TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-v82p-hv3v-p6qp
Summary: Incomplete validation in MKL requantization
Aliases: CVE-2021-37665
Severity: HIGH
CVSS score: 7.8
CWE: CWE-20
Published: 2021-08-25T14:42:16Z

### Impact
Due to incomplete validation in MKL implementation of requantization, an  attacker can trigger undefined behavior via binding a reference to a null pointer or can access data outside the bounds of heap allocated arrays:

```python
import tensorflow as tf

tf.raw_ops.RequantizationRangePerChannel(
  input=[],
  input_min=[0,0,0,0,0],
  input_max=[1,1,1,1,1],
  clip_value_max=1)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/mkl/mkl_requantization_range_per_channel_op.cc) does not validate the dimensions of the `input` tensor.

A similar issue occurs in `MklRequantizePerChannelOp`:

```python
import tensorflow as tf 
from tensorflow.python.ops import gen_math_ops

gen_math_ops.requantize_per_channel(
  input=[],
  input_min=[-100,-100,-100,-100,-100],
  input_max=[-100,-100,-100],
  requested_output_min=[-100,-100,-100,-100,-100],
  requested_output_max=[],
  out_type=tf.int)
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/mkl/mkl_requantize_per_channel_op.cc) does not perform full validation for all the input arguments.

### Patches
We have patched the issue in GitHub commit [9e62869465573cb2d9b5053f1fa02a81fce21d69](https://github.com/tensorflow/tensorflow/commit/9e62869465573cb2d9b5053f1fa02a81fce21d69) and in the Github commit [203214568f5bc237603dbab6e1fd389f1572f5c9](https://github.com/tensorflow/tensorflow/commit/203214568f5bc237603dbab6e1fd389f1572f5c9).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-pf3p-x6qj-6j7q
Summary: mio invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2020-35922
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-188
Published: 2021-08-25T20:50:33Z

An issue was discovered in the mio crate before 0.7.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
Vulnerability: GHSA-hm45-mgqm-gjm4
Summary: Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability
Aliases: CVE-2020-26249
Severity: HIGH
CVSS score: 7.7
CWE: CWE-79
Published: 2020-12-08T23:55:54Z

### Impact
A RCE exploit has been discovered in the Red Discord Bot - Dashboard Webserver: this exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserver front-end code.  By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information.

### Patches
This high severity exploit has been fixed on version `0.1.7a`.

### Workarounds
There are no workarounds, bot owners must upgrade their relevant packages (Dashboard module and Dashboard webserver) in order to patch this issue

### References
- 99d88b8
- a6b9785

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-Dashboard](https://github.com/Cog-Creators/Red-Dashboard/issues/new/choose)
* Over on the official [Red Server](https://discord.gg/red) or at the Third Party Server [Toxic Layer](https://discord.gg/vQZTdB9)
Vulnerability: GHSA-29qj-rvv6-qrmv
Summary: Cross-site scripting in RESTEasy
Aliases: CVE-2020-10688
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-15T16:05:22Z

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
Vulnerability: GHSA-xgc9-9w4v-h33h
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-1321
Severity: HIGH
CVSS score: 7.2
CWE: CWE-20
Published: 2018-11-06T23:17:27Z

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
Vulnerability: GHSA-4v2c-g2xc-47fv
Summary: Downloads Resources over HTTP in massif
Aliases: CVE-2016-10682
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:38Z

Affected versions of `massif` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `massif`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3448-vrgh-85xr
Summary: NULL Pointer Dereference in OpenCV.
Aliases: CVE-2019-14493
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-10-12T22:21:43Z

An issue was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.1.26). There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.
Vulnerability: GHSA-cr6m-62pq-hmqh
Summary: OS Command injection in npm-lockfile
Aliases: CVE-2022-0841
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-03-04T00:00:18Z

npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5.
Vulnerability: GHSA-f6vf-pq8c-69m4
Summary: Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
Aliases: CVE-2019-17195
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-754, CWE-755
Published: 2019-10-16T18:31:17Z

