TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-j66h-cc96-c32q
Summary: Cross-site Scripting in SilverStripe Framework
Aliases: CVE-2021-36150
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-12T18:42:30Z

SilverStripe Framework through 4.8.1 allows XSS.
Vulnerability: GHSA-5qgp-p5jc-w2rm
Summary: Arbitrary Code Execution in Docker
Aliases: CVE-2014-6407
Severity: HIGH
CVSS score: 7.3
CWE: CWE-59
Published: 2022-02-15T00:41:12Z

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
Vulnerability: GHSA-5mh9-r3rr-9597
Summary: Code execution vulnerability in HtmlUnit
Aliases: CVE-2020-5529
Severity: HIGH
CVSS score: 8.1
CWE: CWE-665
Published: 2020-05-21T21:08:33Z

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
Vulnerability: GHSA-83r8-p8v6-6gfm
Summary: Slock<T> allows sending non-Send types across thread boundaries
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:20Z

`Slock<T>` unconditionally implements `Send`/`Sync`.

Affected versions of this crate allows sending non-Send types to other threads,
which can lead to data races and memory corruption due to the data race.
Vulnerability: GHSA-gq77-3r6x-383w
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0880
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

ShowDoc version 2.10.3 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-59x8-7wx6-4hj9
Summary: Malicious Package in secure_identity_login_module
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:47:52Z

All versions of `secure_identity_login_module` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rvmq-4x66-q7j3
Summary: Remote code execution in Apache Airflow
Aliases: CVE-2020-11978
Severity: HIGH
CVSS score: 8.8
CWE: CWE-77, CWE-78
Published: 2020-07-27T16:57:33Z

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
Vulnerability: GHSA-f7f4-hqp2-7prc
Summary: Improper Input Validation in sails-hook-sockets
Aliases: CVE-2018-21036
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2020-07-24T20:10:21Z

Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
Vulnerability: GHSA-m9mq-p2f9-cfqv
Summary: Critical severity vulnerability that affects bleach
Aliases: CVE-2018-7753
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2019-01-04T17:46:30Z

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
Vulnerability: GHSA-2q66-6cc3-6xm8
Summary: CSRF issue on preview pages in Bolt CMS
Aliases: CVE-2020-4040
Severity: HIGH
CVSS score: 8.6
CWE: CWE-352
Published: 2020-06-09T00:25:41Z

### Impact

Bolt CMS lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview.

### Patches

This has been fixed in Bolt 3.7.1

### References

Related issue: https://github.com/bolt/bolt/pull/7853
Vulnerability: GHSA-9q9m-m2f6-jr5q
Summary: Malicious Package in chak
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:22:34Z

All versions of `chak` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-5q5w-mqp6-g2gh
Summary: Unrestricted Upload of File with Dangerous Type in jsdecena/laracom
Aliases: CVE-2022-0472
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-434, CWE-79
Published: 2022-02-06T00:01:07Z

jsdecena/laracom prior to version 2.0.9 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability: GHSA-25jw-gcfj-283j
Summary: Directory Traversal in 360class.jansenhm
Aliases: CVE-2017-16186
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:27:04Z

Affected versions of `360class.jansenhm` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hhrj-wp42-32v3
Summary: Generation of Error Message Containing Sensitive Information in microweber
Aliases: CVE-2022-0660
Severity: HIGH
CVSS score: 7.5
CWE: CWE-209
Published: 2022-02-19T00:01:36Z

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-g2fg-mr77-6vrm
Summary: Uncontrolled Resource Consumption in Apache Thrift
Aliases: CVE-2020-13949
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-12T21:33:55Z

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
Vulnerability: GHSA-jp4x-w63m-7wgm
Summary: Prototype Pollution in hoek
Aliases: CVE-2018-3728
Severity: MODERATE
CVSS score: 0
CWE: CWE-471
Published: 2018-04-26T15:25:17Z

Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.

The `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.

This can be demonstrated like so:

```javascript
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
```

This type of attack can be used to overwrite existing properties causing a potential denial of service.


