TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-32wx-4gxx-h48f
Summary: Users can edit the tags of any discussion
Severity: MODERATE
CVSS score: 0
CWE: CWE-639
Published: 2021-01-29T18:13:32Z

This advisory concerns a vulnerability which was patched and publicly released on October 5, 2020.

### Impact
This vulnerability allowed any registered user to edit the tags of any discussion for which they have READ access using the REST API.

Users were able to remove any existing tag, and add any tag in which they are allowed to create discussions. The chosen tags still had to match the configured Tags minimums and maximums.

By moving the discussion to new tags, users were able to go around permissions applied to restricted tags. Depending on the setup, this can include publicly exposing content that was only visible to certain groups, or gain the ability to interact with content where such interaction was limited.

The full impact varies depending on the configuration of permissions and restricted tags, and which community extensions are being used. All tag-scoped permissions offered by extensions are impacted by this ability to go around them.

Forums that don't use restricted tags and don't use any extension that relies on tags for access control should not see any security impact. An update is still required to stop users from being able to change any discussion's tags.

Forums that don't use the Tags extension are unaffected.

### Patches
The fix will be available in version v0.1.0-beta.14 with Flarum beta 14. The fix has already been back-ported to Flarum beta 13 as version v0.1.0-beta.13.2 of the Tags extension.

### Workarounds
Version v0.1.0-beta.13.2 of the Tags extension allows existing Flarum beta 13 forums to fix the issue without the need to update to beta 14.

Forums that have not yet updated to Flarum beta 13 are encouraged to update as soon as possible.

### References

- [Release announcement](https://discuss.flarum.org/d/25059-security-update-to-flarum-tags-010-beta132)
- [GitHub issue](https://github.com/flarum/core/issues/2355)

### For more information
If you have any questions or comments about this advisory, please start a new discussion on our [support forum](https://discuss.flarum.org/t/support).

If you discover a security vulnerability within Flarum, please send an e-mail to [security@flarum.org](mailto:security@flarum.org). All security vulnerabilities will be promptly addressed. More details can be found in our [security policy](https://github.com/flarum/core/security/policy).
Vulnerability: GHSA-4vr3-9v7h-5f8v
Summary: Low severity vulnerability that affects Gw2Sharp
Severity: LOW
CVSS score: 0
Published: 2019-06-18T15:38:41Z

## Leaking cached authenticated requests

### Impact
If you've been using one `MemoryCacheMethod` object in multiple instances of `Gw2WebApiClient` and are requesting authenticated endpoints with different access tokens, then you are likely to run into this bug.

When using an instance of `MemoryCacheMethod` and using it with multiple instances of `Gw2WebApiClient`, there's a possibility that cached authenticated responses are leaking to another request to the same endpoint, but with a different Guild Wars 2 access token. The latter request wouldn't start however, and would return the first cached response immediately. This means that the second response (or later responses) may contain the same data as the first response, therefore leaking data from another authenticated endpoint.

The occurence of this is limited however. The Guild Wars 2 API doesn't use the `Expires` header on most (if not all) authenticated endpoints. This header is checked when caching responses. If this header isn't available, the response isn't cached at all. You should still update to at least version 0.3.1 in order to be certain that it won't happen.

### Patches
This bug has been fixed in version 0.3.1. When using an authenticated endpoint, it will prepend the SHA-1 hash of the access token to the cache id.

### Workarounds
For version 0.3.0 and lower, you can use one separate instance of `MemoryCacheMethod` per `Gw2WebApiClient` if you need to use it.

### For more information
If you have any questions or comments about this advisory, you can open an issue in [the Gw2Sharp repository](https://github.com/Archomeda/Gw2Sharp) or contact me on [Discord](https://discord.gg/hNcpDT3).
Vulnerability: GHSA-f545-vpwp-r9j7
Summary: showdoc is vulnerable to URL Redirection to Untrusted Site
Aliases: CVE-2021-3989
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-12-03T20:41:35Z

showdoc is vulnerable to URL Redirection to Untrusted Site.
Vulnerability: GHSA-gcj7-j438-hjj2
Summary: Smokescreen SSRF via deny list bypass
Aliases: CVE-2022-24825
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-918
Published: 2022-04-07T22:10:22Z

The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure.

Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by appending a dot to the end of user-supplied URLs, or by providing input in a different letter case.

### Recommendation
Upgrade Smokescreen to version 0.0.3 or later.

### Acknowledgements
Thanks to [Grzegorz Niedziela](https://twitter.com/gregxsunday) for reporting the issue.

### For more information
Email us at security@stripe.com
Vulnerability: GHSA-8c89-2vwr-chcq
Summary: Heap buffer overflow in `QuantizedResizeBilinear`
Aliases: CVE-2021-29537
Severity: LOW
CVSS score: 2.5
CWE: CWE-131, CWE-787
Published: 2021-05-21T14:22:35Z

### Impact
An attacker can cause a heap buffer overflow in `QuantizedResizeBilinear` by passing in invalid thresholds for the quantization:

```python
import tensorflow as tf

images = tf.constant([], shape=[0], dtype=tf.qint32)
size = tf.constant([], shape=[0], dtype=tf.int32) 
min = tf.constant([], dtype=tf.float32)
max = tf.constant([], dtype=tf.float32)

tf.raw_ops.QuantizedResizeBilinear(images=images, size=size, min=min, max=max, align_corners=False, half_pixel_centers=False)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/50711818d2e61ccce012591eeb4fdf93a8496726/tensorflow/core/kernels/quantized_resize_bilinear_op.cc#L705-L706) assumes that the 2 arguments are always valid scalars and tries to access the numeric value directly:

```cc
const float in_min = context->input(2).flat<float>()(0);
const float in_max = context->input(3).flat<float>()(0);
```

However, if any of these tensors is empty, then `.flat<T>()` is an empty buffer and accessing the element at position 0 results in overflow.

### Patches 
We have patched the issue in GitHub commit [f6c40f0c6cbf00d46c7717a26419f2062f2f8694](https://github.com/tensorflow/tensorflow/commit/f6c40f0c6cbf00d46c7717a26419f2062f2f8694).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-7638-r9r3-rmjj
Summary: chroot isolation: environment value leakage to intermediate processes
Aliases: CVE-2021-3602
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-200
Published: 2021-07-19T15:19:09Z

### Impact
When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602).  This isolation type is often used when running `buildah` in unprivileged containers, and it is often used to do so in CI/CD environments.  If sensitive information is exposed to the original `buildah` process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during `buildah run`.  The commands that `buildah` is instructed to run can read that information if they choose to.

### Patches
Users should upgrade packages, or images which contain packages, to include version 1.21.3 or later.

### Workarounds
As a workaround, invoking `buildah` in a container under `env -i` to have it started with a reinitialized environment should prevent the leakage.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [buildah](https://github.com/containers/buildah/issues)
* Email us at [the buildah general mailing list](mailto:buildah@lists.buildah.io), or [the podman security mailing list](mailto:security@lists.podman.io) if it's sensitive.
Vulnerability: GHSA-4pwq-fj89-6rjc
Summary: Cross-site Scripting in Apache Airflow
Aliases: CVE-2020-13944
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-18T18:29:54Z

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.
Vulnerability: GHSA-jjjr-3jcw-f8v6
Summary: Potential Observable Timing Discrepancy in Wagtail
Aliases: CVE-2020-11037
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-208
Published: 2020-05-07T18:04:53Z

### Impact
A potential timing attack exists on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. (This is [understood to be feasible on a local network, but not on the public internet](https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ).)

Privacy settings that restrict access to pages / documents on a per-user or per-group basis (as opposed to a shared password) are unaffected by this vulnerability.

### Patches
Patched versions have been released as Wagtail 2.7.3 (for the LTS 2.7 branch), Wagtail 2.8.2 and Wagtail 2.9.

### Workarounds
Site owners who are unable to upgrade to the new versions can use [user- or group-based privacy restrictions](https://docs.wagtail.io/en/stable/advanced_topics/privacy.html) to restrict access to sensitive information; these are unaffected by this vulnerability.
Vulnerability: GHSA-f8h4-7rgh-q2gm
Summary: Segfault and heap buffer overflow in `{Experimental,}DatasetToTFRecord`
Aliases: CVE-2021-37650
Severity: HIGH
CVSS score: 7.8
CWE: CWE-787, CWE-120
Published: 2021-08-25T14:43:24Z

### Impact
The implementation for `tf.raw_ops.ExperimentalDatasetToTFRecord` and `tf.raw_ops.DatasetToTFRecord` can trigger heap buffer overflow and segmentation fault:

