TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-f8q4-jwww-x3wv
Summary: Race Condition in Paramiko
Aliases: CVE-2022-24302
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2022-03-19T00:01:03Z

In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Vulnerability: GHSA-2p6g-gjp8-ggg9
Summary: Validation bypass in personnummer
Severity: LOW
CVSS score: 0
Published: 2020-09-09T17:29:34Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-4r97-78gf-q24v
Summary: Prototype Pollution in klona
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T17:53:27Z

Versions of `klona` prior to 1.1.1 are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype when cloning objects, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

Upgrade to version 1.1.1 or later.
Vulnerability: GHSA-cgjx-mwpx-47jv
Summary: Private Data Disclosure in express-restify-mongoose
Aliases: CVE-2016-10533
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2018-10-23T17:14:57Z

Affected versions of `express-restify-mongoose` are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private.


## Proof of Concept

If you have a user model that you want to protect, such as the following User model:
```
const User = mongoose.model('User', new mongoose.Schema({
    name: String,
    password: String,
}));
```

You would normally do something such as:
```
restify.serve(router, User, {
    private: ['password'], // Set the password part of User as private, so outside people can't read it
})
```

This would hide the password field from people that send your application a `GET /User` and `GET /User/some-user-id` request. 

A malicious user can go to your application and send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This could be used for other private data, if the malicious user knew what was set as private for specific routes.


## Recommendation

Version 2.x: Update to version 2.5.0 or later.
Version 3.x: Update to version 3.1.0 or later.
Vulnerability: GHSA-m6wh-m8m8-6xx5
Summary: Exfiltrates data on installation in cofeescript
Aliases: CVE-2017-16202
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-06T20:05:28Z

The `cofeescript` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

If you have found `cofeescript` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-4g54-95xv-f353
Summary: Hijacked Environment Variables in http-proxy.js
Aliases: CVE-2017-16075
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:16:56Z

The `http-proxy.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-pw2r-vq6v-hr8c
Summary: Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Aliases: CVE-2022-0536
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2022-02-10T00:00:31Z

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
Vulnerability: GHSA-388g-jwpg-x6j4
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2020-09-11T21:20:14Z

Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 3.0.13 or later.
Vulnerability: GHSA-8qm2-24qc-c4qg
Summary: Malicious Package in freshdom
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:57:56Z

Version 0.0.6 of `freshdom` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.6 of this module is found installed you will want to replace it with a version before or after 0.0.6. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-m36x-mgfh-8g78
Summary: Subdomain Takeover in Interactsh server
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2022-01-27T15:15:25Z

A domain configured with interactsh server was vulnerable to subdomain takeover for specfic subdomain, i.e `app`, Interactsh server before `< 1.0.0` used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default which intended to used for hosting interactsh [web client](https://github.com/projectdiscovery/interactsh-web) using GitHub pages. It turns out to be a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a cname entry pointing to GitHub pages, making them vulnerable to subdomain takeover.

This issue was initially reported to us as a subdomain takeover for one of our domains that runs interactsh server by **Melih** at `security@projectdiscovery.io`, and after conducting an internal investigation, we determined that it was an issue with the default config of interactsh server affecting all the server running self-hosted instance of interactsh, as a result - cname entry has been removed in the latest release.

#### Impact
This allows one to host / run arbitrary client side code (XSS) in a user's browser when browsing the vulnerable subdomain, for more details on the impact, please read this [detailed blogpost](https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/) from Detectify.
#### Patches
Update to [Interactsh server v1.0.0 ](https://github.com/projectdiscovery/interactsh/releases/tag/v1.0.0)with `go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest`

#### References
https://github.com/projectdiscovery/interactsh/issues/136

#### For more information
If you have any questions or comments about this advisory:
* Email us at [security@projectdiscovery.io](mailto:security@projectdiscovery.io)
Vulnerability: GHSA-9g9w-hmvj-5h57
Summary: Prototype Pollution in merge-deep
Aliases: CVE-2018-3722
Severity: LOW
CVSS score: 0
CWE: CWE-471
Published: 2018-07-26T15:17:15Z

Versions of `merge-deep` before 3.0.1 are vulnerable to prototype pollution via merging functions.