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Vulnerability: GHSA-vm37-j55j-8655
Summary: OS Command Injection in Microweber
Aliases: CVE-2022-0557
Severity: HIGH
CVSS score: 7.8
CWE: CWE-78
Published: 2022-02-12T00:00:49Z

Microweber is a content management system with drag and drop. Prior to version 1.2.11, Microweber is vulnerable to OS Command Injection.
Vulnerability: GHSA-wh4h-v3f2-r2pp
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2019-6975
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2019-02-12T15:36:37Z

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
Vulnerability: GHSA-7wph-fc4w-wqp2
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2010-4535
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2018-07-23T19:51:59Z

The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.
Vulnerability: GHSA-hxvf-35w8-f5mw
Summary: Cross-Site Request Forgery in Magnolia CMS
Aliases: CVE-2021-46366
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-02-12T00:00:37Z

An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.
Vulnerability: GHSA-rrvx-pwf8-p59p
Summary: In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values
Aliases: CVE-2016-1000343
Severity: HIGH
CVSS score: 7.5
Published: 2018-10-17T16:24:22Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Vulnerability: GHSA-72j4-94rx-cr6w
Summary: Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak
Aliases: CVE-2020-1694
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-732, CWE-183
Published: 2022-02-09T00:57:02Z

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.
Vulnerability: GHSA-mvmf-cvfx-qg55
Summary: Regular Expression Denial of Service in bleach
Aliases: CVE-2014-8881
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2020-09-01T15:16:43Z

All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.



## Recommendation

The `bleach` package is not currently maintained, and has not seen an update since 2014. 

To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=html%20sanitizer&page=1&ranking=optimal).
Vulnerability: GHSA-3cjv-4phw-gvvv
Summary: Malicious Package in getcookies
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T20:39:33Z

The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module.


## Recommendation

This module should be uninstalled if found used within an application. In addition to removing the installed module, you will also want to evaluate your application to determine whether or not user data or systems were compromised.
Vulnerability: GHSA-8f64-q7jc-ccgp
Summary: Cross-Site Scripting in metascraper
Aliases: CVE-2018-3773
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2018-08-08T22:25:57Z

Versions of `metascraper` prior to 5.3.0 are vulnerable to stored cross-site scripting (XSS).


## Recommendation

Upgrade to version 5.3.0 or later.
Vulnerability: GHSA-36h2-95gj-w488
Summary: Open redirect in Gitea
Aliases: CVE-2021-45328
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-02-09T00:00:28Z

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.
Vulnerability: GHSA-c6rq-rjc2-86v2
Summary: Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
Aliases: CVE-2017-18869
Severity: LOW
CVSS score: 2.5
CWE: CWE-367
Published: 2022-02-10T23:33:39Z

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
Vulnerability: GHSA-76qr-mmh8-cp8f
Summary: Moderate severity vulnerability that affects com.sparkjava:spark-core
Aliases: CVE-2018-9159
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2018-10-19T16:56:00Z

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
Vulnerability: GHSA-qh2g-7h5p-mxf4
Summary: Credentials bypass in Apache Druid
Aliases: CVE-2020-1958
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-74
Published: 2022-02-09T22:05:39Z

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.
Vulnerability: GHSA-2777-2vq8-c4v4
Summary: SQL Injection in sequelize
Aliases: CVE-2019-11069
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-04-11T16:33:17Z

Versions of `sequelize` prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL option`standard_conforming_strings` is not set to `on` by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals.


## Recommendation

Upgrade to version 5.3.0 or later.
Vulnerability: GHSA-qjw2-hr98-qgfh
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-24750
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:15:36Z

FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Vulnerability: GHSA-xgjc-49cw-529m
Summary: Moderate severity vulnerability that affects org.b3log:symphony
Aliases: CVE-2019-9142
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-03-06T17:35:49Z

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
Vulnerability: GHSA-hxmp-pqch-c8mm
Summary: Denial of service attack via incorrect parameters in Matrix Synapse
Aliases: CVE-2020-26257
Severity: LOW
CVSS score: 6.5
CWE: CWE-74, CWE-79, CWE-400
Published: 2020-12-09T18:21:29Z

### Impact

A malicious or poorly-implemented homeserver can inject malformed events into a room by specifying a different room id in the path of a `/send_join`, `/send_leave`, `/invite` or `/exchange_third_party_invite` request.

