TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-36p7-xjw8-h6f2
Summary: Ruby-saml allows attackers to perform XML signature wrapping attacks via unspecified vectors
Aliases: CVE-2016-5697
Severity: HIGH
CVSS score: 7.5
CWE: CWE-91
Published: 2018-08-21T17:08:30Z

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
Vulnerability: GHSA-5wg4-74h6-q47v
Summary: Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt
Aliases: CVE-2020-7689
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-327, CWE-190
Published: 2020-08-20T14:38:49Z

In bcrypt (npm package) before version 5.0.0, data is truncated wrong when its length is greater than 255 bytes.
Vulnerability: GHSA-xwv6-v7qx-f5jc
Summary: Code injection in ezsystems/ezpublish-kernel
Aliases: CVE-2022-25337
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2022-02-19T00:01:25Z

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, since not all possible attack vectors are removed from the original file name.

The second issue is that direct access to the images is not access controlled. This is by design, for performance reasons, and documented as such. But it does mean that images not meant to be publicly accessible can be accessed, provided that the image path and filename is correctly deduced and/or guessed, through dictionary attacks and similar.
Vulnerability: GHSA-9mxf-g3x6-wv74
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14721
Severity: CRITICAL
CVSS score: 10
CWE: CWE-918
Published: 2019-01-04T19:07:06Z

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Vulnerability: GHSA-g5m7-57ph-j6p8
Summary: OS Command Injection in Nexus Yum Repository Plugin
Aliases: CVE-2019-5475
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2019-09-11T23:04:57Z

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
Vulnerability: GHSA-x4g7-fvjj-prg8
Summary: Division by 0 in `QuantizedConv2D`
Aliases: CVE-2021-29527
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:21:59Z

### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.QuantizedConv2D`:

```python
import tensorflow as tf

input = tf.zeros([1, 1, 1, 1], dtype=tf.quint8)
filter = tf.constant([], shape=[1, 0, 1, 1], dtype=tf.quint8)
min_input = tf.constant(0.0)
max_input = tf.constant(0.0001)
min_filter = tf.constant(0.0)
max_filter = tf.constant(0.0001)
strides = [1, 1, 1, 1]
padding = "SAME"               
                               

tf.raw_ops.QuantizedConv2D(input=input, filter=filter, min_input=min_input, max_input=max_input, min_filter=min_filter, max_filter=max_filter, strides=strides, padding=padding)
```
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/00e9a4d67d76703fa1aee33dac582acf317e0e81/tensorflow/core/kernels/quantized_conv_ops.cc#L257-L259) does a division by a quantity that is controlled by the caller: 

```cc
const int filter_value_count = filter_width * filter_height * input_depth;
const int64 patches_per_chunk = kMaxChunkSize / (filter_value_count * sizeof(T1));
```
  
### Patches
We have patched the issue in GitHub commit [cfa91be9863a91d5105a3b4941096044ab32036b](https://github.com/tensorflow/tensorflow/commit/cfa91be9863a91d5105a3b4941096044ab32036b).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-5f5c-687x-g5qm
Summary: Classic Buffer Overflow in pyo
Aliases: CVE-2021-41499
Severity: HIGH
CVSS score: 7.5
CWE: CWE-120
Published: 2022-01-07T00:10:33Z

Buffer Overflow Vulnerability exists in ajaxsoundstudio.com in Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by deliberately passing on an overlong audio file name.
Vulnerability: GHSA-qj3f-9gmq-fwv5
Summary: Cross-Site Scripting in simple-markdown
Aliases: CVE-2019-9844
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-09T19:47:29Z

Versions of `simple-markdown` prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.


## Recommendation

Upgrade to version 0.4.4 or later.
Vulnerability: GHSA-jxf5-7x3j-8j9m
Summary: Malicious Package in load-from-cwd-or-npm
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:19:14Z

Version 3.0.2 of `load-from-cwd-or-npm`  contains malicious code. The malware breaks functionality of the `purescript-installer` package by injecting targeted code.


