TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-6mq2-37j5-w6r6
Summary: Moderate severity vulnerability that affects webrick
Aliases: CVE-2009-4492
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Vulnerability: GHSA-vh4p-6j7g-f4j9
Summary: Data races in lock_api
Aliases: CVE-2020-35911
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362
Published: 2021-08-25T20:49:56Z

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness.
Vulnerability: GHSA-rwpr-83g3-96g7
Summary: Cross-site scripting in padrino-contrib
Aliases: CVE-2019-16145
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-09-23T18:33:07Z

The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
Vulnerability: GHSA-xwjr-6fj7-fc6h
Summary: Local File Inclusion by unauthenticated users
Aliases: CVE-2020-15246
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863, CWE-22
Published: 2020-11-23T19:48:12Z

### Impact
An attacker can exploit this vulnerability to read local files on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request.

### Patches
Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

### Workarounds
Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1105" alt="Screen Shot 2020-10-10 at 1 05 19 PM" src="https://user-images.githubusercontent.com/7253840/95663086-4ffc4780-0af9-11eb-9bb6-fd40cf11c033.png">
Vulnerability: GHSA-vgg8-72f2-qm23
Summary: Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2017-7657
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-444, CWE-190
Published: 2018-10-19T16:15:34Z

In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Vulnerability: GHSA-4mg9-vhxq-vm7j
Summary: SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2021-04-29T21:52:53Z

### Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

### Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

### Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.
Vulnerability: GHSA-wxrm-2h86-v95f
Summary: Malicious Package in pizza-pasta
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:04:20Z

Version 1.0.3 of `pizza-pasta` contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from `imgur.com`. The package also printed the users SSH keys to the console.


## Recommendation

Remove the package from your environment. There are no evidences of further compromise.
Vulnerability: GHSA-vgjp-vh3c-32v3
Summary: Directory Traversal in mockserve
Aliases: CVE-2017-16146
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:46:55Z

Affected versions of `mockserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-823f-cwm9-4g74
Summary: Splash authentication credentials potentially leaked to target websites 
Aliases: CVE-2021-41124
Severity: HIGH
CVSS score: 7.4
CWE: CWE-200
Published: 2021-10-06T17:49:23Z

### Impact

If you use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for Splash authentication, any non-Splash request will expose your credentials to the request target. This includes `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`.

### Patches

Upgrade to scrapy-splash 0.8.0 and use the new `SPLASH_USER` and `SPLASH_PASS` settings instead to set your Splash authentication credentials safely.

### Workarounds

If you cannot upgrade, set your Splash request credentials on a per-request basis, [using the `splash_headers` request parameter](https://github.com/scrapy-plugins/scrapy-splash/tree/0.8.x#http-basic-auth), instead of defining them globally using the [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth).

Alternatively, make sure all your requests go through Splash. That includes disabling the [robots.txt middleware](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#topics-dlmw-robots).

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy-plugins/scrapy-splash/issues)
* [Email us](mailto:opensource@zyte.com)
Vulnerability: GHSA-362v-wg5p-64w2
Summary: Incorrect Privilege Assignment in HashiCorp Vault
Aliases: CVE-2021-42135
Severity: HIGH
CVSS score: 8.1
CWE: CWE-863, CWE-266
Published: 2021-10-12T18:41:16Z

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
Vulnerability: GHSA-4w82-r329-3q67
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2020-8840
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-03-04T20:52:14Z

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2  lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Vulnerability: GHSA-fq6p-6334-8gr4
Summary: Memory leak in decoding PNG images
Aliases: CVE-2022-23585
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-401
Published: 2022-02-09T23:26:08Z

### Impact
When [decoding PNG images](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/image/decode_image_op.cc#L322-L416) TensorFlow can produce a memory leak if the image is invalid.
After calling `png::CommonInitDecode(..., &decode)`, the `decode` value contains allocated buffers which can only be freed by calling `png::CommonFreeDecode(&decode)`. However, several error case in the function implementation invoke the `OP_REQUIRES` macro which immediately terminates the execution of the function, without allowing for the memory free to occur.
  
### Patches   
We have patched the issue in GitHub commit [ab51e5b813573dc9f51efa335aebcf2994125ee9](https://github.com/tensorflow/tensorflow/commit/ab51e5b813573dc9f51efa335aebcf2994125ee9).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-f7p5-w2cr-7cp7
Summary: High severity vulnerability that affects puppet
Aliases: CVE-2013-3567
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Vulnerability: GHSA-pjj4-w39g-pw54
Summary: Ox gem crashes due to a crafted input
Aliases: CVE-2017-15928
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2017-11-21T18:26:40Z

In the Ox gem 2.8.0 for Ruby, the process crashes with a segmentation fault when a crafted input is supplied to parse_obj. NOTE: the vendor has stated "Ox should handle the error more gracefully" but has not confirmed a security implication.
Vulnerability: GHSA-x7hc-x7fm-f7qh
Summary: Cross-Site Scripting in Content Preview (CType menu)
Aliases: CVE-2021-21370
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2021-03-23T01:54:17Z

> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.1)
> * CWE-79
> * Status: **DRAFT**

### Problem
It has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-008](https://typo3.org/security/advisory/typo3-core-sa-2021-008)
Vulnerability: GHSA-cvfm-xjc8-f2vm
Summary: Denial of Service in @commercial/subtext
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:46:36Z

Version 5.1.1 of `@commercial/subtext` is vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 5.1.2 or later.
Vulnerability: GHSA-2598-2f59-rmhq
Summary: SQL Injection in sequelize
Aliases: CVE-2019-10749
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-11-08T17:05:17Z

Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

Upgrade to version 3.35.1 or later.
Vulnerability: GHSA-wh33-4p32-g7vh
Summary: Directory Traversal in serverxxx
Aliases: CVE-2017-16182
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:43:56Z