This can lead to a denial of service in which future events will not be correctly sent to other servers over federation.

This affects any server which accepts federation requests from untrusted servers.

### Patches

Issue is resolved by https://github.com/matrix-org/synapse/pull/8776.

### Workarounds

Homeserver administrators could limit access to the federation API to trusted servers (for example via `federation_domain_whitelist`).
Vulnerability: GHSA-pr5m-4w22-8483
Summary: XXS in NanoHTTPD
Aliases: CVE-2020-13697
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-02-25T16:32:34Z

An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
Vulnerability: GHSA-57q7-rxqq-7vgp
Summary: On Windows, `git-sizer` might run a `git` executable within the repository being analyzed
Severity: MODERATE
CVSS score: 0
Published: 2022-02-15T01:57:18Z

### Impact
On Windows, if `git-sizer` is run against a non-bare repository, and that repository has an executable called `git.exe`, `git.bat`, etc., then that executable might be run by `git-sizer` rather than the system `git` executable. An attacker could try to use social engineering to get a victim to run `git-sizer` against a hostile repository and thereby get the victim to run arbitrary code.

On Linux or other Unix-derived platforms, a similar problem could occur if the user's `PATH` has the current directory before the path to the standard `git` executable, but this is would be a very unusual configuration that has been known for decades to lead to all kinds of security problems.

### Patches
Users should update to git-sizer v1.4.0

### Workarounds
If you are on Windows, then either
* Don't run `git-sizer` against a repository that might contain hostile code, or, if you must…
* Run `git-sizer` against a bare clone of the hostile repository, or, if that is not possible…
* Make sure that the hostile repository doesn't have an executable in its top-level directory before running `git-sizer`.

If you are on Linux or other Unix-based system, then (for myriad reasons!) don't add the current directory to your `PATH`.

### References
* [Command PATH security in Go](https://blog.golang.org/path-security)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the `git-sizer` project](https://github.com/github/git-sizer).
* Email us at [GitHub support](mailto:support@github.com).
Vulnerability: GHSA-5f38-9jw2-6r6h
Summary: Cross-site Scripting in teddy
Aliases: CVE-2021-23447
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79, CWE-843
Published: 2021-10-12T16:22:04Z

Teddy is a readable and easy to learn templating language. This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).
Vulnerability: GHSA-78vq-9j56-wrfr
Summary: Cross-site Scripting in gon
Aliases: CVE-2020-25739
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-30T17:29:15Z

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
Vulnerability: GHSA-xh56-3f5w-9h25
Summary: Hijacked Environment Variables in nodemailer-js
Aliases: CVE-2017-16071
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:40:01Z

The `nodemailer-js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-cjj8-wfrx-jqcf
Summary: Cross-Site Scripting (XSS) in pivottable
Aliases: CVE-2016-1000241
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T16:00:18Z

Affected versions of `pivottable` are vulnerable to cross-site scripting, due to a new mechanism used to render JSON elements.


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-r4gv-vj59-cccm
Summary: Control character injection in console output in github.com/ipfs/go-ipfs 
Aliases: CVE-2020-26283
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-116, CWE-150
Published: 2021-06-23T17:27:27Z

### Impact
Control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action.

### Patches
<!-- _Has the problem been patched? What versions should users upgrade to?_  -->

- Patched via https://github.com/ipfs/go-ipfs/pull/7831 in v0.8.0

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ipfs](http://github.com/ipfs/go-ipfs)
* Email us at [security@ipfs.io](mailto:security@ipfs.io)
Vulnerability: GHSA-4q69-q4q7-x82c
Summary: High severity vulnerability that affects rendertron
Aliases: CVE-2017-18353
Severity: HIGH
CVSS score: 7.5
Published: 2019-01-04T17:41:46Z

Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.
Vulnerability: GHSA-83rh-hx5x-q9p5
Summary: Out-of-bounds Read in OpenCV
Aliases: CVE-2017-18009
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2021-10-12T22:03:23Z

In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.
Vulnerability: GHSA-33xh-xch9-p6hj
Summary: Incorrect Authorization in Apache Ozone
Aliases: CVE-2021-39233
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-863
Published: 2021-11-23T18:17:59Z

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Vulnerability: GHSA-g6f4-j6c2-w3p3
Summary: High severity vulnerability that affects uglify-js
Severity: HIGH
CVSS score: 0
Published: 2018-10-09T00:39:43Z

Withdrawn, accidental duplicate publish.

