TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-j96p-r523-8r3w
Summary: HTTP Request Smuggling in github.com/hyperledger/fabric
Aliases: CVE-2021-43669
Severity: HIGH
CVSS score: 7.5
CWE: CWE-444
Published: 2021-12-03T20:52:02Z

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
Vulnerability: GHSA-7p79-6x2v-5h88
Summary: Server crash if running Python 3.10 w/ Sanic 20.12
Severity: HIGH
CVSS score: 0
Published: 2022-02-16T22:57:57Z

**!!! ONLY APPLIES TO VERSIONS PRIOR TO Sanic v20.12 WHEN USING Python 3.10 !!!**

Sanic v20.12 officially supports Python versions 3.6, 3.7, 3.8, and 3.9. However, if you accidentally run it with version 3.10 (**which is not supported by Sanic 20.12**), your server is prone to crashing on an incoming web request.

### Impact
Anyone running Sanic server between 0.1.7 and 20.12 **using Python 3.10**.

### Patches
[Sanic v20.12.6](https://github.com/sanic-org/sanic/releases/tag/v20.12.6)

### Workarounds
Use a supported version of Python (v3.6 - v3.9)

### References
> In [asyncio](https://docs.python.org/3/library/asyncio.html#module-asyncio), the explicit passing of a loop argument has been deprecated and will be removed in version 3.10 for the following: ... [asyncio.Event](https://docs.python.org/3/library/asyncio-sync.html#asyncio.Event)

[Python 3.8 Release Notes](https://docs.python.org/3/whatsnew/3.8.html#deprecated)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the community forums](https://community.sanicframework.org/)
* Ping us on [the Discord server](https://discord.gg/FARQzAEMAA)
Vulnerability: GHSA-52qp-gwwh-qrg4
Summary: Missing Handler in @scandipwa/magento-scripts
Aliases: CVE-2021-32684
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-670
Published: 2021-06-21T17:10:02Z

### Impact
After changing the function from synchronous to asynchronous there wasn't implemented handler in the [start](https://docs.create-magento-app.com/getting-started/available-commands/start), [stop](https://docs.create-magento-app.com/getting-started/available-commands/stop), [exec](https://docs.create-magento-app.com/getting-started/available-commands/exec) and [logs](https://docs.create-magento-app.com/getting-started/available-commands/logs) commands, effectively making them unusable.

### Patches
[Version 1.5.3](https://github.com/scandipwa/create-magento-app/releases/tag/%40scandipwa%2Fmagento-scripts%401.5.3) contains patches for the problems described above.

### Workarounds
Upgrade to patched or latest (recommended) version `npm i @scandipwa/magento-scripts@1.5.3` or `npm i @scandipwa/magento-scripts@latest`.

### References
New releases always available here: https://github.com/scandipwa/create-magento-app/releases

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [create-magento-app](https://github.com/scandipwa/create-magento-app/issues)
Vulnerability: GHSA-pfrg-w49c-8432
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0768
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-08-02T17:26:23Z

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-v35c-49j6-q8hq
Summary: Security Constraint Bypass in Spring Security
Aliases: CVE-2016-9879
Severity: HIGH
CVSS score: 7.5
Published: 2020-09-15T20:30:34Z

Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed.

Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath() and getPathInfo() [1].

Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified.

Users of IBM WebSphere Application Server 8.5.x are known to be affected.

Users of other containers that implement the Servlet specification may be affected.

[1] https://issues.apache.org/bugzilla/show_bug.cgi?id=25015

## Affected Pivotal Products and Versions
Severity is high unless otherwise noted.
- Spring Security 3.2.0 - 3.2.9
- Spring Security 4.0.x - 4.1.3
- Spring Security 4.2.0
- Older unsupported versions are also affected

## Mitigation
Adopting one of the following mitigations will protect against this vulnerability.

- Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo()
- Upgrading to Spring Security 3.2.10, 4.1.4 or 4.2.1 will reject the request with a RequestRejectedException if the presence of an encoded "/" is detected. Note: If you wish to disable this feature it can be disabled by setting the DefaultHttpFirewall.allowUrlEncodedSlash = true. However, disabling this feature will mean applications are vulnerable (in containers that return path parameters in getServletPath() or getPathInfo()).

