

You can do so by updating the `PackageReference` in your `.csproj` file
```diff
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="1.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="1.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.1" />
</ItemGroup>
```
or by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)
![image](https://user-images.githubusercontent.com/25307628/162951795-a30f8ed7-77ef-4c4f-920e-58d9e1587ad1.png)

### References

[CVE-2022-26924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924)
Vulnerability: GHSA-9gph-22xh-8x98
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36179
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:15:54Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-f2rp-4rv7-fc95
Summary: Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox
Aliases: CVE-2021-20259
Severity: HIGH
CVSS score: 7.8
CWE: CWE-200
Published: 2021-06-10T15:54:43Z

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions before foreman_fog_proxmox 0.13.1 are affected
Vulnerability: GHSA-h96f-fc7c-9r55
Summary: Regex denial of service vulnerability in codesample plugin
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2021-01-06T19:25:46Z

### Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the `codesample` plugin
- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting

### Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-9hc2-w9gg-q6jw
Summary: Malicious Package in boogeyman
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:07:41Z

All versions of `boogeyman` are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users `.npmrc` and send them to a private pastebin account.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate your ssh keys and your npm token.
Vulnerability: GHSA-r53v-vm87-f72c
Summary: Moderate severity vulnerability that affects org.apache.axis:axis
Aliases: CVE-2014-3596
Severity: MODERATE
CVSS score: 0
CWE: CWE-297
Published: 2018-10-16T20:50:58Z

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Vulnerability: GHSA-xm99-6pv5-q363
Summary: OS Command injection in github.com/kardianos/service
Aliases: CVE-2022-29583
Severity: HIGH
CVSS score: 0
CWE: CWE-78
Published: 2022-04-23T00:03:03Z

service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory.

The validity of this vulnerability has been [questioned](https://github.com/kardianos/service/pull/290#issuecomment-1109831505) and the reporter has requested that the CVE be [disputed](https://github.com/kardianos/service/issues/289#issuecomment-1110546798).
Vulnerability: GHSA-2pmw-cvc7-frvh
Summary: SQL injection in MCMS
Aliases: CVE-2021-44868
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-02-18T00:00:34Z

A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
Vulnerability: GHSA-jr2m-29wj-w9qc
Summary: SQL Injection in FreeTAKServer-UI
Aliases: CVE-2022-25506
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-89
Published: 2022-03-12T00:00:37Z

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.
Vulnerability: GHSA-jgjc-332c-8cmc
Summary: SQL injection in phpMyAdmin
Aliases: CVE-2019-18622
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2020-01-16T21:56:15Z

An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
Vulnerability: GHSA-mvff-h3cj-wj9c
Summary: Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux
Aliases: CVE-2021-43816
Severity: HIGH
CVSS score: 8
CWE: CWE-281
Published: 2022-01-06T17:36:59Z

### Impact

Containers launched through containerd’s CRI implementation on Linux systems which use the SELinux security module and containerd versions since v1.5.0 can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bind mounts in a hostPath volume. This relabeling elevates permissions for the container, granting full read/write access over the affected files and directories. Kubernetes and crictl can both be configured to use containerd’s CRI implementation.

If you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not affected by this issue.

### Patches

This bug has been fixed in containerd 1.5.9.  Because file labels persist independently of containerd, users should both update to these versions as soon as they are released and validate that all files on their host are correctly labeled.

### Workarounds

Ensure that no sensitive files or directories are used as a hostPath volume source location.  Policy enforcement mechanisms such a Kubernetes Pod Security Policy [AllowedHostPaths](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems) may be specified to limit the files and directories that can be bind-mounted to containers.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Vulnerability: GHSA-xxgp-pcfc-3vgc
Summary: Privilege Escalation in Hibernate Validator
Aliases: CVE-2017-7536
Severity: HIGH
CVSS score: 7
CWE: CWE-470
Published: 2020-06-15T19:57:48Z