```python
import tensorflow as tf

dataset = tf.data.Dataset.range(3)
dataset = tf.data.experimental.to_variant(dataset)
tf.raw_ops.ExperimentalDatasetToTFRecord(
  input_dataset=dataset,
  filename='/tmp/output',
  compression_type='')
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/data/experimental/to_tf_record_op.cc#L93-L102) assumes that all records in the dataset are of string type. However, there is no check for that, and the example given above uses numeric types.

### Patches
We have patched the issue in GitHub commit [e0b6e58c328059829c3eb968136f17aa72b6c876](https://github.com/tensorflow/tensorflow/commit/e0b6e58c328059829c3eb968136f17aa72b6c876).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-gf8q-jrpm-jvxq
Summary: URL parsing in node-forge could lead to undesired behavior.
Severity: LOW
CVSS score: 0
Published: 2022-01-08T00:22:02Z

### Impact
The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.

### Patches
`forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.

### Workarounds
Ensure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input.

### References
- https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at support@digitalbazaar.com
Vulnerability: GHSA-j89m-gcjf-6ghp
Summary:  Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0825
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:57:02Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-49h4-g8p5-jgq6
Summary: Moderate severity vulnerability that affects org.apache.juddi:juddi-client
Aliases: CVE-2015-5241
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2018-10-16T19:49:32Z

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or 'uddi-console'. User session data, credentials, and auth tokens are cleared before the redirect.
Vulnerability: GHSA-vxf5-wxwp-m7g9
Summary: Open Redirect in Next.js
Aliases: CVE-2021-37699
Severity: MODERATE
CVSS score: 6.9
CWE: CWE-601
Published: 2021-08-12T14:51:14Z

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when `pages/_error.js` was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

### Impact

- **Affected:** Users of Next.js between `10.0.5` and `10.2.0`
- **Affected:** Users of Next.js between `11.0.0` and `11.0.1` using `pages/_error.js` without `getInitialProps`
- **Affected:** Users of Next.js between `11.0.0` and `11.0.1` using `pages/_error.js` and `next export`
- **Not affected**: Deployments on Vercel ([vercel.com](https://vercel.com)) are not affected
- **Not affected:** Deployments **with** `pages/404.js`
- Note that versions prior to 0.9.9 package `next` npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

### Patches

https://github.com/vercel/next.js/releases/tag/v11.1.0
Vulnerability: GHSA-pmcr-2rhp-36hr
Summary: SQL injection in github.com/navidrome/navidrome
Aliases: CVE-2022-23857
Severity: MODERATE
CVSS score: 0
CWE: CWE-89
Published: 2022-01-27T16:23:02Z

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
Vulnerability: GHSA-gfv4-2vhm-486m
Summary: Hijacked Environment Variables in node-fabric
Aliases: CVE-2017-16052
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T20:50:10Z

The `node-fabric` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-8fvr-5rqf-3wwh
Summary: Information Exposure in Docker Engine
Aliases: CVE-2015-3630
Severity: HIGH
CVSS score: 8.4
CWE: CWE-285
Published: 2022-02-15T01:57:18Z

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Vulnerability: GHSA-vj88-5667-w56p
Summary: Singleton lacks bounds on Send and Sync.
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:11Z

`Singleton<T>` is meant to be a static object that can be initialized lazily. In
order to satisfy the requirement that `static` items must implement `Sync`,
`Singleton` implemented both `Sync` and `Send` unconditionally.