## Credit
The issue was identified by Shumpei Asahara & Yuji Ito from NTT DATA Corporation and responsibly reported to Pivotal.
Vulnerability: GHSA-5qx5-vg5w-5mx3
Summary: Stored XSS vulnerability in Jenkins Badge Plugin
Aliases: CVE-2022-23108
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-13T00:00:54Z

Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-5v95-v8c8-3rh6
Summary: Privilege escalation in rbac
Aliases: CVE-2021-22538
Severity: HIGH
CVSS score: 8.8
CWE: CWE-276
Published: 2021-05-21T14:32:55Z

### Impact
Using a carefully crafted request or malicious proxy, a user with `UserWrite` permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions. The event would be captured in the Event Log.

### Patches
The issue has been fixed in 0.24.0 and 0.23.1.

### Workarounds
For users who are unable to upgrade, we recommend auditing users who have `UserWrite` permissions and regularly reviewing the Event Log for malicious activity.

### Kudos
Thank you to Michael Mazzolini (Ethical Hacker at WHO) for finding and disclosing this vulnerability.
Vulnerability: GHSA-j6w4-pg6p-5mrv
Summary: Directory Traversal in tmock
Aliases: CVE-2017-16106
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T23:51:04Z

`tmock` is a static file server.

`tmock` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-7cj4-gj8m-m2f7
Summary: Authentication bypass in Apache Shiro
Aliases: CVE-2020-17510
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-04-22T16:13:23Z

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Vulnerability: GHSA-6584-gfwm-3vc3
Summary: Malicious Package in budfer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:43:01Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-54qq-9chj-rxhv
Summary: Cross-site Scripting in LiveHelperChat
Aliases: CVE-2022-0395
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-29T00:00:33Z

LiveHelperChat prior to version 3.93 contains a cross-site scripting vulnerability.
Vulnerability: GHSA-8phj-f9w2-cjcc
Summary: Arbitrary file reading vulnerability in Aim
Aliases: CVE-2021-43775
Severity: HIGH
CVSS score: 8.6
CWE: CWE-22
Published: 2021-11-23T22:03:23Z

### Impact
A path traversal attack aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.

Vulnerable code: https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16

### Patches
The vulnerability issue is resolved in Aim v3.1.0.

### References
https://owasp.org/www-community/attacks/Path_Traversal
Vulnerability: GHSA-x38q-xg2h-rxgx
Summary: Regular Expression Denial of Service in Leo Editor
Aliases: CVE-2020-23478
Severity: HIGH
CVSS score: 7.5
CWE: CWE-697
Published: 2021-09-23T23:14:28Z

Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
Vulnerability: GHSA-jjp3-m93h-5jm4
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0928
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2022-03-12T00:00:34Z

Microweber drag and drop website builder and CMS with e-commerce. Cross-site Scripting (XSS) discovered in microweber prior to 1.2.12. There is currently no known workaround, users are recommended to update to version 1.2.12.
Vulnerability: GHSA-g4xp-36c3-f7mr
Summary: Hidden Directories Always Served in inert
Aliases: CVE-2014-10068
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2020-08-31T22:47:41Z

Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.

The inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false.


## Recommendation

Update to version >= 1.1.1.
Vulnerability: GHSA-6j63-35hj-vmcg
Summary: Moderate severity vulnerability that affects mysql-binuuid-rails
Aliases: CVE-2018-18476
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2018-10-30T20:34:06Z

mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns.
Vulnerability: GHSA-43q8-3fv7-pr5x
Summary: Improper Validation of Integrity Check Value in TensorFlow
Severity: HIGH
CVSS score: 7
CWE: CWE-354
Published: 2022-02-09T23:37:55Z

### Impact
The implementation of [`tf.sparse.split`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_split_op.cc#L26-L102) does not fully validate the input arguments. Hence, a malicious user can trigger a denial of service via a segfault or a heap OOB read:

```python
import tensorflow as tf
data = tf.random.uniform([1, 32, 32], dtype=tf.float32)
axis = [1, 2]
x = tf.sparse.from_dense(data)
result = tf.sparse.split(x,3, axis=axis)
```
The code assumes `axis` is a scalar. This is another instance of [TFSA-2021-190](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-190.md) (CVE-2021-41206).