## Recommendation

Upgrade to version 3.0.4 or later. There is no indication of further compromise.
Vulnerability: GHSA-887w-45rq-vxgf
Summary: Moderate severity vulnerability that affects SQLAlchemy
Aliases: CVE-2019-7164
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-04-16T15:50:41Z

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Vulnerability: GHSA-2589-w6xf-983r
Summary: Cross-site scripting in react-bootstrap-table
Aliases: CVE-2021-23398
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-10T18:58:49Z

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
Vulnerability: GHSA-82mg-x548-gq3j
Summary: LDAP Injection in ldapauth
Aliases: CVE-2015-7294
Severity: HIGH
CVSS score: 7.5
CWE: CWE-90
Published: 2020-08-31T22:49:46Z

Versions 2.2.4 and earlier of `ldapauth-fork` are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.



## Recommendation

ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use [ldapauth-fork](https://www.npmjs.com/package/ldapauth-fork) 2.3.3 or greater.
Vulnerability: GHSA-9c78-vcq7-7vxq
Summary: Out of bounds write in TFLite
Aliases: CVE-2022-23561
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2022-02-09T23:53:47Z

### Impact 
An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

### Patches
We have patched the issue in GitHub commit [6c0b2b70eeee588591680f5b7d5d38175fd7cdf6](https://github.com/tensorflow/tensorflow/commit/6c0b2b70eeee588591680f5b7d5d38175fd7cdf6).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability: GHSA-fj2w-wfgv-mwq6
Summary: Denial of service in CBOR library
Severity: HIGH
CVSS score: 0
CWE: CWE-407
Published: 2022-01-21T23:21:48Z

### Impact
Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.  

Affected versions _include_ versions 4.0.0 through 4.5.0.

This vulnerability was privately reported to me.

### Patches
This issue has been fixed in version 4.5.1.  Users should use the latest version of this library.  (The latest version is not necessarily 4.5.1.  Check the README for [this library's repository](https://github.com/peteroupc/CBOR-Java) to see the latest version's version number.)

### Workarounds

Again, users should use the latest version of this library.

In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if&mdash;

- it begins with a byte other than 0x80 through 0xDF, or
- it does not contain a byte in the range 0xa0 through 0xBF.

Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR-Java).
Vulnerability: GHSA-xmc8-26q4-qjhx
Summary: Denial of Service (DoS) in Jackson Dataformat CBOR
Aliases: CVE-2020-28491
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2021-12-09T19:17:21Z

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
Vulnerability: GHSA-88h9-fc6v-jcw7
Summary: Unintended Require in larvitbase-www
Severity: MODERATE
CVSS score: 0
Published: 2020-09-03T20:28:51Z

All versions of `larvitbase-www` are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-867q-77cc-98mv
Summary: Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
Aliases: CVE-2021-21429
Severity: MODERATE
CVSS score: 4
CWE: CWE-552, CWE-379, CWE-378, CWE-377
Published: 2021-04-29T21:51:37Z

### Impact

Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This vulnerability does not impact Windows or modern versions of MacOS.

OpenAPI Generator Maven plug-in creates insecure temporary files during the code generation process. It creates insecure temporary files to store the OpenAPI specification files provided by the users and these temporary files can be read by any users in the system.

The impact of this vulnerability is information disclosure of the contents of the specification file to other local users.

### Patches
The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [OpenAPI Generator Github repo](https://github.com/openAPITools/openapi-generator/)
* Email us at [security@openapitools.org](mailto:security@openapitools.org)
Vulnerability: GHSA-5c6c-w4c4-vgvx
Summary: Cross-site scripting in Jenkins Scriptler Plugin
Aliases: CVE-2021-21668
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-06T18:45:09Z

Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
Vulnerability: GHSA-4662-j96g-mv46
Summary: Arbitrary Code Injection in reduce-css-calc
Aliases: CVE-2016-10548
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2018-06-07T19:43:06Z

Affected versions of `reduce-css-calc` pass input directly to `eval`. If user input is passed into the calc function, this may result in cross-site scripting on the browser, or remote code execution on the server.