This allows for a bug where non-`Sync` types such as `Cell` can be used in
singletons and cause data races in concurrent programs.

The flaw was corrected in commit `b0d2bd20e` by adding trait bounds, requiring
the contaiend type to implement `Sync`.
Vulnerability: GHSA-jqfh-8hw5-fqjr
Summary: Improper Handling of Exceptional Conditions in detect-character-encoding
Aliases: CVE-2021-39157
Severity: HIGH
CVSS score: 7.5
CWE: CWE-755
Published: 2021-08-25T14:44:48Z

### Impact

In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash.

### Patches

The problem has been patched in [detect-character-encoding v0.7.0](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0).

### CVSS score

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)

Base Score: 7.5 (High)
Temporal Score: 7.2 (High)

Since detect-character-encoding is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, accepting data from untrusted sources over a network and passing it directly to detect-character-encoding. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

### Proof of concept

```js
const express = require("express");
const bodyParser = require("body-parser");
const detectCharacterEncoding = require("detect-character-encoding");

const app = express();

app.use(bodyParser.raw());

app.post("/", (req, res) => {
  const charsetMatch = detectCharacterEncoding(req.body);

  res.end(charsetMatch.encoding);
});

app.listen(3000);
```

`printf "\xAA" | curl --request POST --header "Content-Type: application/octet-stream" --data-binary @- http://localhost:3000` crashes the server.
Vulnerability: GHSA-p979-4mfw-53vg
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2019-16869
Severity: HIGH
CVSS score: 7.5
CWE: CWE-444
Published: 2019-10-11T18:41:23Z

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Vulnerability: GHSA-7c6q-jqwc-4423
Summary: Path Traversal in Crafter CMS Crafter Studio
Aliases: CVE-2017-15681
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2022-02-09T23:07:59Z

In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.
Vulnerability: GHSA-5j5w-g665-5m35
Summary: Ambiguous OCI manifest parsing
Severity: LOW
CVSS score: 3
CWE: CWE-843
Published: 2021-11-18T16:08:58Z

### Impact

In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header.  Versions of containerd prior to 1.4.12 and 1.5.8 treat the Content-Type header as trusted and deserialize the document according to that header.  If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image.

### Patches

This issue has been fixed in containerd 1.4.12 and 1.5.8.  Image pulls for manifests that contain a “manifests” field or indices which contain a “layers” field are rejected.

### Workarounds

Ensure you only pull images from trusted sources.

### References

https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Vulnerability: GHSA-28xx-8j99-m32j
Summary: Malicious Package in nginxbeautifier
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T20:37:25Z

Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.14 of this module is found installed you will want to replace it with a version before or after 1.0.14. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-gc67-crq6-hgh5
Summary: Improper Input Validation in Parquet-MR
Aliases: CVE-2021-41561
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2022-01-06T23:59:25Z

Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.
Vulnerability: GHSA-h72c-w3q3-55qq
Summary: OS Command Injection in jw.util
Aliases: CVE-2020-13388
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-06-02T21:45:12Z

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used.
Vulnerability: GHSA-29f8-q7mf-7cqj
Summary: Logic error in Apache Pinot
Aliases: CVE-2022-23974
Severity: HIGH
CVSS score: 7.5
CWE: CWE-674
Published: 2022-04-06T00:01:28Z

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Vulnerability: GHSA-56hp-xqp3-w2jf
Summary: Repository credentials passed to alternate domain
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2021-06-23T18:14:15Z

While working on the Helm source, a Helm core maintainer discovered a situation where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository.