## Recommendation

Update to version 3.0.1 or later.
Vulnerability: GHSA-mqf3-28j7-3mj6
Summary: Information Exposure in Kubernetes
Aliases: CVE-2015-7528
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2022-02-15T01:57:18Z

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
Vulnerability: GHSA-9j5m-873f-xh76
Summary: Directory Traversal in static-html-server
Aliases: CVE-2017-16152
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:46:32Z

Affected versions of `static-html-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-88cc-g835-76rp
Summary: Improper Restriction of XML External Entity Reference
Aliases: CVE-2020-13692
Severity: HIGH
CVSS score: 7.7
CWE: CWE-611
Published: 2022-02-10T00:30:07Z

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Vulnerability: GHSA-j6qj-j888-vvgq
Summary: Directory exposure in jetty
Aliases: CVE-2021-28163
Severity: LOW
CVSS score: 2.7
CWE: CWE-200, CWE-59
Published: 2021-04-06T17:32:00Z

### Impact
If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. 

For example, the problem manifests in the following `${jetty.base}`:
```$ tree demo-base/
demo-base/
├── etc
├── lib
├── resources
├── start.d
├── deploy
│   └── async-rest.war
└── webapps -> deploy

``` 

### Workarounds
Do not use a symlink
Vulnerability: GHSA-xqh8-5j36-4556
Summary: SQL Injection in connect-pg-simple
Aliases: CVE-2019-15658
Severity: HIGH
CVSS score: 7.3
CWE: CWE-89
Published: 2019-08-26T16:59:45Z

Versions of `connect-pg-simple` are vulnerable to SQL Injection. The `PGStore.prototype.quotedTable` function allows for the query to be manipulated if the input has double quotes through the `schemaName` or `tableName` variables. These variables are passed to the constructor and are unlikely to be controlled by user-input. If they are controlled by user-input it could allow attackers to execute arbitrary SQL queries.


## Recommendation

Upgrade to version 6.0.1 or later.
Vulnerability: GHSA-f5cv-xrv9-r8w7
Summary: NoSQL injection in express-cart
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2020-09-01T21:17:16Z

Versions of `express-cart` before 1.1.8 are vulnerable to NoSQL injection. 

The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which allows to insert operators. 

These operators can be used to extract the value of the field blindly in the same manner of a blind SQL injection. In this case, the `$regex` operator is used to guess each character of the token from the start.


## Recommendation

Update to version 1.1.8 or later.
Vulnerability: GHSA-9fhw-r42p-5c7r
Summary: Regular expression Denial of Service in @progfay/scrapbox-parser
Aliases: CVE-2021-27405
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-400
Published: 2021-03-01T20:44:44Z

### Impact

A [Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) flaw was found in the @progfay/scrapbox-parser package before 6.0.3, 7.0.2 for Node.js.
The attacker that is able to be parsed a specially crafted text may cause the application to consume an excessive amount of CPU.

### Patches

Upgrade to version 6.0.3, 7.0.2 or later.

### Workarounds

Avoid to parse text with a lot of `[` chars.

### References

* https://github.com/progfay/scrapbox-parser/pull/519
* https://github.com/progfay/scrapbox-parser/pull/539
* https://github.com/progfay/scrapbox-parser/pull/540
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27405
* https://snyk.io/vuln/SNYK-JS-PROGFAYSCRAPBOXPARSER-1076803

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/progfay/scrapbox-parser](https://github.com/progfay/scrapbox-parser/issues)
Vulnerability: GHSA-cqxx-66wh-8pjw
Summary: Improper Removal of Sensitive Information Before Storage or Transfer in irrd
Aliases: CVE-2022-24798
Severity: HIGH
CVSS score: 7.5
CWE: CWE-212
Published: 2022-04-01T13:59:17Z

IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected.