## Proof of Concept

```
const reduceCSSCalc = require('reduce-css-calc');
console.log(reduceCSSCalc(`calc(                       (Buffer(10000)))`));
console.log(reduceCSSCalc(`calc(                       (global['fs'] = require('fs')))`));
console.log(reduceCSSCalc(`calc(                       (fs['readFileSync']("/etc/passwd", "utf-8")))`));
```



## Recommendation

Update to version 1.2.5 or later.
Vulnerability: GHSA-rp42-c45j-g46x
Summary: yetiforcecrm is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4107
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-79
Published: 2021-12-16T14:12:23Z

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-hr3c-6mmp-6m39
Summary: Memory corruption slice-deque
Aliases: CVE-2018-20995
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2021-08-25T20:42:57Z

An issue was discovered in the slice-deque crate before 0.1.16 for Rust. move_head_unchecked allows memory corruption because deque updates are mishandled.
Vulnerability: GHSA-9c5c-5j4h-8q2c
Summary: bookstack is vulnerable to Improper Access Control.
Aliases: CVE-2021-4119
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-284
Published: 2021-12-16T19:40:26Z

bookstack prior to version 21.11.3 is vulnerable to Improper Access Control.
Vulnerability: GHSA-pm3h-mm62-pwm8
Summary: XML Entity Expansion in trytond and proteus
Aliases: CVE-2022-26662
Severity: HIGH
CVSS score: 7.5
CWE: CWE-776
Published: 2022-03-11T00:02:04Z

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
Vulnerability: GHSA-477x-w7m6-c6ph
Summary: Improper input validation in Apache Olingo
Aliases: CVE-2019-17555
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2020-02-04T22:37:15Z

The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.
Vulnerability: GHSA-m8h8-v6jh-c762
Summary: Incorrect buffer size in crossbeam-channel
Aliases: CVE-2020-35904
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-131
Published: 2021-08-25T20:49:43Z

An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are.
Vulnerability: GHSA-5wq6-v5cw-jvfr
Summary: Malicious Package in js-shas
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:03:36Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-w6v2-qchm-grj7
Summary: Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity
Aliases: CVE-2020-25039
Severity: HIGH
CVSS score: 8.1
CWE: CWE-668, CWE-732
Published: 2021-12-20T18:25:46Z

### Impact

Insecure permissions on temporary directories used in fakeroot or user namespace container execution.

When a Singularity action command (run, shell, exec) is run with the fakeroot or user namespace option, Singularity will extract a container image to a temporary sandbox directory. Due to insecure permissions on the temporary directory it is possible for any user with access to the system to read the contents of the image. Additionally, if the image contains a world-writable file or directory, it is possible for a user to inject arbitrary content into the running container.

### Patches

This issue is addressed in Singularity 3.6.3.

All users are advised to upgrade to 3.6.3.

### Workarounds

The issue is mitigated if `TMPDIR` is set to a location that is only accessible to the user, as any subdirectories directly under `TMPDIR` cannot then be accessed by others. However, this is difficult to enforce so it is not recommended to rely on this as a mitigation.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-w5q7-3pr9-x44w
Summary: Denial of Service in serialize-to-js
Severity: HIGH
CVSS score: 0
Published: 2020-09-02T15:59:19Z

Versions of `serialize-to-js` prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely.


## Recommendation

Upgrade to version 2.0.0 or later.
Vulnerability: GHSA-crfh-jmv2-2f9v
Summary: Malicious Package in singale
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:03:11Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7frv-9phw-vrvr
Summary: Authorization bypass in Strapi
Aliases: CVE-2020-27664
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-862
Published: 2021-05-10T18:43:59Z

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
Vulnerability: GHSA-24r8-fm9r-cpj2
Summary: Low severity vulnerability that affects com.linecorp.armeria:armeria
Aliases: CVE-2019-16771
Severity: LOW
CVSS score: 4.8
CWE: CWE-113
Published: 2019-12-05T18:40:51Z

## Multiple timing attack vulnerabilities leading to the recovery of secrets based on the use of non-constant time compare function

### Impact

String comparison method in multiple authentication validation in Armeria were known to be vulnerable to timing attacks. This vulnerability is caused by the insecure implementation of `equals` method from `java.lang.String`. While this attack is not practically possible, an attacker still has a potential to attack if the victim's server validates user by using `equals` method.