### Impact

The `index.yaml` within a Helm chart repository contains a reference where to get the chart archive for each version of a chart. The reference can be relative to the `index.yaml` file or a URL to location. The URL can point to any domain and this is a feature leveraged by Helm users. For example, an `index.yaml` file can be hosted on GitHub pages while the chart archives are hosted as GitHub releases. These are on different domain names and the `index.yaml` file points to the other domain.

When a username and password were associated with a Helm repository the username and password were also passed on to other domains referenced in the `index.yaml` file. This occurred when Helm went to retrieve a specific chart archive on the other domain.

### Patches

This issue has been resolved in 3.6.1.

There is a slight behavior change to credential handling with regard to repositories. Usernames and passwords are only passed to the URL location of the Helm repository by default. The username and password are scoped to the scheme, host, and port of the Helm repository. To pass the username and password to other domains Helm may encounter when it goes to retrieve a chart, the new `--pass-credentials` flag can be used. This flag restores the old behavior for a single repository as an opt-in behavior.

### Workarounds

If you use a username and password for a Helm repository you can audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed the credentials would have been passed on.

### For more information

Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.
Vulnerability: GHSA-j34v-3552-5r7j
Summary: Multiple security issues in Pomerium's embedded envoy
Severity: MODERATE
CVSS score: 0
Published: 2022-03-01T22:04:17Z

Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.

Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.

### Impact

- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted

### Patches
Patched in v0.16.4

### Workarounds
No

### References

[Envoy Security Announcement](https://groups.google.com/g/envoy-security-announce/c/QBGxoqZdTR4)

* [CVE-2021-43824](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p) (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer dereference when using JWT filter safe_regex match
* [CVE-2021-43825](https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh) (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when response filters increase response data, and increased data exceeds downstream buffer limits.
* [CVE-2021-43826](https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf) (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when tunneling TCP over HTTP, if downstream disconnects during upstream connection establishment
* [CVE-2022-21654](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283) (CVSS Score 7.3, High): Envoy 1.7.0 and later - Incorrect configuration handling allows mTLS session re-use without re-validation after validation settings have changed.
* [CVE-2022-21655](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg) (CVSS Score 7.5, High): Envoy 1.21 and earlier - Incorrect handling of internal redirects to routes with a direct response entry
* [CVE-2022-21657](https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g) (CVSS Score 3.1, Low): Envoy 1.20.1 and earlier - X.509 Extended Key Usage and Trust Purposes bypass

### For more information
If you have any questions or comments about this advisory:

Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-5fvx-5p2r-4mvp
Summary: Open Redirect in firefly-iii
Aliases: CVE-2021-3851
Severity: MODERATE
CVSS score: 5
CWE: CWE-601
Published: 2021-10-21T17:48:41Z

firefly-iii is vulnerable to URL Redirection to Untrusted Site
Vulnerability: GHSA-5pq8-2q24-mj3p
Summary: Downloads Resources over HTTP in fis-parser-sass-bin
Aliases: CVE-2016-10660
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:45:03Z

Affected versions of `fis-parser-sass-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fis-parser-sass-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-qgmg-gppg-76g5
Summary: Inefficient Regular Expression Complexity in validator.js
Aliases: CVE-2021-3765
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-1333
Published: 2021-11-03T17:34:45Z

validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-4pv3-63jw-4jw2
Summary: Missing Release of Memory after Effective Lifetime in Apache Tika
Aliases: CVE-2020-9489
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-401
Published: 2021-05-07T15:53:40Z

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Vulnerability: GHSA-446m-mv8f-q348
Summary: Regular Expression Denial of Service in moment
Aliases: CVE-2017-18214
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-03-05T18:35:09Z

Affected versions of `moment` are vulnerable to a low severity regular expression denial of service when parsing dates as strings.