### Patches
We have patched the issue in GitHub commit [61bf91e768173b001d56923600b40d9a95a04ad5](https://github.com/tensorflow/tensorflow/commit/61bf91e768173b001d56923600b40d9a95a04ad5) (merging [#53695](https://github.com/tensorflow/tensorflow/pull/53695)).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/53660).
Vulnerability: GHSA-qc36-q22q-cjw3
Summary: SMTP command injection in lettre
Aliases: CVE-2021-38189
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-147
Published: 2021-07-12T17:03:27Z

### Impact

Affected versions of lettre allowed SMTP command injection through an attacker's controlled message body. The module for escaping lines starting with a period wouldn't catch a period that was placed after a double CRLF sequence, allowing the attacker to end the current message and write arbitrary SMTP commands after it.

### Fix

The flaw is fixed by correctly handling consecutive CRLF sequences.

### References

* [RUSTSEC-2021-0069](https://rustsec.org/advisories/RUSTSEC-2021-0069.html)
Vulnerability: GHSA-mpjm-v997-c4h4
Summary: Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
Aliases: CVE-2021-39184
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-668
Published: 2021-10-12T21:59:13Z

### Impact
This vulnerability allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases.

All current stable versions of Electron are affected.

### Patches
This was fixed with #30728, and the following Electron versions contain the fix:

- 15.0.0-alpha.10
- 14.0.0
- 13.3.0
- 12.1.0
- 11.5.0

### Workarounds
If your app enables `contextIsolation`, this vulnerability is significantly more difficult for an attacker to exploit.

Further, if your app does not depend on the `createThumbnailFromPath` API, then you can simply disable the functionality. In the main process, before the 'ready' event:
```js
delete require('electron').nativeImage.createThumbnailFromPath
```

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Vulnerability: GHSA-9wrv-g75h-8ccc
Summary: Improper Access Control in Shopware
Aliases: CVE-2022-24872
Severity: HIGH
CVSS score: 8.1
CWE: CWE-732
Published: 2022-04-22T21:04:27Z

Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 1.500 community extensions. Permissions set to sales channel context by admin-api are still useable within normal user session. We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-3h87-v52r-p9rg
Summary: Out of bounds write in reorder
Aliases: CVE-2021-29941
Severity: HIGH
CVSS score: 7.3
CWE: CWE-787
Published: 2021-08-25T20:54:08Z

An issue was discovered in the reorder crate through 2021-02-24 for Rust. swap_index has an out-of-bounds write if an iterator returns a len() that is too small.
Vulnerability: GHSA-j379-9jr9-w5cq
Summary: Moderate severity vulnerability that affects com.squareup.retrofit2:retrofit
Aliases: CVE-2018-1000844
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-611
Published: 2018-12-21T17:48:26Z

Square Open Source Retrofit versions prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contain a XML External Entity (XXE) vulnerability in JAXB. An attacker could use this to remotely read files from the file system or to perform SSRF. This vulnerability appears to have been fixed in commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.
Vulnerability: GHSA-4vhw-4rw7-jfpv
Summary: Path traversal in mozwire
Aliases: CVE-2020-35883
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-22
Published: 2021-08-25T20:49:02Z

An issue was discovered in the mozwire crate through 2020-08-18 for Rust. A ../ directory-traversal situation allows overwriting local files that have .conf at the end of the filename.
Vulnerability: GHSA-rgh3-987h-wpmw
Summary: XML External Entity Injection in XStream
Aliases: CVE-2016-3674
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2020-06-30T22:48:14Z

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Vulnerability: GHSA-qrqm-fpv6-6r8g
Summary: Command Injection Vulnerability in Mechanize
Aliases: CVE-2021-21289
Severity: HIGH
CVSS score: 7.4
CWE: CWE-78
Published: 2021-02-02T18:50:27Z

This security advisory has been created for public disclosure of a Command Injection vulnerability that was responsibly reported by @kyoshidajp (Katsuhiko YOSHIDA).