We would like to thank @chrsow for pointing out the issue.

## Potentially vulnerable codes

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/OAuth2Token.java#L54
https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/BasicToken.java#L64

### Patches

There are two options to patch this issue.

1. Remove `equals` method; it has been exclusively used for test cases and was never used in any OSS projects that are using Armeria. (But it is worth noting that there are possibilities of closed projects authenticating users by utilizing `equals` method)

2. Use `MessageDigest.isEqual` to compare the credential instead.

### Workarounds

1. Update to the latest version (TBD)

2-1. Users can prevent these vulnerabilities by modifying and implementing timing attack preventions by themselves.

2-2. Precisely speaking, it is possible to compare credentials by securely comparing them after calling methods to directly return the input (namely `Object. accessToken()`, `Object.username()` and `Object.password()`).

### References
- https://cwe.mitre.org/data/definitions/208.html
- https://security.stackexchange.com/questions/111040/should-i-worry-about-remote-timing-attacks-on-string-comparison

### Side Note

Since it is a theoretical attack, there is no PoC available from neither the vendor nor the security team.
Vulnerability: GHSA-p2j7-6g9h-32xh
Summary: Cross site scripting in Shopizer
Aliases: CVE-2022-23059
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-30T00:00:27Z

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
Vulnerability: GHSA-6768-mcjc-8223
Summary: Command injection leading to Remote Code Execution in Apache Storm
Aliases: CVE-2021-38294
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74, CWE-77
Published: 2021-10-27T18:51:22Z

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
Vulnerability: GHSA-q6j3-c4wc-63vw
Summary: CSRF tokens leaked in URL by canned query form
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200
Published: 2020-08-11T14:54:40Z

### Impact

The HTML form for a read-only canned query includes the hidden CSRF token field added in #798 for writable canned queries (#698).

This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhood_search submitting the form took me to:

https://latest.datasette.io/fixtures/neighborhood_search?text=down&csrftoken=CSRFTOKEN-HERE

This token could potentially leak to an attacker if the resulting page has a link to an external site on it and the user clicks the link, since the token would be exposed in the referral logs.

### Patches

A fix for this issue has been released in Datasette 0.46.

### Workarounds

You can fix this issue in a Datasette instance without upgrading by copying the [0.46 query.html template](https://raw.githubusercontent.com/simonw/datasette/0.46/datasette/templates/query.html) into a custom `templates/` directory and running Datasette with the `--template-dir=templates/` option.

### References

Issue 918 discusses this in details: https://github.com/simonw/datasette/issues/918

### For more information

Contact swillison at gmail with any questions.
Vulnerability: GHSA-hpm9-fx8v-w45v
Summary: Plaintext storage in Jenkins instant-messaging Plugin
Aliases: CVE-2022-28135
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-256
Published: 2022-03-30T00:00:25Z

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Vulnerability: GHSA-wx77-rp39-c6vg
Summary: Regular Expression Denial of Service in markdown
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2020-09-04T15:11:03Z

All versions of `markdown` are vulnerable to Regular Expression Denial of Service (ReDoS). The `markdown.toHTML()` function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the parser accepts user input.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-284f-f2hw-j2gx
Summary: Server-Side Request Forgery vulnerability in concrete5
Aliases: CVE-2021-22958
Severity: HIGH
CVSS score: 8.2
CWE: CWE-918
Published: 2021-10-12T18:41:59Z

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.
Vulnerability: GHSA-f8xq-q7px-wg8c
Summary: Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
Aliases: CVE-2022-24770
Severity: HIGH
CVSS score: 8.8
CWE: CWE-1236
Published: 2022-03-18T23:11:43Z

### Impact
The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer.

### Patches
The problem has been patched as of `2.8.11`, which escapes the data saved to the csv with single quotes.

### Workarounds
If you are using an older version of `gradio`, don't open csv files generated by `gradio` with Excel or similar spreadsheet programs.
Vulnerability: GHSA-fqr5-qphf-vfr8
Summary: Cross Site Scripting (XSS) in Simiki
Aliases: CVE-2020-19000
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-09-01T18:37:01Z

Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simiki/blob/master/simiki/generators.py'.
Vulnerability: GHSA-3pcq-34w5-p4g2
Summary: forEachSeries and forEachLimit do not limit the number of requests
Aliases: CVE-2021-41167
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-10-21T17:49:30Z

### Impact

This is a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects.