## Recommendation

Update to version 2.19.3 or later.
Vulnerability: GHSA-qgcg-p3v2-9h4p
Summary: Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix
Aliases: CVE-2020-5412
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-610, CWE-441
Published: 2021-04-30T17:29:42Z

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Vulnerability: GHSA-c4fm-46gm-4469
Summary: Malicious Package in sparkies
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T20:00:05Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-hgwm-pv9h-q5m7
Summary: Potential XSS in jQuery dependency in Mirador
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-18T18:03:29Z

### Impact
Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken.

### Patches
Mirador adopters should update to v3.0.0, no updates exist for v2.x releases.

### Workarounds
Yes, Mirador users could fork and create their own custom build of Mirador and make the bug fixes themselves.

### References
https://github.com/advisories/GHSA-gxr4-xjj5-5px2
https://github.com/advisories/GHSA-jpcq-cgw6-v4j6


https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/
Vulnerability: GHSA-5f2r-qp73-37mr
Summary: `CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow
Aliases: CVE-2022-23579
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-10T00:33:29Z

### Impact
The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that [`SafeToRemoveIdentity`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/dependency_optimizer.cc#L59-L98) would trigger `CHECK` failures.

### Patches
We have patched the issue in GitHub commit [92dba16749fae36c246bec3f9ba474d9ddeb7662](https://github.com/tensorflow/tensorflow/commit/92dba16749fae36c246bec3f9ba474d9ddeb7662).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-fgmr-vx7c-5wj6
Summary: Timing attack on HMAC signature comparison in Apache Tapestry
Aliases: CVE-2019-10071
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-697, CWE-203
Published: 2019-09-26T21:30:34Z

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
Vulnerability: GHSA-j586-cj67-vg4p
Summary: Cross-Site Request Forgery in Drupal core
Aliases: CVE-2020-13674
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2022-02-12T00:00:47Z

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.
Vulnerability: GHSA-wr2c-ppj9-f2fv
Summary: Downloads Resources over HTTP in webdrvr
Aliases: CVE-2016-10601
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:33:54Z

Affected versions of `webdrvr` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webdrvr`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-h372-w3xp-2jg3
Summary: Directory Traversal in section2.madisonjbrooks12
Aliases: CVE-2017-16172
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:54:34Z

Affected versions of `section2.madisonjbrooks12` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hv9c-qwqg-qj3v
Summary: Remote Code Execution in electron
Aliases: CVE-2018-15685
Severity: HIGH
CVSS score: 8.1
CWE: CWE-1188
Published: 2018-08-23T19:12:08Z

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

More information to determine if you are impacted can be found on the [electron blog](https://electronjs.org/blog/web-preferences-fix).


## Recommendation

Upgrade Electron to >=3.0.0-beta.7, >=2.0.8, >=1.8.8, or >=1.7.16."
Vulnerability: GHSA-mvg9-xffr-p774
Summary: Out of bounds read in Pillow
Aliases: CVE-2021-25291
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2021-03-29T16:35:57Z

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
Vulnerability: GHSA-5v7r-jg9r-vq44
Summary: Insecure Cryptography Algorithm in simple-crypto-js
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-327
Published: 2020-09-03T21:19:46Z

Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.


## Recommendation

Upgrade to version 2.3.0 or later.
Vulnerability: GHSA-2wrq-wmqf-8vcc
Summary: Downloads Resources over HTTP in operadriver
Aliases: CVE-2016-10565
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:35:48Z

operadriver is a Opera Driver for Selenium.

operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

Update to version 0.2.3 or later.
Vulnerability: GHSA-7ph8-f946-q5r7
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0611
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2019-04-09T19:43:54Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0592.
Vulnerability: GHSA-qpp2-2mcp-2wm5
Summary: Unauthenticated user can list hidden document from multiple velocity templates in XWiki
Aliases: CVE-2022-24820
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-359
Published: 2022-04-08T22:00:54Z