### Impact

Mechanize `>= v2.0`, `< v2.7.7` allows for OS commands to be injected using several classes' methods which implicitly use Ruby's `Kernel.open` method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls:

- `Mechanize::CookieJar#load`: since v2.0 (see 208e3ed)
- `Mechanize::CookieJar#save_as`: since v2.0 (see 5b776a4)
- `Mechanize#download`: since v2.2 (see dc91667)
- `Mechanize::Download#save` and `#save!` since v2.1 (see 98b2f51, bd62ff0)
- `Mechanize::File#save` and `#save_as`: since v2.1 (see 2bf7519)
- `Mechanize::FileResponse#read_body`: since v2.0 (see 01039f5)


### Patches

These vulnerabilities are patched in Mechanize v2.7.7.


### Workarounds

No workarounds are available. We recommend upgrading to v2.7.7 or later.


### References

See https://docs.rubocop.org/rubocop/cops_security.html#securityopen for background on why `Kernel.open` should not be used with untrusted input.


### For more information

If you have any questions or comments about this advisory, please open an issue in [sparklemotion/mechanize](https://github.com/sparklemotion/mechanize/issues/new).
Vulnerability: GHSA-w32p-76xr-88pc
Summary: Out-of-bounds write
Aliases: CVE-2019-1003
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:06Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
Vulnerability: GHSA-c6pw-q7f2-97hv
Summary: Privilege Escalation in cordova-plugin-inappbrowser
Aliases: CVE-2019-0219
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-79
Published: 2020-09-04T17:57:43Z

Versions of `cordova-plugin-inappbrowser` prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android applications using the package.


## Recommendation

Upgrade to version 3.1.0 or later.
Vulnerability: GHSA-wr5r-m8pc-85j9
Summary: Low severity vulnerability that affects org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml
Aliases: CVE-2019-3772
Severity: LOW
CVSS score: 0
CWE: CWE-611
Published: 2019-01-25T16:18:49Z

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability: GHSA-c6fg-99pr-25m9
Summary: Uncapped length of skin data fields submitted by players
Severity: HIGH
CVSS score: 7.5
Published: 2022-01-06T23:53:58Z

### Impact
Some skin data fields (e.g. skinID, geometryName) are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave.

This is problematic due to the 32767 byte limit on `TAG_String`s. If any of these fields exceeds 32767 bytes, an exception will be thrown during data saving, which will cause the server to crash.

Other fields (such as skinGeometryData) are also uncapped, but those have a much larger 2 GB length limit, so this is not a concern for those, particularly considering the decompressed packet size limit of 2 MB.

### Patches
PM3: 958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb
PM4: 6492cac5c10f9fa8443ceddd2191a7b65b73f601

### Workarounds
A plugin may check player skins during `PlayerLoginEvent` and `PlayerSkinChangeEvent` and ensure that the offending fields are not larger than 32767 bytes.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-g644-6fg4-hrh9
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0830
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:57:47Z

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-54fx-gm74-q676
Summary: Permissions bypass in SmallRye
Aliases: CVE-2020-1729
Severity: MODERATE
CVSS score: 4
CWE: CWE-863
Published: 2022-03-18T17:55:47Z

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
Vulnerability: GHSA-4r8q-gv9j-3xx6
Summary: Open Redirect
Aliases: CVE-2021-32645
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-601
Published: 2022-03-18T17:55:07Z

### Impact
In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL.
This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`)

### Patches
Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to.

### Workarounds
There is a simple way to work around the security issue
- Set the `force_https` to every tenant to `false`

### References
https://nvd.nist.gov/vuln/detail/CVE-2018-11784

### For more information
If you have any questions or comments about this advisory:
* Contact us in Discord: https://tenancy.dev/chat
Vulnerability: GHSA-pc5p-h8pf-mvwp
Summary: Machine-In-The-Middle in https-proxy-agent
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-300
Published: 2020-04-16T03:14:56Z

Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.