The issue occurred:
* For `mntner` objects where all password hash names (`MD5-PW` and `CRYPT-PW`) were in lower or mixed case in the `auth` attribute. For these objects, hashes remained in the output of all queries of any method and all database exports made with the `export_destination` setting. Fortunately, objects in the common public IRR database virtually all use uppercase hash names which means very few of those objects were affected.
* For any GraphQL queries that queried the `auth` field on `mntner` objects.
* For any GraphQL queries that queried the `objectText` field on the `journal` field on `mntner` objects, if the `nrtm_access_list` setting permitted journal access.

The two GraphQL cases are visible in logs, allowing users to determine whether any existing objects had their hashes exposed.
This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. All users running a more recent version from the main branch should update to the latest version. Alternatively, but not recommended, apply the patch manually [for 4.2.x]
Vulnerability: GHSA-9qj7-jvg4-qr2x
Summary: Moderate severity vulnerability that affects passenger
Aliases: CVE-2013-2119
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:37Z

Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary "config" file in a directory with a predictable name in /tmp/ before it is used by the gem.
Vulnerability: GHSA-mmph-wp49-r48h
Summary: Malicious Package in experss
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:20:26Z

All versions of `experss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-fr32-gr5c-xq5c
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8321
Severity: HIGH
CVSS score: 7.5
CWE: CWE-88
Published: 2019-06-20T16:06:04Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Vulnerability: GHSA-45h5-r968-5xr7
Summary: Exposure of sensitive information in Elasticsearch
Aliases: CVE-2021-22147
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-732
Published: 2021-09-20T20:29:40Z

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
Vulnerability: GHSA-fw76-p9p2-6pvf
Summary: Malicious Package in serilize
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:58:58Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-5mjw-6jrh-hvfq
Summary: Sandbox Breakout / Arbitrary Code Execution in static-eval
Aliases: CVE-2017-16226
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2018-08-06T21:37:06Z

Affected versions of `static-eval` pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.

## Proof of concept
```
var evaluate = require('static-eval');
var parse = require('esprima').parse;
var src = '(function(){console.log(process.pid)})()';
var ast = parse(src).body[0].expression;
var res = evaluate(ast, {});
// Will print the process id
```


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-qrvj-274h-hfcg
Summary: Deserialization of Untrusted Data in topthink/framework
Aliases: CVE-2021-36567
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-12-07T00:00:28Z

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
Vulnerability: GHSA-vwx4-frpr-w27j
Summary: Improper Synchronization in Jenkins Convertigo Mobile Platform Plugin
Aliases: CVE-2022-25210
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-662, CWE-820
Published: 2022-02-16T00:01:14Z

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
Vulnerability: GHSA-rmw5-xpg9-jr29
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone
Aliases: CVE-2020-28924
Severity: HIGH
CVSS score: 7.5
CWE: CWE-338, CWE-331
Published: 2021-06-10T17:23:21Z

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.
Vulnerability: GHSA-4gf2-xv97-63m2
Summary: Exposure of Sensitive Information in keycloak
Aliases: CVE-2020-1744
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-200, CWE-755
Published: 2021-09-20T20:43:24Z

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Vulnerability: GHSA-3j95-fjv2-3m4p
Summary: CSS Injection in Chartkick gem
Aliases: CVE-2020-16254
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-74
Published: 2020-08-12T14:29:15Z

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).
Vulnerability: GHSA-6w7g-p4jh-rf92
Summary: "Verify All" Returns Success Despite Validation Failures in Singularity
Aliases: CVE-2020-13846
Severity: HIGH
CVSS score: 7.5
Published: 2021-12-20T18:24:43Z

### Impact

The `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.

The SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0`  are returned.

Workflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.

```
$ singularity verify -a image.sif 
WARNING: Missing signature for SIF descriptor 2 (JSON.Generic)
WARNING: Missing signature for SIF descriptor 3 (FS)
Container is signed by 1 key(s):

Verifying partition: Def.FILE:
12045C8C0B1004D058DE4BEDA20C27EE7FF7BA84
[LOCAL]   Unit Test <unit@test.com>
[OK]      Data integrity verified

INFO:    Container verified: image.sif

$ echo $?
0
```


### Patches

Singularity 3.6.0 has a new implementation of sign/verify that fixes this issue.