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Vulnerability: GHSA-75f6-78jr-4656
Summary: Null pointer dereference in `EditDistance`
Aliases: CVE-2021-29564
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:25:08Z

### Impact
An attacker can trigger a null pointer dereference in the implementation of `tf.raw_ops.EditDistance`: 
    
```python
import tensorflow as tf

hypothesis_indices = tf.constant([247, 247, 247], shape=[1, 3], dtype=tf.int64)
hypothesis_values = tf.constant([-9.9999], shape=[1], dtype=tf.float32)
hypothesis_shape = tf.constant([0, 0, 0], shape=[3], dtype=tf.int64)
truth_indices = tf.constant([], shape=[0, 3], dtype=tf.int64)
truth_values = tf.constant([], shape=[0], dtype=tf.float32)
truth_shape = tf.constant([0, 0, 0], shape=[3], dtype=tf.int64)

tf.raw_ops.EditDistance(
    hypothesis_indices=hypothesis_indices, hypothesis_values=hypothesis_values,
    hypothesis_shape=hypothesis_shape, truth_indices=truth_indices,
    truth_values=truth_values, truth_shape=truth_shape, normalize=True)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/79865b542f9ffdc9caeb255631f7c56f1d4b6517/tensorflow/core/kernels/edit_distance_op.cc#L103-L159) has incomplete validation of the input parameters.

In the above scenario, an attacker causes an allocation of an empty tensor for the output:

```cc
OP_REQUIRES_OK(ctx, ctx->allocate_output("output", output_shape, &output));
auto output_t = output->flat<float>();
output_t.setZero();
```

Because `output_shape` has 0 elements, the result of `output->flat<T>()` has an empty buffer, so calling `setZero` would result in a null dereference.

### Patches
We have patched the issue in GitHub commit [f4c364a5d6880557f6f5b6eb5cee2c407f0186b3](https://github.com/tensorflow/tensorflow/commit/f4c364a5d6880557f6f5b6eb5cee2c407f0186b3).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-jv2c-mhcq-6wp4
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0829
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:57:39Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-c2w9-48qc-qpj4
Summary: High severity vulnerability that affects ansible
Aliases: CVE-2017-2809
Severity: HIGH
CVSS score: 7.8
CWE: CWE-94
Published: 2018-07-13T15:16:54Z

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.
Vulnerability: GHSA-f4hq-453j-p95f
Summary: Open redirect in Slashify
Aliases: CVE-2021-3189
Severity: HIGH
CVSS score: 6.1
CWE: CWE-601
Published: 2021-02-05T20:43:34Z

The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, `bookings/latest/` to `bookings/latest`. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain.

Consider the [example from the docs](https://www.npmjs.com/package/slashify#usage). Assume we have run it and started a server on `localhost:3000`, then visiting `localhost:3000///github.com/` redirects you to https://github.com.

## Recommendation

This vulnerability is currently un-patched in the `slashify` package so there is no known safe version of this package. Discontinuing use of `slashify` is recommended.
Vulnerability: GHSA-fv9m-f7w4-889c
Summary: Exfiltrates Discord login tokens to pastebin in discordi.js
Aliases: CVE-2017-16207
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-06T21:43:03Z

The `discordi.js` package is malware that attempts to discover and exfiltrate a user's [Discord](https://discordapp.com/) credentials, sending them to pastebin.

All versions have been unpublished from the npm registry.


## Recommendation

Do not install / use this module. It has been unpublished from the npm registry but may exist in some caches. Any users that logged into Discord using this library will need to change their credentials.
Vulnerability: GHSA-8h56-v53h-5hhj
Summary: Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Aliases: CVE-2020-10204
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2020-04-14T15:27:14Z

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
Vulnerability: GHSA-qcc9-q247-3m2m
Summary: Malicious Package in js-regular
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:46:49Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-5r2p-j47h-mhpg
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2018-16471
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-15T15:59:08Z

There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.
Vulnerability: GHSA-j5hj-fhc9-g24m
Summary: Moderate severity vulnerability that affects rack-mini-profiler
Aliases: CVE-2016-4442
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2017-10-24T18:33:35Z

The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
Vulnerability: GHSA-4xj5-vv9x-63jp
Summary: Data races in concread
Aliases: CVE-2020-35928
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362
Published: 2021-08-25T20:50:22Z

An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.
Vulnerability: GHSA-83vp-6jqg-6cmr
Summary: Incorrect Authentication in shopware
Aliases: CVE-2022-24748
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-287
Published: 2022-03-10T18:02:14Z

### Impact
Modify Customers, create Orders without App Permission

## Patches
We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-32wr-8wxm-852c
Summary: Deserialization of Untrusted Data in NukeViet
Aliases: CVE-2019-7725
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-06-22T15:24:59Z

includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
Vulnerability: GHSA-qx4v-6gc5-f2vv
Summary: Regular Expression Denial of Service
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-06-20T14:32:56Z

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.
Vulnerability: GHSA-58g2-9fqr-36q2
Summary: Prototype Pollution in Proto
Aliases: CVE-2021-23426
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2021-09-02T22:01:01Z

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.
Vulnerability: GHSA-5crj-c72x-m7gq
Summary: Null pointer exception when `Exit` node is not preceded by `Enter` op
Aliases: CVE-2021-41217
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-476
Published: 2021-11-10T18:55:11Z

### Impact
The [process of building the control flow graph](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/common_runtime/immutable_executor_state.cc#L284-L346) for a TensorFlow model is vulnerable to a null pointer exception when nodes that should be paired are not:
  