### Patches

The problem has been patched in 1.0.4.

### Workarounds

There is no workaround aside from upgrading to 1.0.4.
Vulnerability: GHSA-pm77-c4q7-3fwj
Summary: Improper Certificate Validation in Heartland & Global Payments PHP SDK
Aliases: CVE-2019-20455
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2021-10-12T16:31:12Z

Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations.
Vulnerability: GHSA-4mf2-f3wh-gvf2
Summary: Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy
Aliases: CVE-2021-21291
Severity: LOW
CVSS score: 5.4
CWE: CWE-601
Published: 2021-05-25T18:42:20Z

### Impact
_What kind of vulnerability is it? Who is impacted?_
For users that use the whitelist domain feature, a domain that ended in a similar way to the intended domain could have been allowed as a redirect.

For example, if a whitelist domain was configured for `.example.com`, the intention is that subdomains of `example.com` are allowed.
Instead, `example.com` and `badexample.com` could also match.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
This is fixed in version 7.0.0 onwards.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Disable the whitelist domain feature and run separate OAuth2 Proxy instances for each subdomain.

# Original Issue Posted by @semoac:

Whitelist Domain feature is not working as expected because is not matching a dot to ensure the redirect is a subdomain.

## Expected Behavior

If whitelist domain is set to `.example.com` , then `hack.alienexample.com`  should be rejected as a valid redirect.

## Current Behavior

The code is removing the `dot`  from `.example.com`  and  only checking if the redirect string end with `example.com`

## Possible Solution
Here
https://github.com/oauth2-proxy/oauth2-proxy/blob/c377466411f2aee180a732187edb638f2f7e57fb/oauthproxy.go#L661

Include the dot when checking the string:
```
strings.HasSuffix(redirectHostname, "." + domainHostname)
```

## Steps to Reproduce (for bugs)

```
package main

import (
	"fmt"
	"strings"
)

func validOptionalPort(port string) bool {
	if port == "" || port == ":*" {
		return true
	}
	if port[0] != ':' {
		return false
	}
	for _, b := range port[1:] {
		if b < '0' || b > '9' {
			return false
		}
	}
	return true
}

func splitHostPort(hostport string) (host, port string) {
	host = hostport

	colon := strings.LastIndexByte(host, ':')
	if colon != -1 && validOptionalPort(host[colon:]) {
		host, port = host[:colon], host[colon+1:]
	}

	if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") {
		host = host[1 : len(host)-1]
	}

	return
}

func main() {
	domain := ".example.com"
	domainHostname, _ := splitHostPort(strings.TrimLeft(domain, "."))
	redirectHostname := "https://hack.alienexample.com"
	if (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectHostname, domainHostname)) { fmt.Println("This should not have happen.")}
}

```

Users of `github.com/oauth2-proxy/oauth2-proxy` are advised to update to `github.com/oauth2-proxy/oauth2-proxy/v7`
Vulnerability: GHSA-c8x3-rg72-fwwg
Summary: Privilege escalation in Hashicorp Nomad
Aliases: CVE-2021-37218
Severity: HIGH
CVSS score: 8.8
CWE: CWE-295
Published: 2021-09-08T20:14:38Z

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
Vulnerability: GHSA-5c6f-jpx7-cwq6
Summary: Directory Traversal in enserver
Aliases: CVE-2017-16209
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:13:11Z

Affected versions of `enserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-vx9g-377x-xwxq
Summary: Server side request forgery in gibbon
Aliases: CVE-2022-27311
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2022-04-26T00:00:41Z

Gibbon v3.4.3 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. This issue has been resolved in version 3.4.4
Vulnerability: GHSA-jp99-5h8w-gmxc
Summary: Sandbox Breakout / Arbitrary Code Execution in @zhaoyao91/eval-in-vm
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-04T15:03:13Z

All versions of `@zhaoyao91/eval-in-vm` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-cvmr-6428-87w9
Summary: Cross-Site Scripting in Grav
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-12-10T23:13:08Z

### Impact
Privileged users (with the ability to edit pages) have a mechanism to perform remote code execution via XSS. At a minimum, the vulnerability represents a bypass of security controls put in place to mitigate this form of attack.