All users are advised to upgrade to 3.6.0. Note that Singularity 3.6.0 uses a new signature format that is necessarily incompatible with Singularity < 3.6.0 - e.g. Singularity 3.5.3 cannot verify containers signed by 3.6.0.

Version 3.6.0 includes a `--legacy-insecure` flag for the `singularity verify` command, that will perform verification of the older, and insecure, legacy signatures for compatibility with existing containers. This does not guarantee that containers have not been modified since signing, due to other issues in the legacy signature format.

### Workarounds

If you are unable to update to 3.6.0 ensure that you do not rely on the return code of `singularity verify --all / -a` as an indicator of trust in a container.

Note that other issues in the sign/verify implementation in Singularity < 3.6.0 allow additional means to introduce malicious behavior to a signed container.


### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-v935-pqmr-g8v9
Summary: Unexpected panics in num-bigint
Severity: MODERATE
CVSS score: 0
CWE: CWE-131, CWE-20
Published: 2021-11-03T17:36:04Z

### Impact

Two scenarios were reported where `BigInt` and `BigUint` multiplication may unexpectedly panic.

- The internal `mac3` function did not expect the possibility of non-empty all-zero inputs, leading to an `unwrap()` panic.
- A buffer was allocated with less capacity than needed for an intermediate result, leading to an assertion panic.

Rust panics can either cause stack unwinding or program abort, depending on the application configuration. In some settings, an unexpected panic may constitute a denial-of-service vulnerability.

### Patches
Both problems were introduced in version 0.4.1, and are fixed in version 0.4.3.

### For more information
If you have any questions or comments about this advisory, please open an issue in the [num-bigint](https://github.com/rust-num/num-bigint) repo.

### Acknowledgements
Thanks to Guido Vranken and Arvid Norberg for privately reporting these issues to the author.

### References
* [GHSA-v935-pqmr-g8v9](https://github.com/rust-num/num-bigint/security/advisories/GHSA-v935-pqmr-g8v9)
* [num-bigint#228](https://github.com/rust-num/num-bigint/pull/228)
Vulnerability: GHSA-vrgp-3ph6-2wwq
Summary: SQL Injection in Dolibarr
Aliases: CVE-2021-36625
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2022-04-01T00:00:41Z

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
Vulnerability: GHSA-7cg8-pq9v-x98q
Summary: Sandbox Breakout in realms-shim
Severity: CRITICAL
CVSS score: 9.8
Published: 2019-10-21T21:58:55Z

Versions of `realms-shim` prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting function. Confined code which used the evaluator itself could provide a malicious rewriter function that captured this object, and use it to breach the sandbox.


## Recommendation

Upgrade to version 1.2.1 or later.
Vulnerability: GHSA-3q32-j57w-q4w7
Summary: Path Traversal in total.js
Aliases: CVE-2019-8903
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-02-20T15:40:13Z

Affected versions of `total.js` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files outside the `/public` folder by using relative paths.  
The files served are limited to these file types: `flac`, `jpg`, `jpeg`, `png`, `gif`, `ico`, `js`, `css`, `txt`, `xml`, `woff`, `woff2`, `otf`, `ttf`, `eot`, `svg`, `zip`, `rar`, `pdf`, `docx`, `xlsx`, `doc`, `xls`, `html`, `htm`, `appcache`, `manifest`, `map`, `ogv`, `ogg`, `mp4`, `mp3`, `webp`, `webm`, `swf`, `package`, `json`, `md`, `m4v`, `jsx`, `heif`, `heic`.


## Recommendation

- If you are using version 2.1.x, upgrade to 2.1.1 or later.
- If you are using version 2.2.x, upgrade to 2.2.1 or later.
- If you are using version 2.3.x, upgrade to 2.3.1 or later.
- If you are using version 2.4.x, upgrade to 2.4.1 or later.
- If you are using version 2.5.x, upgrade to 2.5.1 or later.
- If you are using version 2.6.x, upgrade to 2.6.3 or later.
- If you are using version 2.7.x, upgrade to 2.7.1 or later.
- If you are using version 2.8.x, upgrade to 2.8.1 or later.
- If you are using version 2.9.x, upgrade to 2.9.5 or later.
- If you are using version 3.0.x, upgrade to 3.0.1 or later.
- If you are using version 3.1.x, upgrade to 3.1.1 or later.
- If you are using version 3.2.x, upgrade to 3.2.4 or later.
Vulnerability: GHSA-6mww-xvh7-fq4f
Summary: Koji hub call does not perform correct access checks
Aliases: CVE-2018-1002150
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-732
Published: 2018-07-12T20:29:40Z