### Impact
A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents.

### Patches
The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1.

### Workarounds
There is no known workaround for this problem.

### References
https://jira.xwiki.org/browse/XWIKI-16544

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-hh3j-x4mc-g48r
Summary: Insufficiently Protected Credentials in Apache Tomcat
Aliases: CVE-2019-12418
Severity: HIGH
CVSS score: 7
CWE: CWE-522
Published: 2019-12-26T18:22:36Z

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Vulnerability: GHSA-xj6f-x7jm-85ff
Summary: Downloads Resources over HTTP in openframe-ascii-image
Aliases: CVE-2016-10690
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:41:54Z

Affected versions of `openframe-ascii-image` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `openframe-ascii-image`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5gqf-456p-4836
Summary: Reference binding to nullptr in `SdcaOptimizer`
Aliases: CVE-2021-29572
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:25:31Z

### Impact
The implementation of `tf.raw_ops.SdcaOptimizer` triggers undefined behavior due to dereferencing a null pointer:

```python
import tensorflow as tf

sparse_example_indices = [tf.constant((0), dtype=tf.int64), tf.constant((0), dtype=tf.int64)]
sparse_feature_indices = [tf.constant([], shape=[0, 0, 0, 0], dtype=tf.int64), tf.constant((0), dtype=tf.int64)]
sparse_feature_values = []

dense_features = []
dense_weights = []

example_weights = tf.constant((0.0), dtype=tf.float32)
example_labels = tf.constant((0.0), dtype=tf.float32)

sparse_indices = [tf.constant((0), dtype=tf.int64), tf.constant((0), dtype=tf.int64)]
sparse_weights = [tf.constant((0.0), dtype=tf.float32), tf.constant((0.0), dtype=tf.float32)]
  
example_state_data = tf.constant([0.0, 0.0, 0.0, 0.0], shape=[1, 4], dtype=tf.float32)
  
tf.raw_ops.SdcaOptimizer(
  sparse_example_indices=sparse_example_indices,
  sparse_feature_indices=sparse_feature_indices,
  sparse_feature_values=sparse_feature_values, dense_features=dense_features,
  example_weights=example_weights, example_labels=example_labels, 
  sparse_indices=sparse_indices, sparse_weights=sparse_weights, 
  dense_weights=dense_weights, example_state_data=example_state_data,
  loss_type="logistic_loss", l1=0.0, l2=0.0, num_loss_partitions=1,
  num_inner_iterations=1, adaptative=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/60a45c8b6192a4699f2e2709a2645a751d435cc3/tensorflow/core/kernels/sdca_internal.cc) does not validate that the user supplied arguments satisfy all [constraints expected by the op](https://www.tensorflow.org/api_docs/python/tf/raw_ops/SdcaOptimizer).

### Patches
We have patched the issue in GitHub commit [f7cc8755ac6683131fdfa7a8a121f9d7a9dec6fb](https://github.com/tensorflow/tensorflow/commit/f7cc8755ac6683131fdfa7a8a121f9d7a9dec6fb).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-34hv-f45p-4qfq
Summary: Open redirect in wwbn/avideo
Aliases: CVE-2022-27463
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-04-06T00:01:29Z

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. A patch is available on the `master` branch of the repository.
Vulnerability: GHSA-7p8f-8hjm-wm92
Summary: Lookup operations do not take into account wildcards in SpiceDB
Aliases: CVE-2022-21646
Severity: HIGH
CVSS score: 8.1
CWE: CWE-155, CWE-20
Published: 2022-01-13T15:05:41Z

### Impact
Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.

For example, given schema:

```zed
definition user {}

definition resource {
   relation viewer: user
   relation banned: user | user:*
   permission view = viewer - banned
}
```

If `user:*` is placed into the `banned` relation for a particular resource, `view` should return false for *all* resources. in `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion.

### Workarounds
Don't make use of wildcards on the right side of intersections or within exclusions. 

### References
https://github.com/authzed/spicedb/issues/358

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [SpiceDB](https://github.com/authzed/spicedb)
* Ask a question in the [SpiceDB Discord](https://authzed.com/discord)