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
Vulnerability: GHSA-j23j-q57m-63v3
Summary: Denial of service in DataCommunicator class in Vaadin 8
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-400
Published: 2021-10-13T18:54:50Z

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Vulnerability: GHSA-qq74-vgcf-54c3
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0946
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-15T00:01:00Z

ShowDoc is vulnerable to stored cross-site scripting via viva cshtm file upload in in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-6jmf-mxwf-r3jc
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka
Aliases: CVE-2019-12399
Severity: HIGH
CVSS score: 7.5
CWE: CWE-319
Published: 2020-05-12T00:39:27Z

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
Vulnerability: GHSA-pmfr-63c2-jr5c
Summary: Execution Control List (ECL) Is Insecure in Singularity
Aliases: CVE-2020-13845
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347, CWE-354
Published: 2021-12-20T18:24:30Z

### Impact

The Singularity Execution Control List (ECL) allows system administrators to set up a policy that defines rules about what signature(s) must be (or must not be) present on a SIF container image for it to be permitted to run.

In Singularity 3.x versions below 3.6.0, the following issues allow the ECL to be bypassed by a malicious user:

 * Image integrity is not validated when an ECL policy is enforced.
 * The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature. Thus, it is trivial to craft an arbitrary payload which will be permitted to run, even if the attacker does not have access to the private key associated with the fingerprint(s) configured in the ECL.

### Patches

These issues are addressed in Singularity 3.6.0.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `legacyinsecure` option that can be set to `legacyinsecure = true` in `ecl.toml` to allow the ECL to perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format. The option should be used only to temporarily ease the transition to containers signed with the new 3.6.0 signature format.

### Workarounds

This issue affects any installation of Singularity configured to use the Execution Control List (ECL) functionality. There is no workaround if ECL is required.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-mfc2-93pr-jf92
Summary: Malicious code in `loadyaml`
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2020-10-01T17:10:15Z

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information:
- IP and IP-based geolocation
- home directory name
- local username 

The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.
Vulnerability: GHSA-f2rp-38vg-j3gh
Summary: Null characters not escaped
Aliases: CVE-2021-21384
Severity: HIGH
CVSS score: 6.3
CWE: CWE-88
Published: 2021-03-18T23:47:56Z

### Impact

Anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a [null character](https://en.wikipedia.org/wiki/Null_character) into the payload. For example (on Windows):

```javascript
const cp = require("child_process");
const shescape = require("shescape");

const nullChar = String.fromCharCode(0);
const payload = "foo\" && ls -al ${nullChar} && echo \"bar";
console.log(cp.execSync(`echo ${shescape.quote(payload)}`));
// foototal 3
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:44 .
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 00:09 ..
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:42 folder                                                                 
// -rw-r--r-- 1 owner XXXXXX      0 Mar 13 18:42 file
```

### Patches

The problem has been patched in [v1.1.3](https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3) which you can upgrade to now. No further changes are required.

### Workarounds

Alternatively, null characters can be stripped out manually using e.g. `arg.replace(/\u{0}/gu, "")`
Vulnerability: GHSA-28mg-98xm-q493
Summary: Open Redirect in archivy
Aliases: CVE-2022-0697
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-03-08T00:00:32Z

archivy prior to version 1.7.1 is vulnerable to open redirect.
Vulnerability: GHSA-h24f-9mm4-w336
Summary: Cross-site Scripting (XSS) - Stored in crud-file-server
Aliases: CVE-2018-3726
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2018-07-18T18:34:27Z

Versions of `crud-file-server` before 0.8.0 are vulnerable to stored cross-site scripting (XSS). This is due to insufficient santiziation of filenames when directory index is served by `crud-file-server`.


## Recommendation

Update to version 0.8.0 or later.
Vulnerability: GHSA-5p9f-55j8-922m
Summary: Moderate severity vulnerability that affects doorkeeper
Severity: MODERATE
CVSS score: 0
Published: 2018-08-13T20:49:10Z

Withdrawn, accidental duplicate publish.

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.