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1.
Vulnerability: GHSA-mq35-wqvf-r23c
Summary: Sinatra has XSS via 400 Bad Request page via params parser exception
Aliases: CVE-2018-11627
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-06-05T21:32:06Z

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Vulnerability: GHSA-45vg-2v73-vm62
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2015-0201
Severity: MODERATE
CVSS score: 0
Published: 2018-10-17T20:28:20Z

The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors.
Vulnerability: GHSA-q257-vv4p-fg92
Summary: Header Forgery in http-signature
Aliases: CVE-2017-16005
Severity: LOW
CVSS score: 0
CWE: CWE-20
Published: 2018-11-09T17:49:34Z

Affected versions of `http-signature` contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature. 

This problem occurs because vulnerable versions of `http-signature` sign the contents of headers, but not the header names.

## Proof of Concept

Consider this to be the initial, untampered request:
```
POST /pay HTTP/1.1
Host: example.com
Date: Thu, 05 Jan 2012 21:31:40 GMT
X-Payment-Source: src@money.com
X-Payment-Destination: dst@money.com
Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-source x-payment-destination" MDyO5tSvin5...
```

And the request is intercepted and tampered as follows:
```
X-Payment-Source: dst@money.com // Emails switched
X-Payment-Destination: src@money.com
Authorization: Signature keyId="Test",algorithm="rsa-sha256",headers="x-payment-destination x-payment-source" MDyO5tSvin5...
```

In the resulting responses, both requests would pass signature verification without issue.
```
src@money.com\n
dst@money.com\n
```



## Recommendation

Update to version 0.10.0 or higher.
Vulnerability: GHSA-v3wr-67px-44xg
Summary: Execution with Unnecessary Privileges in arc-electron
Severity: HIGH
CVSS score: 0
Published: 2022-03-03T19:11:14Z

### Impact

When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that ARC has access to from the renderer process, which includes file system access, data store access (which may contain sensitive information), and some additional processes that only ARC should have access to.

### Patches

This is patched in version 17.0.9.

### Workarounds

Do not click onto any link in the response headers view.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [advanced-rest-client/arc-electron](https://github.com/advanced-rest-client/arc-electron)
* Email us at [Salesforce Security](mailto:security@salesforce.com)
Vulnerability: GHSA-wqv3-8cm6-h6wg
Summary: Improper Authentication in Kubernetes
Aliases: CVE-2020-8558
Severity: HIGH
CVSS score: 8.8
CWE: CWE-287, CWE-420
Published: 2022-02-15T01:57:18Z

A security issue was discovered in kube-proxy which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8558
https://www.openwall.com/lists/oss-security/2020/07/08/1
Vulnerability: GHSA-8p83-68cw-943f
Summary: Apache Ignite communicates to an external PHP server where sensitive information is sent
Aliases: CVE-2017-7686
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2018-10-16T20:53:20Z

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
Vulnerability: GHSA-j9wf-vvm6-4r9w
Summary: Unverified Ownership in Kubernetes
Aliases: CVE-2020-8554
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-283, CWE-863
Published: 2022-02-08T21:50:34Z

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Vulnerability: GHSA-pv36-h7jh-qm62
Summary: Heap buffer overflow in CefSharp
Aliases: CVE-2020-15999
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-119, CWE-787
Published: 2020-10-27T19:47:38Z

### Impact
A memory corruption bug(Heap overflow) in the FreeType font rendering library.

> This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ 

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

### Patches
Upgrade to 85.3.130 or higher

### References
- https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/
- https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999
- https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942