## Recommendation

Upgrade to version 3.0.0 or 2.2.3.
Vulnerability: GHSA-cvhw-2593-5j2q
Summary: Double Free in OpenCV
Aliases: CVE-2016-1516
Severity: HIGH
CVSS score: 8.8
CWE: CWE-415
Published: 2021-10-12T22:00:08Z

OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV-Python and and OpenCV-Contrib-Python 3.3.1.11).
Vulnerability: GHSA-8jxq-75rw-fhj9
Summary: Eve allows execution of arbitrary code via Code Injection in the where parameter
Aliases: CVE-2018-8097
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2018-07-12T20:29:35Z

io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.
Vulnerability: GHSA-j29f-m23h-3p8p
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0911
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-17T00:00:48Z

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Vulnerability: GHSA-9988-f88m-mr42
Summary: Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
Aliases: CVE-2022-25512
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-03-12T00:00:37Z

FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
Vulnerability: GHSA-7xrj-f5rp-j55h
Summary: Uncontrolled Resource Consumption in transpile
Aliases: CVE-2021-23429
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400, CWE-755
Published: 2021-09-02T17:10:42Z

All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.
Vulnerability: GHSA-3p3h-qghp-hvh2
Summary: Open Redirect in werkzeug
Aliases: CVE-2020-28724
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-04-20T16:30:26Z

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
Vulnerability: GHSA-4c7m-wxvm-r7gc
Summary: Improper parsing of octal bytes in netmask
Aliases: CVE-2021-28918
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-20
Published: 2021-04-14T15:03:16Z

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

:exclamation: NOTE: The fix for this issue was incomplete. A subsequent fix was made in version `2.0.1` which was assigned [CVE-2021-29418 / GHSA-pch5-whg9-qr2r](https://github.com/advisories/GHSA-pch5-whg9-qr2r). For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.
Vulnerability: GHSA-779f-wgxg-qr8f
Summary: Prototype Pollution in lodash.mergewith
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T18:10:22Z

Versions of `lodash.mergewith` before 4.6.2 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.2 or later.
Vulnerability: GHSA-xqvg-xm9m-p2c4
Summary: Moderate severity vulnerability that affects mailman
Aliases: CVE-2018-13796
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2018-09-11T18:57:16Z

An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.
Vulnerability: GHSA-52p9-v744-mwjj
Summary: Remote code execution in Kramdown
Aliases: CVE-2021-28834
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94
Published: 2021-03-29T16:30:34Z

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.
Vulnerability: GHSA-28hp-fgcr-2r4h
Summary: Cross-Site Scripting via JSONP
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2019-06-27T17:25:42Z

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.
Vulnerability: GHSA-3r8w-mphv-2f3f
Summary: Prototype Pollution
Aliases: CVE-2021-23396
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-1321
Published: 2021-06-21T17:12:25Z

All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
Vulnerability: GHSA-mgr2-3mpv-43gc
Summary: Downloads Resources over HTTP in openframe-image
Aliases: CVE-2016-10616
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:47:37Z

Affected versions of `openframe-image` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rww7-2gpw-fv6j
Summary: Crash when type cannot be specialized in Tensorflow
Aliases: CVE-2022-23572
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-754
Published: 2022-02-09T23:28:29Z

### Impact
Under certain scenarios, TensorFlow can fail to specialize a type during [shape inference](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L168-L174):

```cc
void InferenceContext::PreInputInit(
    const OpDef& op_def, const std::vector<const Tensor*>& input_tensors,
    const std::vector<ShapeHandle>& input_tensors_as_shapes) {
  const auto ret = full_type::SpecializeType(attrs_, op_def);
  DCHECK(ret.status().ok()) << "while instantiating types: " << ret.status();
  ret_types_ = ret.ValueOrDie();
  // ... 
}
```

However, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the `ValueOrDie` line. This results in an assertion failure as `ret` contains an error `Status`, not a value. In the second case we also get a crash due to the assertion failure.
### Patches
We have patched the issue in GitHub commit [cb164786dc891ea11d3a900e90367c339305dc7b](https://github.com/tensorflow/tensorflow/commit/cb164786dc891ea11d3a900e90367c339305dc7b).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-pwwm-pwx2-2hw7
Summary: Generation of Error Message Containing Sensitive Information in Snipe-IT
Aliases: CVE-2022-0622
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-209
Published: 2022-02-18T00:00:37Z

Snipe-IT prior to version 5.3.11 is vulnerable to Generation of Error Message Containing Sensitive Information.
Vulnerability: GHSA-r659-8xfp-j327
Summary: Prototype Pollution in objection.js
Aliases: CVE-2021-3766
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321, CWE-915
Published: 2021-09-07T23:09:43Z

objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). This issue is patched in version 2.2.16.
Vulnerability: GHSA-773h-w45w-f2f9
Summary: Denial of service vulnerability exists in libxmljs
Aliases: CVE-2022-21144
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2022-05-03T00:00:46Z

libxmljs provides libxml bindings for v8 javascript engine. This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.
Vulnerability: GHSA-6gww-qpm6-mc2g
Summary: Server-Side Request Forgery in ssrf-agent
Aliases: CVE-2021-23718
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-918
Published: 2021-12-02T17:51:51Z