The remote code execution can be performed because XSS would allow an attacker to execute functionality on behalf of a stolen administrative account - the facility to install custom plugins would then allow said attacker to install a plugin containing a web shell and thus garner access to the underlying system.

### References
https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
https://cwe.mitre.org/data/definitions/79.html

### For more information
Please contact contact@pentest.co.uk
Vulnerability: GHSA-6x8c-mvpv-5366
Summary: Directory Traversal in shit-server
Aliases: CVE-2017-16147
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:18:32Z

Affected versions of `shit-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-2c83-wfv3-q25f
Summary: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown
Severity: CRITICAL
CVSS score: 0
CWE: CWE-78
Published: 2021-09-07T23:07:56Z

### Impact

A Remote Command Execution vulnerability was found in the rebber module,
which allowed execution of arbitrary commands. The reported problem came
from CodeBlocks, which could be escaped to insert malicious LaTeX.

Anyone using `rebber` without sanitation of code content or a custom
macro is impacted by this vulnerability. Here is an example of a Markdown
content that will exploit the vulnerability:

````markdown
```
\end{CodeBlock}

\immediate\write18{COMMAND > outputrce}
\input{outputrce}

\begin{CodeBlock}{text}
```
````

Will insert into the generated LaTeX the result of executing
`COMMAND` on the system.

### Patches

The vulnerability has been patched in version 5.2.1.
If impacted, you should update to this version as soon as possible.

### Workarounds

It is possible to mitigate the vulnerability without upgrading by using a
custom code macro. Please make sure this custom macro escapes your
closing LaTeX sequence. For the example above, use:

```javascript
const escaped = content.replace(new RegExp('\\\\end\\s*{CodeBlock}', 'g'), '')
```

### For more information

If you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).
Vulnerability: GHSA-j8fq-86c5-5v2r
Summary: Remote code execution in dask
Aliases: CVE-2021-42343
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-668
Published: 2021-10-27T18:53:48Z

An issue was discovered in Dask (aka python-dask) through 2021.09.1. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
Vulnerability: GHSA-h595-8pw6-5q6v
Summary: Inadequate Encryption Strength in DotNetNuke
Aliases: CVE-2018-15811
Severity: HIGH
CVSS score: 7.5
CWE: CWE-326
Published: 2019-07-05T21:08:36Z

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Vulnerability: GHSA-8r4g-cg4m-x23c
Summary: Denial of Service in node-static
Severity: MODERATE
CVSS score: 0
CWE: CWE-248, CWE-400
Published: 2021-09-22T18:22:02Z

All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.
Vulnerability: GHSA-gc25-3vc5-2jf9
Summary: Sandbox Breakout / Arbitrary Code Execution in sandbox
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-04T15:00:58Z

All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7p7h-4mm5-852v
Summary: Regular Expression Denial of Service in trim-newlines
Aliases: CVE-2021-33623
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-07T22:10:39Z

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.
Vulnerability: GHSA-72mh-269x-7mh5
Summary: Improper Certificate Validation in xmlhttprequest-ssl
Aliases: CVE-2021-31597
Severity: CRITICAL
CVSS score: 9.4
CWE: CWE-295
Published: 2021-05-24T19:52:55Z

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Vulnerability: GHSA-3r8f-gphx-9m2c
Summary: Path Traversal in mcstatic
Aliases: CVE-2018-3730
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-27T17:04:16Z

All versions of `mcstatic` are vulnerable to path traversal.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
Vulnerability: GHSA-r74q-wqx8-2pr3
Summary: Downloads Resources over HTTP in nodeschnaps
Aliases: CVE-2016-10622
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:31Z

Affected versions of `nodeschnaps` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodeschnaps`.