## Recommendation

Update to version 4.2.1, 5.0.3 or later.
Vulnerability: GHSA-6x3j-x9rp-whxp
Summary: Unrestricted Upload of File with Dangerous Type in showdoc
Aliases: CVE-2022-0409
Severity: HIGH
CVSS score: 7.8
CWE: CWE-434
Published: 2022-02-20T00:00:32Z

showdoc prior to 2.10.2 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability: GHSA-hwhf-64mh-r662
Summary: ReDoS vulnerability in parser_apache2
Aliases: CVE-2021-41186
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2021-11-01T19:16:31Z

### Impact
parser_apache2 plugin in Fluentd v0.14.14 to v1.14.1 suffers from a regular expression denial of service (ReDoS) vulnerability. A broken apache log with a certain pattern of string can spend too much time in a regular expression, resulting in the potential for a DoS attack.

### Patches
v1.14.2

### Workarounds
Either of the following:

* Don't use parser_apache2 for parsing logs which cannot guarantee generated by Apache.
* Put patched version of parser_apache2.rb into /etc/fluent/plugin  directory (or any other directories specified by the environment variable `FLUENT_PLUGIN` or `--plugin` option of fluentd).

### References
* [CVE-2021-41186](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41186)
* [GHSA-hwhf-64mh-r662](https://github.com/fluent/fluentd/security/advisories/GHSA-hwhf-64mh-r662)
* [GHSL-2021-102](https://securitylab.github.com/advisories/GHSL-2021-102-fluent-fluentd/)
* https://github.com/fluent/fluentd/blob/master/CHANGELOG.md#v1142
Vulnerability: GHSA-pfmw-vj74-ph8g
Summary: Incorrect Permission Assignment for Critical Resource in HashiCorp Vault
Aliases: CVE-2021-43998
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-732
Published: 2021-12-02T17:48:30Z

HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias if multiple entity aliases exist for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. Fixed in Vault and Vault Enterprise 1.7.6, 1.8.5, and 1.9.0.
Vulnerability: GHSA-9gr3-7897-pp7m
Summary: XSS in Image Optimization API for Next.js
Aliases: CVE-2021-39178
Severity: HIGH
CVSS score: 7.5
CWE: CWE-79
Published: 2021-09-01T18:24:22Z

### Impact
- **Affected:** All of the following must be true to be affected
    - Next.js between version 10.0.0 and 11.1.0
    - The `next.config.js` file has [`images.domains`](https://nextjs.org/docs/basic-features/image-optimization#domains) array assigned
    - The image host assigned in [`images.domains`](https://nextjs.org/docs/basic-features/image-optimization#domains) allows user-provided SVG
- **Not affected**: The `next.config.js` file has [`images.loader`](https://nextjs.org/docs/basic-features/image-optimization#loader) assigned to something other than default
- **Not affected**: Deployments on [Vercel](https://vercel.com) are not affected

### Patches
[Next.js v11.1.1](https://github.com/vercel/next.js/releases/tag/v11.1.1)
Vulnerability: GHSA-72wf-hwcq-65h9
Summary: Cross-Site Request Forgery in Filebrowser
Aliases: CVE-2021-46398
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-02-05T00:00:31Z

A Cross-Site Request Forgery (CSRF) vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.
Vulnerability: GHSA-6x85-j5j2-27jx
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-0130
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Vulnerability: GHSA-v85c-hgq5-7pfw
Summary: Arbitrary Command Injection
Aliases: CVE-2021-23399
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2021-06-29T18:26:05Z

This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-c3hq-7mxh-mqxf
Summary: Sandbox Breakout / Arbitrary Code Execution in lighter-vm
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-04T14:59:50Z

All versions of `lighter-vm` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-26q7-g57v-mxcp
Summary: HTML Injection in shout
Aliases: CVE-2017-16043
Severity: MODERATE
CVSS score: 0
CWE: CWE-80
Published: 2018-11-07T00:28:11Z

Affected versions of `shout` do not escape the `/topic` command in messages, and are therefore vulnerable to cross-site scripting.