To review the `CEF/Chromium` patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d
Vulnerability: GHSA-7322-9mx6-5j2m
Summary: High severity vulnerability that affects redcarpet
Aliases: CVE-2015-5147
Severity: HIGH
CVSS score: 0
CWE: CWE-119
Published: 2018-08-15T20:04:30Z

Stack-based buffer overflow in the header_anchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Vulnerability: GHSA-322v-p3jc-7hrg
Summary: Cross-Site Request Forgery in Anchor CMS
Aliases: CVE-2022-25576
Severity: MODERATE
CVSS score: 4.5
CWE: CWE-352
Published: 2022-03-26T00:00:34Z

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
Vulnerability: GHSA-pg2f-r7pc-6fxx
Summary: Cross-Site Request Forgery in MicroPyramid Django CRM
Aliases: CVE-2019-11457
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2019-09-11T22:57:57Z

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.
Vulnerability: GHSA-h726-x36v-rx45
Summary: Prototype Pollution in lodash.merge
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T18:04:54Z

Versions of `lodash.merge` before 4.6.2 are vulnerable to prototype pollution. The function `merge` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.2 or later.
Vulnerability: GHSA-m8gq-83gh-v42v
Summary: XML External Entities Vulnerability in CVRF-CSAF-Converter
Aliases: CVE-2022-27193
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-552, CWE-611
Published: 2022-03-16T00:00:49Z

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.
Vulnerability: GHSA-2vxm-vp4c-fjfw
Summary: Authentication Bypass in Apache Cassandra
Aliases: CVE-2020-17516
Severity: HIGH
CVSS score: 7.5
CWE: CWE-290
Published: 2022-02-09T01:01:22Z

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
Vulnerability: GHSA-rrqv-vjrw-hrcr
Summary: Arbitrary Code Execution in json-ptr
Severity: HIGH
CVSS score: 0
CWE: CWE-74
Published: 2021-05-26T19:59:19Z

There is a security vulnerability in `json-ptr` versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get() method, your project is vulnerable to this injection-style vulnerability.
Vulnerability: GHSA-m87f-9fvv-2mgg
Summary: Deserialization of Untrusted Data in parlai
Aliases: CVE-2021-39207
Severity: HIGH
CVSS score: 8.4
CWE: CWE-502
Published: 2021-09-13T20:05:39Z

### Impact
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.

### Patches
The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls.

### References

- https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
- https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
- https://anon-artist.github.io/blogs/blog3.html
Vulnerability: GHSA-gv5f-cjw9-5vxg
Summary: Camel-xstream component in Apache Camel can allow remote attackers to execute arbitrary commands 
Aliases: CVE-2015-5344
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-10-16T23:10:23Z

The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Vulnerability: GHSA-gjcg-vrxg-xmgv
Summary: Incorrect handling of H2 GOAWAY + SETTINGS frames
Aliases: CVE-2021-39162
Severity: HIGH
CVSS score: 8.6
CWE: CWE-754
Published: 2021-09-10T17:54:01Z

Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event.  

### Impact
This can lead to a DoS in the presence of untrusted *upstream* servers.

### Patches
0.15.1 contains an upgraded envoy binary with this vulnerability patched.

### Workarounds
If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32780)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-pf59-j7c2-rh6x
Summary: Exposure of Sensitive Information to an Unauthorized Actor and Insertion of Sensitive Information Into Sent Data in Calico
Aliases: CVE-2020-13597
Severity: LOW
CVSS score: 6
CWE: CWE-200, CWE-201
Published: 2022-02-15T01:57:18Z

Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
Vulnerability: GHSA-389p-fchr-q2mg
Summary: Path Traversal in ImpressCMS
Aliases: CVE-2022-24977
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2022-02-15T00:02:47Z

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.
Vulnerability: GHSA-qv8p-v9qw-wc7g
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2012-1098
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
Vulnerability: GHSA-x7vr-c387-8w57
Summary: Integer Overflow/Infinite Loop in the http crate
Aliases: CVE-2020-25574
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835, CWE-190
Published: 2021-08-25T21:01:31Z

An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).
Vulnerability: GHSA-v73m-fjxv-w4rh
Summary: Hijacked Environment Variables in fabric-js
Aliases: CVE-2017-16053
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T20:50:18Z