## Recommendation

Update to version 1.0.3 or later.
Vulnerability: GHSA-4284-x26r-4hhc
Summary: Cross Site Request Forgery in Apache JSPWiki
Aliases: CVE-2022-24947
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-02-26T00:00:44Z

Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
Vulnerability: GHSA-h45p-w933-jxh3
Summary: Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript 
Severity: MODERATE
CVSS score: 0
CWE: CWE-347
Published: 2021-06-01T21:20:22Z

### Impact

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. 

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. 

For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to process per message. This configuration provides customers with a way to limit the number of AWS KMS Decrypt API calls that the ESDK will make per message. This setting will reject messages with more EDKs than the configured limit.

Finally, this update adds early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.

### Patches

Fixed in versions 1.9 and 2.2. We recommend that all users upgrade to address these issues.

Customers leveraging the ESDK’s streaming features have several options to protect signature validation. One is to ensure that client code reads to the end of the stream before using released plaintext. With this release, using the new API for streaming and falling back to the non-streaming decrypt API for signed messages prevents using any plaintext from signed data before the signature is validated. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

Users processing ESDK messages from untrusted sources should use the new maximum encrypted data keys parameter. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

### Workarounds

None

### For more information

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#digital-sigs

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x
Vulnerability: GHSA-wfm4-pq59-wg6r
Summary: Reset Password / Login vulnerability in Sulu
Aliases: CVE-2020-15132
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-209
Published: 2020-08-05T21:27:44Z

### Impact

_What kind of vulnerability is it? Who is impacted?_

This vulnerability consists of a few related issues:

#### Forget password leaks information if the user exists

When the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist:

```json
{
    "code": 0,
    "message": "Entity with the type \u0022Sulu\\Bundle\\SecurityBundle\\Entity\\User\u0022 and the id \u0022asdf\u0022 not found."
}
```

This enables attackers to retrieve valid usernames.

#### Forgot password leaks user email if user exists

The response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful:

```json
{"email":"admin@localhost.local"}
```

This information should not be exposed, as it can be used to gather email addresses.

#### Response time of login gives hint if the username exists

If the username the user enters in the login screen does not exists, the request responds much faster than if the username exists. This again allows attackers to retrieve valid usernames.

#### Reset Token for Forgot Password feature is not hashed

The reset token in the user database table is not hashed. That means that somebody could try to request a new password using the Forgot Password feature, and look that up in the database, if the attacker somehow got access to the database. Hashing the reset token would fix that problem.

### Patches

This problem was fixed in Release 1.6.34, 2.0.10 and 2.1.1.

### Workarounds

Override the files manually in your project and change them accordingly.
Vulnerability: GHSA-q4m3-2j7h-f7xw
Summary: Cross-Site Scripting in jquery
Aliases: CVE-2020-7656
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-05-20T16:18:01Z

Versions of `jquery` prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.9.0 or later.
Vulnerability: GHSA-p75j-wc34-527c
Summary: Exposure of Sensitive Information to an Unauthorized Actor in ansible
Aliases: CVE-2019-10217
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2021-10-12T16:31:59Z

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.
Vulnerability: GHSA-434h-p4gx-jm89
Summary: Observable Response Discrepancy in Flask-AppBuilder
Aliases: CVE-2021-29621
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-203
Published: 2021-05-27T18:38:36Z

### Impact
User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.

### Patches
Upgrade to 3.3.0

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Flask-AppBuilder](https://github.com/dpgaspar/Flask-AppBuilder)
Vulnerability: GHSA-6qpr-9mc5-7gch
Summary: Command Injection in async-git
Aliases: CVE-2020-28490
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-12T19:50:20Z

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')
Vulnerability: GHSA-cfc5-x58f-869w
Summary: Malicious Package in conistring
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:40:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-p826-8vhq-h439
Summary: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
Aliases: CVE-2021-31411
Severity: HIGH
CVSS score: 6.3
CWE: CWE-379
Published: 2021-05-06T15:27:12Z

Insecure temporary directory usage in frontend build functionality of `com.vaadin:flow-server` versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

- https://vaadin.com/security/cve-2021-31411