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.
Vulnerability: GHSA-gfj6-p24g-6hpm
Summary: Malicious Package in jc-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:55:06Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-h9v8-rm3m-5h5f
Summary: OS Command Injection in git-add-remote
Aliases: CVE-2020-7630
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:47:47Z

git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.
Vulnerability: GHSA-j4mv-2rv7-v2j9
Summary: Improper Privilege Management in Concrete CMS 
Aliases: CVE-2021-22966
Severity: MODERATE
CVSS score: 0
CWE: CWE-269
Published: 2021-11-23T18:18:07Z

Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved.
Vulnerability: GHSA-hf4p-jm7r-vjjj
Summary: Deserialization of Untrusted Data in EthereumJ
Aliases: CVE-2018-15890
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-07-26T16:10:39Z

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.
Vulnerability: GHSA-q67f-3jq4-mww2
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0831
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
Vulnerability: GHSA-9423-6c93-gpp8
Summary: Arbitrary File Write via Archive Extraction (Zip Slip)
Aliases: CVE-2020-7667
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-06-23T17:13:29Z

The CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note, the fixing commit was applied to all affected versions which were re-released.
Vulnerability: GHSA-hfm2-fffh-v47v
Summary: Out-of-bounds write
Aliases: CVE-2019-1196
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:58:01Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1140, CVE-2019-1141, CVE-2019-1195, CVE-2019-1197.
Vulnerability: GHSA-96qc-ghj4-rq27
Summary: Directory Traversal in yttivy
Aliases: CVE-2017-16219
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:24:56Z

Affected versions of `yttivy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-wj36-v8j4-pc7c
Summary: Low severity vulnerability that affects express-cart
Aliases: CVE-2018-16483
Severity: HIGH
CVSS score: 8.8
CWE: CWE-290
Published: 2019-02-07T18:16:03Z

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
Vulnerability: GHSA-vqmr-957g-r7w3
Summary: High severity vulnerability that affects rendertron
Aliases: CVE-2017-18355
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2019-02-12T15:36:39Z

Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.
Vulnerability: GHSA-9h6g-6mxg-vvp4
Summary: Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Severity: MODERATE
CVSS score: 4
CWE: CWE-208
Published: 2021-04-19T14:47:18Z

Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

- https://vaadin.com/security/cve-2021-31406
Vulnerability: GHSA-hh56-x62g-gvhc
Summary: Cross-site scripting in CLEditor
Aliases: CVE-2019-1010113
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-07-26T16:10:06Z

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element.
Vulnerability: GHSA-vm6v-w6q2-mrrq
Summary: Malicious Package in bb-builder
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:20:05Z

All versions of `bb-builder` contained malicious code. The package ran an executable targeting Windows and uploaded information to a remote server.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m362-87jc-f39v
Summary: Directory Traversal in uv-tj-demo
Aliases: CVE-2017-16200
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:16:24Z

Affected versions of `uv-tj-demo` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-qmmc-jppf-32wv
Summary: Directory Traversal in Docker
Aliases: CVE-2014-9358
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-59
Published: 2022-02-15T00:41:14Z

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
Vulnerability: GHSA-mxv6-q98x-h958
Summary: Data races in model
Aliases: CVE-2020-36460
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-843
Published: 2021-08-25T20:56:07Z

`Shared` data structure in `model` crate implements `Send` and `Sync` traits regardless of the inner type.
This allows safe Rust code to trigger a data race, which is undefined behavior in Rust.