The `fabric-js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-rjjg-hgv6-h69v
Summary: Memory corruption in Tensorflow
Aliases: CVE-2020-15193
Severity: HIGH
CVSS score: 7.1
CWE: CWE-908
Published: 2020-09-25T18:28:27Z

### Impact
The implementation of `dlpack.to_dlpack` can be made to use uninitialized memory resulting in further memory corruption. This is because the pybind11 glue code assumes that the argument is a tensor:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/tfe_wrapper.cc#L1361

However, there is nothing stopping users from passing in a Python object instead of a tensor.
```python
In [2]: tf.experimental.dlpack.to_dlpack([2])                                                                                                                                            
==1720623==WARNING: MemorySanitizer: use-of-uninitialized-value                                                                                                                            
    #0 0x55b0ba5c410a in tensorflow::(anonymous namespace)::GetTensorFromHandle(TFE_TensorHandle*, TF_Status*) third_party/tensorflow/c/eager/dlpack.cc:46:7
    #1 0x55b0ba5c38f4 in tensorflow::TFE_HandleToDLPack(TFE_TensorHandle*, TF_Status*) third_party/tensorflow/c/eager/dlpack.cc:252:26
... 
```

The uninitialized memory address is due to a `reinterpret_cast`
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/python/eager/pywrap_tensor.cc#L848-L850

Since the `PyObject` is a Python object, not a TensorFlow Tensor, the cast to `EagerTensor` fails. 

### Patches
We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-3crj-w4f5-gwh4
Summary: Processing untrusted theming resources might execute arbitrary code (ACE)
Aliases: CVE-2021-21316
Severity: HIGH
CVSS score: 6.3
CWE: CWE-74
Published: 2021-01-29T20:51:37Z

### Impact
When processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be executed in the context of the build process.

While this is a [feature](http://lesscss.org/usage/#less-options-enable-inline-javascript-deprecated-) of the [Less.js library](https://github.com/less/less.js), it is an unexpected behavior in the context of OpenUI5 and SAPUI5 development.

Especially in the context of [UI5 Tooling](https://github.com/SAP/ui5-tooling), which relies on less-openui5, this poses a security threat:

An attacker might create a [library](https://sap.github.io/ui5-tooling/pages/Builder/#library) or [theme-library](https://sap.github.io/ui5-tooling/pages/Builder/#theme-library) containing a custom control or theme, hiding malicious JavaScript code in one of the `.less` files.

This is an example of inline JavaScript in a Less file:
```less
.rule {
	@var: `(function(){console.log('Hello from JavaScript'); process.exit(1);})()`;
	color: @var;
}
```

Starting with Less.js version 3.0.0, the Inline JavaScript feature is disabled by default. less-openui5 however currently uses [a fork](https://github.com/SAP/less-openui5/tree/master/lib/thirdparty/less) of Less.js v1.6.3.

Note that disabling the Inline JavaScript feature in Less.js versions 1.x, still evaluates code has additional double codes around it:
```less
.rule {
	@var: "`(function(){console.log('Hello from JavaScript'); process.exit(1);})()`";
	color: @var;
}
```

### Patches
We decided to remove the inline JavaScript evaluation feature completely from the code of our Less.js fork.

This fix is available in less-openui5 version [v0.10.0](https://github.com/SAP/less-openui5/releases/tag/v0.10.0)

### Workarounds
Only process trusted theming resources.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/SAP/less-openui5
* Email us at secure@sap.com
Vulnerability: GHSA-hxw9-jxqw-jc8j
Summary: Data races in dces
Aliases: CVE-2020-36459
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:58:05Z

An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. This allows non-thread safe `EntityStore` and `ComponentStore`s to be sent
across threads and cause data races.
Vulnerability: GHSA-q5c4-39f5-m68j
Summary: Regular Expression Denial of Service in decamelize
Aliases: CVE-2017-16023
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:00:17Z

Affected versions of `decamelize` are susceptible to a denial of service vulnerability when user input is passed directly into `decamelize`.




## Recommendation

Update to version 1.1.2 or later.