```python
import tensorflow as tf
  
@tf.function
def func():
  return tf.raw_ops.Exit(data=[False,False])
    
func()
```

This occurs because the code assumes that the first node in the pairing (e.g., an `Enter` node) always exists when encountering the second node (e.g., an `Exit` node):
  
```cc
  ...
} else if (IsExit(curr_node)) {
  // Exit to the parent frame.
  parent = parent_nodes[curr_id];         
  frame_name = cf_info->frame_names[parent->id()];
  ...                
```

When this is not the case, `parent` is `nullptr` so dereferencing it causes a crash.

### Patches
We have patched the issue in GitHub commit [05cbebd3c6bb8f517a158b0155debb8df79017ff](https://github.com/tensorflow/tensorflow/commit/05cbebd3c6bb8f517a158b0155debb8df79017ff).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-wc6f-cjcp-cc33
Summary: Improper Certificate Validation in Apache IoTDB
Aliases: CVE-2020-1952
Severity: HIGH
CVSS score: 9.8
CWE: CWE-295
Published: 2022-01-06T19:45:30Z

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
Vulnerability: GHSA-g8jj-899q-8x3j
Summary: Cross-site scripting in json-sanitizer
Aliases: CVE-2020-13973
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T23:04:13Z

OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
Vulnerability: GHSA-cfqj-9g2g-w7q6
Summary: Cross-site Scripting in Apache JSPWiki
Aliases: CVE-2021-40369
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-02T17:49:14Z

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.
Vulnerability: GHSA-pgf8-28gg-vpr6
Summary: Path traversal
Aliases: CVE-2021-32662
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2021-06-04T19:09:20Z

### Impact

A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API.

This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API.

### Patches

The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-rgp5-m2pq-3fmg
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0690
Severity: HIGH
CVSS score: 8.8
CWE: CWE-79
Published: 2022-02-20T00:00:31Z

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-j665-rvj7-2jv9
Summary: Code Injection in mosc
Aliases: CVE-2020-7672
Severity: HIGH
CVSS score: 8.6
CWE: CWE-94
Published: 2021-05-17T21:00:17Z

mosc through 1.0.0 is vulnerable to Arbitrary Code Execution. User input provided to `properties` argument is executed by the `eval` function, resulting in code execution.
Vulnerability: GHSA-cqv6-3phm-hcwx
Summary: Access to invalid memory during shape inference in `Cudnn*` ops
Aliases: CVE-2021-41221
Severity: HIGH
CVSS score: 7.8
CWE: CWE-787, CWE-120
Published: 2021-11-10T18:50:17Z

### Impact
The [shape inference code](https://github.com/tensorflow/tensorflow/blob/9ff27787893f76d6971dcd1552eb5270d254f31b/tensorflow/core/ops/cudnn_rnn_ops.cc) for the `Cudnn*` operations in TensorFlow can be tricked into accessing invalid memory, via a heap buffer overflow:

```python
import tensorflow as tf

@tf.function
def func():
  return tf.raw_ops.CudnnRNNV3(
    input=[0.1, 0.1],
    input_h=[0.5],
    input_c=[0.1, 0.1, 0.1], 
    params=[0.5, 0.5],
    sequence_lengths=[-1, 0, 1])
  
func() 
```
  
This occurs because the ranks of the `input`, `input_h` and `input_c` parameters are not validated, but code assumes they have certain values:

```cc
auto input_shape = c->input(0);
auto input_h_shape = c->input(1);
auto seq_length = c->Dim(input_shape, 0);
auto batch_size = c->Dim(input_shape, 1);  // assumes rank >= 2
auto num_units = c->Dim(input_h_shape, 2); // assumes rank >= 3
``` 

### Patches
We have patched the issue in GitHub commit [af5fcebb37c8b5d71c237f4e59c6477015c78ce6](https://github.com/tensorflow/tensorflow/commit/af5fcebb37c8b5d71c237f4e59c6477015c78ce6).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-q42c-rrp3-r3xm
Summary: Malicious Package in commmander
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:13:44Z

All versions of `commmander` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-hgwp-4vp4-qmm2
Summary: Local Privilege Escalation in cloudflared
Aliases: CVE-2020-24356
Severity: HIGH
CVSS score: 7.8
CWE: CWE-427
Published: 2021-05-24T16:56:35Z

In `cloudflared` versions < 2020.8.1 on Windows, if an administrator has started `cloudflared` and set it to read configuration files from a certain directory, an unprivileged user can exploit a misconfiguration in order to escalate privileges and execute system-level commands. The misconfiguration was due to the way that `cloudflared` reads its configuration file. One of the locations that `cloudflared` reads from (C:\etc\) is not a secure by default directory due to the fact that Windows does not enforce access controls on this directory without further controls applied. A malformed config.yaml file can be written by any user. Upon reading this config, `cloudflared` would output an error message to a log file defined in the malformed config. The user-controlled log file location could be set to a specific location that Windows will execute when any user logs in.
Vulnerability: GHSA-rj38-87f3-93p6
Summary: Downloads Resources over HTTP in limbus-buildgen
Aliases: CVE-2016-10674
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:27Z

Affected versions of `limbus-buildgen` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `limbus-buildgen`.


## Recommendation

Update to version 0.1.1 or later.
Vulnerability: GHSA-gq67-pp9w-43gp
Summary: Cryptographically weak CSRF tokens in Apache MyFaces
Aliases: CVE-2021-26296
Severity: HIGH
CVSS score: 0
CWE: CWE-352, CWE-330
Published: 2021-06-16T17:31:39Z

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.


Mitigation:
Existing web.xml configuration parameters can be used to direct
MyFaces to use SecureRandom for CSRF token generation:

org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom
Vulnerability: GHSA-46hv-7769-j7rx
Summary: Unauthorized File Access in harp
Aliases: CVE-2019-5437
Severity: MODERATE
CVSS score: 0
CWE: CWE-548
Published: 2019-06-13T16:12:22Z

Affected versions of `harp` are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as `_secret-folder`. If the underscore character is URL encoded the server delivers the file.

## Recommendation

Upgrade to version `0.40.2` or later.
Vulnerability: GHSA-8c4j-34r4-xr8g
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36180
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:18Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-5vx5-9q73-wgp4
Summary: High severity vulnerability that affects safemode
Aliases: CVE-2017-7540
Severity: HIGH
CVSS score: 0
CWE: CWE-184
Published: 2017-10-24T18:33:35Z

rubygem-safemode, as used in Foreman, versions 1.3.1 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
Vulnerability: GHSA-f4g9-h89h-jgv9
Summary: SAML XML Signature wrapping in PySAML2
Aliases: CVE-2021-21238
Severity: LOW
CVSS score: 6.5
CWE: CWE-347
Published: 2021-01-21T14:12:16Z