## Recommendation

Update to version 0.50.0 or later.
Vulnerability: GHSA-hhrp-qm88-xjr3
Summary: Moderate severity vulnerability that affects valine
Aliases: CVE-2018-19289
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-21T22:19:41Z

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
Vulnerability: GHSA-36vc-cw62-fqvr
Summary: Hijacked Environment Variables in shadowsock
Aliases: CVE-2017-16078
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-27T19:07:23Z

The `shadowsock` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-gfr2-qpxh-qj9m
Summary: Path Traversal in Ansible
Aliases: CVE-2020-1735
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-22
Published: 2021-04-07T20:35:24Z

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Vulnerability: GHSA-gvpx-9459-w3mj
Summary: Cross-Site Scripting in @ckeditor/ckeditor5-link
Aliases: CVE-2018-11093
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-05-23T20:37:46Z

Versions of `status-board` prior to 10.0.1 are vulnerable to Cross-Site Scripting. The `_createPreviewButton()` function fails to sanitize the `href` attribute of a created `<a>` tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 10.0.1 or later.
Vulnerability: GHSA-wpw7-wxjm-cw8r
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-6417
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.
Vulnerability: GHSA-m929-7fr6-cvjg
Summary: Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Aliases: CVE-2018-1259
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-17T17:23:36Z

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
Vulnerability: GHSA-ffvq-7w96-97p7
Summary: Denial of Service in Spring Framework
Aliases: CVE-2018-15756
Severity: HIGH
CVSS score: 7.5
Published: 2020-06-15T19:34:50Z

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
Vulnerability: GHSA-6p5r-g9mq-ggh2
Summary: Reference binding to nullptr in `MatrixSetDiagV*` ops
Aliases: CVE-2021-37658
Severity: HIGH
CVSS score: 7.1
CWE: CWE-824
Published: 2021-08-25T14:42:49Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in all operations of type `tf.raw_ops.MatrixSetDiagV*`:

```python
import tensorflow as tf

tf.raw_ops.MatrixSetDiagV3(
  input=[1,2,3],
  diagonal=[1,1],
  k=[],
  align='RIGHT_LEFT')
```
  
The  [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of `k` is a valid tensor. We have check that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong: 

```cc 
  auto& diag_index = context->input(1);
  ...
  lower_diag_index = diag_index.flat<int32>()(0);
```
  
### Patches
We have patched the issue in GitHub commit [ff8894044dfae5568ecbf2ed514c1a37dc394f1b](https://github.com/tensorflow/tensorflow/commit/ff8894044dfae5568ecbf2ed514c1a37dc394f1b).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-6cf8-qhqj-vjqm
Summary: Prototype pollution in total.js
Aliases: CVE-2020-28495
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-02-05T20:43:19Z

There is a prototype pollution vulnerability in the package total.js before version 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
Vulnerability: GHSA-crf7-fvjx-863q
Summary: Path Traversal in zero
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T17:09:26Z

Versions of `zero` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

Upgrade to version 1.0.6 or later.
Vulnerability: GHSA-6wpv-cj6x-v3jw
Summary: Moderate severity vulnerability that affects http
Aliases: CVE-2015-1828
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2018-03-13T16:15:57Z

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Vulnerability: GHSA-m6mm-q862-j366
Summary: Improper Input Validation in Keycloak
Aliases: CVE-2020-1714
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-20
Published: 2022-02-09T00:56:14Z

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
Vulnerability: GHSA-hjxc-462x-x77j
Summary: TOCTOU Race Condition in Yarn
Aliases: CVE-2019-15608
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-367
Published: 2022-02-09T22:49:38Z

The package integrity validation in yarn &lt; 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It&#39;s not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.
Vulnerability: GHSA-2p69-gxpm-5469
Summary: Downloads Resources over HTTP in alto-saxophone
Aliases: CVE-2016-10694
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-07-31T22:34:45Z

Affected versions of `alto-saxophone` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `alto-saxophone`.


## Recommendation

Update to version 2.25.1 or later.
Vulnerability: GHSA-5x7p-gm79-383m
Summary: Malicious Package in regenraotr
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:11:57Z

All versions of `regenraotr` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-p4c6-77gc-694x
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-6077
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2017-10-24T18:33:38Z

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks.  NOTE: this is due to an incomplete fix for CVE-2007-5380.
Vulnerability: GHSA-gq5r-cc4w-g8xf
Summary: Denial of Service (DoS)
Aliases: CVE-2020-7731
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-06-23T17:25:08Z

This affects all versions up to and including 0.6.0 of package github.com/russellhaering/gosaml2. There is a crash on nil-pointer dereference caused by sending malformed XML signatures.
Vulnerability: GHSA-9hx7-rg7w-xm79
Summary: XSS vulnerability in company name field in Mautic
Aliases: CVE-2018-11200
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-01-19T21:16:26Z