Users are advised to treat `Shared` as an unsafe type.
It should not be used outside of the testing context,
and care must be taken so that the testing code does not have a data race
besides a race condition that is expected to be caught by the test.
Vulnerability: GHSA-xjjg-vmw6-c2p9
Summary: Open Redirect in httpie
Aliases: CVE-2019-10751
Severity: HIGH
CVSS score: 8.8
CWE: CWE-601
Published: 2019-08-27T17:44:33Z

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
Vulnerability: GHSA-82gw-pqf7-q3j2
Summary: High severity vulnerability that affects pym.js
Aliases: CVE-2018-1000086
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2018-03-13T20:38:51Z

NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. 

https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later.
Vulnerability: GHSA-c8cc-p3j7-4c7f
Summary: Moderate severity vulnerability that affects org.apache.mesos:mesos
Aliases: CVE-2018-8023
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2018-10-17T19:54:14Z

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Vulnerability: GHSA-g996-q5r8-w7g2
Summary: Escape validation messages in the PHP templating engine
Aliases: CVE-2019-10909
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2019-11-12T23:00:53Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
Vulnerability: GHSA-jjpq-gp5q-8q6w
Summary: Cross-site scripting in Apache Tomcat
Aliases: CVE-2019-0221
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-05-30T03:30:42Z

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Vulnerability: GHSA-wcv5-qrj6-9pfm
Summary: Heap buffer overflow in `Conv3DBackprop*`
Aliases: CVE-2021-29520
Severity: LOW
CVSS score: 2.5
CWE: CWE-787, CWE-120
Published: 2021-05-21T14:21:12Z

### Impact
Missing validation between arguments to `tf.raw_ops.Conv3DBackprop*` operations can result in heap buffer overflows:

```python
import tensorflow as tf

input_sizes = tf.constant([1, 1, 1, 1, 2], shape=[5], dtype=tf.int32)
filter_tensor = tf.constant([734.6274508233133, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0,
                            -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0,
                            -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0], shape=[4, 1, 6, 1, 1], dtype=tf.float32)
out_backprop = tf.constant([-10.0], shape=[1, 1, 1, 1, 1], dtype=tf.float32)

tf.raw_ops.Conv3DBackpropInputV2(input_sizes=input_sizes, filter=filter_tensor, out_backprop=out_backprop, strides=[1, 89, 29, 89, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```
```python
import tensorflow as tf

input_values = [-10.0] * (7 * 7 * 7 * 7 * 7)
input_values[0] = 429.6491056791816
input_sizes = tf.constant(input_values, shape=[7, 7, 7, 7, 7], dtype=tf.float32)
filter_tensor = tf.constant([7, 7, 7, 1, 1], shape=[5], dtype=tf.int32)
out_backprop = tf.constant([-10.0, -10.0, -10.0, -10.0, -10.0, -10.0, -10.0], shape=[7, 1, 1, 1, 1], dtype=tf.float32)
  
tf.raw_ops.Conv3DBackpropFilterV2(input=input_sizes, filter_sizes=filter_tensor, out_backprop=out_backprop, strides=[1, 37, 65, 93, 1], padding='VALID', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/4814fafb0ca6b5ab58a09411523b2193fed23fed/tensorflow/core/kernels/conv_grad_shape_utils.cc#L94-L153) assumes that the `input`, `filter_sizes` and `out_backprop` tensors have the same shape, as they are accessed in parallel.

### Patches
We have patched the issue in GitHub commit [8f37b52e1320d8d72a9529b2468277791a261197](https://github.com/tensorflow/tensorflow/commit/8f37b52e1320d8d72a9529b2468277791a261197).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our securityguide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-xv6v-72hh-g6g2
Summary: Moderate severity vulnerability that affects org.owasp.antisamy:antisamy
Aliases: CVE-2018-1000643
Severity: MODERATE
CVSS score: 0
Published: 2018-10-18T17:22:26Z

OWASP OWASP ANTISAMY version 1.5.7 and earlier contains a Cross Site Scripting (XSS) vulnerability in AntiSamy.scan() - for both SAX & DOM that can result in Cross Site Scripting.
Vulnerability: GHSA-4c7h-f2j9-9c46
Summary: Missing permission Phoenix AutoTest Plugin
Aliases: CVE-2022-28158
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-862
Published: 2022-03-30T00:00:21Z

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability: GHSA-m6f7-46hw-grcj
Summary: Critical severity vulnerability that affects cremefraiche
Aliases: CVE-2013-2090
Severity: CRITICAL
CVSS score: 0
CWE: CWE-78
Published: 2017-10-24T18:33:37Z

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.