### Impact

All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 <= 6.4.1` does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to `xmlsec1` and `xmlsec1` will not validate every signature in the given document, but only the first it finds in the given scope.

### Patches

Users should upgrade to pysaml2 `v6.5.0`.

### Workarounds

No workaround provided at this point.

### References

No references provided at this point.

### Credits

- Victor Schönfelder Garcia (isits AG International School of IT Security)
- Juraj Somorovsky (Paderborn University)
- Vladislav Mladenov (Ruhr University Bochum)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2)
* Email us at [the incident-response address](mailto:incident-response@idpy.org)
Vulnerability: GHSA-6343-m2qr-66gf
Summary: Malicious Package in js-sja3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:10:41Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-g44j-7vp3-68cv
Summary: Arbitrary File Write in Libcontainer
Aliases: CVE-2015-3629
Severity: HIGH
CVSS score: 8.4
CWE: CWE-59
Published: 2022-02-15T01:57:18Z

Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
Vulnerability: GHSA-xqfj-vm6h-2x34
Summary: Improper Handling of Length Parameter Inconsistency in Compress
Aliases: CVE-2021-35517
Severity: HIGH
CVSS score: 7.5
CWE: CWE-130, CWE-770
Published: 2021-08-02T16:55:39Z

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Vulnerability: GHSA-q9p4-qfc8-fvpp
Summary: SQL Injection in medoo
Aliases: CVE-2019-10762
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-10-12T16:32:38Z

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
Vulnerability: GHSA-w457-6q6x-cgp9
Summary: Prototype Pollution in handlebars
Aliases: CVE-2019-19919
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2019-12-26T17:58:13Z

Versions of `handlebars` prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' `__proto__` and `__defineGetter__` properties, which may allow an attacker to execute arbitrary code through crafted payloads.


## Recommendation

Upgrade to version 3.0.8, 4.3.0 or later.
Vulnerability: GHSA-jv9c-w74q-6762
Summary: Insecure permissions on build temporary rootfs in Singularity
Aliases: CVE-2020-25040
Severity: HIGH
CVSS score: 8.8
CWE: CWE-668, CWE-732
Published: 2021-05-24T16:56:23Z

### Impact

Insecure permissions on temporary directories used in explicit and implicit container build operations.

When a Singularity command that results in a container build operation is executed, it is possible for a user with access to the system to read the contents of the image during the build. Additionally, if the image contains a world-writable file or directory, it is possible for a user to inject arbitrary content into the running build, which in certain circumstances may enable arbitrary code execution during the build and/or when the built container is run.

### Patches

This issue is addressed in Singularity 3.6.3.

All users are advised to upgrade to 3.6.3.

### Workarounds

The issue is mitigated if `TMPDIR` is set to a location that is only accessible to the user, as any subdirectories directly under `TMPDIR` cannot then be accessed by others. However, this is difficult to enforce so it is not recommended to rely on this as a mitigation.

### For more information

General questions about the impact of the advisory / changes made in the 3.6.0 release can be asked in the:

* [Singularity Slack Channel](https://bit.ly/2m0g3lX)
* [Singularity Mailing List](https://groups.google.com/a/lbl.gov/forum/??sdf%7Csort:date#!forum/singularity)

Any sensitive security concerns should be directed to: security@sylabs.io

See our Security Policy here: https://sylabs.io/security-policy
Vulnerability: GHSA-g37j-v5gh-g25c
Summary: Malicious Package in js-shi3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:06:48Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vj9x-w7ch-f46p
Summary: pimcore is vulnerable to SQL Injection
Aliases: CVE-2022-0258
Severity: HIGH
CVSS score: 8.3
CWE: CWE-89
Published: 2022-01-21T23:50:08Z

pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command