### Impact
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.

### Patches
Update to 2.14.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-2cf5-4w76-r9qv
Summary: Arbitrary Code Execution in handlebars
Severity: HIGH
CVSS score: 0
Published: 2020-09-04T14:57:38Z

Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:  
```{{#with "constructor"}}
	{{#with split as |a|}}
		{{pop (push "alert('Vulnerable Handlebars JS');")}}
		{{#with (concat (lookup join (slice 0 1)))}}
			{{#each (slice 2 3)}}
				{{#with (apply 0 a)}}
					{{.}}
				{{/with}}
			{{/each}}
		{{/with}}
	{{/with}}
{{/with}}```


## Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.
Vulnerability: GHSA-j86v-p27c-73fm
Summary: Unitialized access in `EinsumHelper::ParseEquation`
Aliases: CVE-2021-41201
Severity: HIGH
CVSS score: 7.8
CWE: CWE-824
Published: 2021-11-10T19:17:43Z

### Impact
During execution, [`EinsumHelper::ParseEquation()`](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/kernels/linalg/einsum_op_impl.h#L126-L181) is supposed to set the flags in `input_has_ellipsis` vector and `*output_has_ellipsis` boolean to indicate whether there is ellipsis in the corresponding inputs and output.

However, the code only changes these flags to `true` and never assigns `false`.

```cc
for (int i = 0; i < num_inputs; ++i) {
  input_label_counts->at(i).resize(num_labels);
  for (const int label : input_labels->at(i)) {
    if (label != kEllipsisLabel)
      input_label_counts->at(i)[label] += 1;
    else
      input_has_ellipsis->at(i) = true;
  }
}
output_label_counts->resize(num_labels);
for (const int label : *output_labels) {
  if (label != kEllipsisLabel)
    output_label_counts->at(label) += 1;
  else
    *output_has_ellipsis = true;
}
```

This results in unitialized variable access if callers assume that `EinsumHelper::ParseEquation()` always sets these flags.


### Patches
We have patched the issue in GitHub commit [f09caa532b6e1ac8d2aa61b7832c78c5b79300c6](https://github.com/tensorflow/tensorflow/commit/f09caa532b6e1ac8d2aa61b7832c78c5b79300c6).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-22hc-47cc-7x6f
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0894
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:48Z

Pimcore prior to 10.4.0 is vulnerable to stored cross-site scripting.
Vulnerability: GHSA-v6w3-2prq-h95f
Summary: Improper Input Validation in Jakarta Expression Language
Aliases: CVE-2021-28170
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-917, CWE-20
Published: 2021-10-06T17:48:38Z

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Vulnerability: GHSA-cfpj-3q4c-jhvr
Summary: Division by zero in TFLite
Aliases: CVE-2021-37680
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:40:38Z

### Impact
The implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/fully_connected.cc#L226):

```cc
const int batch_size = input_size / filter->dims->data[1];
```

An attacker can craft a model such that `filter->dims->data[1]` is 0.

### Patches
We have patched the issue in GitHub commit [718721986aa137691ee23f03638867151f74935f](https://github.com/tensorflow/tensorflow/commit/718721986aa137691ee23f03638867151f74935f).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360. Concurrently, it has also been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-649c-x44h-4q7v
Summary: Low severity vulnerability that affects public
Aliases: CVE-2018-16480
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2019-02-07T18:14:37Z

A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.
Vulnerability: GHSA-gpvj-q7fp-jcch
Summary: Moderate severity vulnerability that affects simplehttpserver
Aliases: CVE-2018-3787
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2018-09-06T03:22:59Z

Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
Vulnerability: GHSA-3pxh-h8hw-mj8w
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2013-0183
Severity: MODERATE
CVSS score: 0
CWE: CWE-119
Published: 2017-10-24T18:33:37Z

multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
Vulnerability: GHSA-wcm2-9c89-wmfm
Summary: Cross-site Scripting in jquery-ui
Aliases: CVE-2010-5312
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Vulnerability: GHSA-jvf5-q4h5-2jmj
Summary: Prototype Pollution in madlib-object-utils
Aliases: CVE-2020-7701
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-05-06T17:28:57Z

madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
Vulnerability: GHSA-43g8-79x3-j898
Summary: Unrestricted access to predictable file paths in hov/jobfair
Aliases: CVE-2021-43564
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-11-15T17:36:22Z

An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. The extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files (e.g., uploads/tx_jobfair/cv.pdf).
Vulnerability: GHSA-54hw-mhgh-x4vc
Summary: Business Logic Errors in pimcore
Aliases: CVE-2021-4146
Severity: MODERATE
CVSS score: 4.3
Published: 2022-01-26T22:09:49Z

In pimcore versions prior to 10.2.9 discounts could be negative resulting in unintended behavior.
Vulnerability: GHSA-5v72-xg48-5rpm
Summary: Denial of Service in ws
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2019-06-04T19:37:52Z

Affected versions of `ws` can crash when a specially crafted `Sec-WebSocket-Extensions` header containing `Object.prototype` property names as extension or parameter names is sent.

## Proof of concept

```
const WebSocket = require('ws');
const net = require('net');

const wss = new WebSocket.Server({ port: 3000 }, function () {
  const payload = 'constructor';  // or ',;constructor'

  const request = [
    'GET / HTTP/1.1',
    'Connection: Upgrade',
    'Sec-WebSocket-Key: test',
    'Sec-WebSocket-Version: 8',
    `Sec-WebSocket-Extensions: ${payload}`,
    'Upgrade: websocket',
    '\r\n'
  ].join('\r\n');

  const socket = net.connect(3000, function () {
    socket.resume();
    socket.write(request);
  });
});
```


## Recommendation

Update to version 3.3.1 or later.
Vulnerability: GHSA-fwcw-5qw2-87mp
Summary: Cross-Site Scripting in fuelux
Aliases: CVE-2016-1000235
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:55:56Z

Affected versions of `fuelux` contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution.  



## Recommendation

Update to version 3.15.7 or later.
Vulnerability: GHSA-hhw2-pqhf-vmx2
Summary: Use after free in actix-utils
Aliases: CVE-2020-35898
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-416
Published: 2021-08-25T20:49:09Z

An issue was discovered in the actix-utils crate before 2.0.0 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
Vulnerability: GHSA-2p62-c4rm-mr72
Summary: Malicious Package in another-date-picker
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:44:57Z

Version 2.0.43 of `another-date-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 2.0.43 of this module is found installed you will want to replace it with a version before or after 2.0.43. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-36c4-4r89-6whg
Summary: Prototype Pollution in @commercial/subtext
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T15:49:02Z

Versions of `@commercial/subtext` prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

Upgrade to version 5.1.2 or later.
Vulnerability: GHSA-7mpx-vg3c-cmr4
Summary: Improper Authentication in react-adal
Aliases: CVE-2020-7787
Severity: HIGH
CVSS score: 8.2
CWE: CWE-287
Published: 2021-04-13T15:22:37Z

This affects versions of react-adal < 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key is automatically appended by ||. When the received nonce and session keys are generated, the list of values is stored in the browser storage, separated by ||, with || always appended to the end of the list. Since || will always be the last 2 characters of the stored values, an empty string ("") will always be in the list of the valid values. Therefore, if an empty session parameter is provided in the callback URL, and a specially-crafted JWT token contains an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic.
Vulnerability: GHSA-f2j6-wrhh-v25m
Summary: High severity vulnerability that affects paramiko
Aliases: CVE-2018-1000805
Severity: HIGH
CVSS score: 8.8
CWE: CWE-863, CWE-732
Published: 2018-10-10T16:10:10Z

Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.
Vulnerability: GHSA-25xm-hr59-7c27
Summary: Release v0.5.8 of github.com/ulikunitz/xz fixes readUvarint denial of service
Aliases: CVE-2021-29482
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2021-05-25T18:39:37Z

### Impact

The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.

### Patches

The problem has been fixed in release v0.5.8.

### Workarounds

Limit the size of the compressed file input to a reasonable size for your use case.

### References

The standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [xz](https://github.com/ulikunitz/xz/issues).
Vulnerability: GHSA-9vvp-fxw6-jcxr
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11113
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2020-05-15T18:58:47Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
Vulnerability: GHSA-6qqj-rx4w-r3cj
Summary: CSRF Vulnerability in jquery-ujs
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2020-08-31T22:48:44Z

Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains.

When an attacker controls the href attribute of an anchor tag, or
the action attribute of a form tag triggering a POST action, the attacker can set the
href or action to " https://attacker.com". By prepending a space to the external domain, it causes jQuery to consider it a same origin request, resulting in the user's CSRF token being sent to the external domain.


## Recommendation

Upgrade jquery-ujs to version 1.0.4 or later.
Vulnerability: GHSA-qgfr-5hqp-vrw9
Summary: Path Traversal in decompress
Aliases: CVE-2020-12265
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-59, CWE-22
Published: 2020-09-03T21:16:27Z

Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`.


## Recommendation

Upgrade to version 4.2.1 or later.
Vulnerability: GHSA-xp5j-wj4h-2jq9
Summary: Injection and Improper Input Validation in Apache Unomi
Aliases: CVE-2020-13942
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74, CWE-20
Published: 2022-02-10T00:30:54Z

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Vulnerability: GHSA-5q5w-mf87-57x4
Summary: Downloads Resources over HTTP in sfml
Aliases: CVE-2016-10654
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:45:18Z

Affected versions of `sfml` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-p5xp-6vpf-jwvh
Summary: Improper Input Validation and Cross-Site Request Forgery in Keycloak
Aliases: CVE-2019-10199
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352, CWE-20
Published: 2019-09-23T18:32:27Z

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
Vulnerability: GHSA-g336-c7wv-8hp3
Summary: Cross-Site Scripting in swagger-ui
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:58:06Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting via the `url` query string parameter.


## Recommendation

Update to 2.2.1 or later.
Vulnerability: GHSA-w3cg-6577-wx9f
Summary: Directory Traversal in cuciuci
Aliases: CVE-2017-16122
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:20:41Z

Affected versions of `cuciuci` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-vx8v-g3p3-88vg
Summary: Weak password hash in LiveHelperChat
Aliases: CVE-2022-1235
Severity: HIGH
CVSS score: 7.5
CWE: CWE-916
Published: 2022-04-06T00:01:31Z

The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.
Vulnerability: GHSA-f58w-649r-qjr9
Summary: Moderate severity vulnerability that affects splunk-sdk
Aliases: CVE-2019-5729
Severity: HIGH
CVSS score: 8.1
CWE: CWE-295
Published: 2019-03-25T16:18:04Z

Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks.
Vulnerability: GHSA-m42h-mh85-4qgc
Summary: Moderate severity vulnerability that affects railties
Aliases: CVE-2019-5420
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-330, CWE-77
Published: 2019-03-13T17:28:35Z

# Possible Remote Code Execution Exploit in Rails Development Mode

Impact 
------ 
With some knowledge of a target application it is possible for an attacker to 
guess the automatically generated development mode secret token.  This secret 
token can be used in combination with other Rails internals to escalate to a 
remote code execution exploit. 

All users running an affected release should either upgrade or use one of the 
workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations. 

Workarounds 
----------- 
This issue can be mitigated by specifying a secret key in development mode. 
In "config/environments/development.rb" add this: 

```
  config.secret_key_base = SecureRandom.hex(64) 
```

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported 
at present. Users of earlier unsupported releases are advised to upgrade as 
soon as possible as we cannot guarantee the continued availability of security 
fixes for unsupported releases. 

Credits 
------- 
Thanks to ooooooo_q
Vulnerability: GHSA-5x8q-gj67-rhf2
Summary: Malicious Package in discord_debug_log
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:18:33Z

All versions of `discord_debug_log` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-25xj-89g5-fm6h
Summary: Information Disclosure in HashiCorp Vault
Aliases: CVE-2020-13223
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-532
Published: 2021-05-18T18:21:09Z

HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File.
Vulnerability: GHSA-rc7p-gmvh-xfx2
Summary: Attack on Kubernetes via Misconfigured Argo Workflows
Severity: MODERATE
CVSS score: 0
Published: 2021-08-02T17:19:52Z

### Impact

Users running using the Argo Server with `--auth-mode=server` (which is the default < v3.0.0) AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining.

### Resolution

* Do not expose your user interface to the Internet. 
* Change configuration. `--auth-mode=client`. 

For users using an older 2.x version of Argo Server, consider upgrading to Argo Server version 3.x or later.
Vulnerability: GHSA-hrcp-8f3q-4w2c
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21351
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-434, CWE-502
Published: 2021-03-22T23:29:37Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21351](https://x-stream.github.io/CVE-2021-21351.html).

### Credits
wh1t3p1g G5-RD6@IIE found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)