Affected versions of `serverxxx` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-r5gm-4p5w-pq2p
Summary: Remote code execution in verot/class.upload.php
Aliases: CVE-2019-19576
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2020-01-16T22:17:40Z

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
Vulnerability: GHSA-cf4h-3jhx-xvhq
Summary: Arbitrary Code Execution in underscore
Aliases: CVE-2021-23358
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-06T16:09:43Z

The package `underscore` from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Vulnerability: GHSA-f26x-pr96-vw86
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-11040
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-829
Published: 2018-10-16T17:43:45Z

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Vulnerability: GHSA-32pc-xphx-q4f6
Summary: Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers
Aliases: CVE-2018-1000164
Severity: HIGH
CVSS score: 7.5
CWE: CWE-93
Published: 2018-07-12T20:30:49Z

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
Vulnerability: GHSA-4g77-cvgw-grvw
Summary: Prototype Pollution in putil-merge
Aliases: CVE-2021-23470
Severity: HIGH
CVSS score: 8.2
CWE: CWE-1321
Published: 2022-02-05T00:00:31Z

This affects the package putil-merge before 3.8.0. The merge() function does not check the values passed into the argument. An attacker can supply a malicious value by adjusting the value to include the constructor property. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-PUTILMERGE-1317077
Vulnerability: GHSA-jmhj-vh4q-hhmq
Summary: tkvideo has a memory issue in playing videos
Aliases: CVE-2022-24902
Severity: HIGH
CVSS score: 0
Published: 2022-05-03T03:47:34Z

Huge memory consumption even when playing small files. This issue has been patched in 2.0.0. Please upgrade to version 2.0.0 or above.
Vulnerability: GHSA-cq8r-fc3q-6hg2
Summary: Denial of Service (DoS) via the unsetByPath function in jsjoints
Aliases: CVE-2020-28479
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-13T15:29:40Z

The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
Vulnerability: GHSA-v7ff-8wcx-gmc5
Summary: Authorization Before Parsing and Canonicalization in jetty
Aliases: CVE-2021-28164
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-551, CWE-863
Published: 2021-04-06T17:31:01Z

Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours.   The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory.  For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file.  This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating `start.d/http.ini` to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.
Vulnerability: GHSA-8m3r-rv5g-fcpq
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2011-0697
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-23T21:01:00Z

Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.
Vulnerability: GHSA-vx6f-6rp6-f2px
Summary: Cross-Site Request Forgery in Jenkins dbCharts Plugin
Aliases: CVE-2022-25205
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-02-16T00:01:17Z

A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance.
Vulnerability: GHSA-269q-hmxg-m83q
Summary: Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Aliases: CVE-2022-24823
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-379, CWE-668, CWE-378
Published: 2022-05-10T08:46:50Z

### Description ###
[GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified.

### Impact ###

When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.

This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.

### Vulnerability Details ###

To fix the vulnerability the code was changed to the following:

```java
    @SuppressJava6Requirement(reason = "Guarded by version check")
    public static File createTempFile(String prefix, String suffix, File directory) throws IOException {
        if (javaVersion() >= 7) {
            if (directory == null) {
                return Files.createTempFile(prefix, suffix).toFile();
            }
            return Files.createTempFile(directory.toPath(), prefix, suffix).toFile();
        }
        if (directory == null) {
            return File.createTempFile(prefix, suffix);
        }
        File file = File.createTempFile(prefix, suffix, directory);
        // Try to adjust the perms, if this fails there is not much else we can do...
        file.setReadable(false, false);
        file.setReadable(true, true);
        return file;
    }
```

Unfortunately, this logic path was left vulnerable:

```java
        if (directory == null) {
            return File.createTempFile(prefix, suffix);
        }
```

This file is still readable by all local users.

### Patches ###

Update to 4.1.77.Final

### Workarounds ###

Specify your own `java.io.tmpdir` when you start the JVM or use `DefaultHttpDataFactory.setBaseDir(...)` to set the directory to something that is only readable by the current user or update to Java 7 or above.

### References ###

 - [CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)
 - [CWE-379: Creation of Temporary File in Directory with Insecure Permissions](https://cwe.mitre.org/data/definitions/379.html)


### For more information ###

If you have any questions or comments about this advisory:

Open an issue in [netty](https://github.com/netty/netty)
Vulnerability: GHSA-p4mf-4qvh-w8g5
Summary: Malicious Package in bitcionjslib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:41:42Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6495-8jvh-f28x
Summary: File restriction bypass in socket.io-file
Severity: HIGH
CVSS score: 7.8
CWE: CWE-20
Published: 2020-10-02T15:39:54Z

All versions of `socket.io-file`are vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the `name` value to upload any file types.

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-rwcq-qpm6-7867
Summary: Malicious Package in riped160
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:04:32Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hpr6-f4vq-mxch
Summary: Command injection in LocalStack
Aliases: CVE-2021-32090
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-77
Published: 2021-06-18T18:38:00Z

The dashboard component of StackLift LocalStack allows attackers to inject arbitrary shell commands via the functionName parameter.
Vulnerability: GHSA-phg2-9c5g-m4q7
Summary: Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-17190
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-11-21T22:19:30Z

In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.

# Mitigation
Enable authentication on any Spark standalone cluster that is not otherwise secured from unwanted access, for example by network-level restrictions. Use spark.authenticate and related security properties described at https://spark.apache.org/docs/latest/security.html
Vulnerability: GHSA-v98r-gjgc-m9pf
Summary: Cross-site Scripting in Jenkins Promoted Builds Plugin
Aliases: CVE-2022-29045
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-13T00:00:16Z

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-72q2-5rxx-xfff
Summary: Downloads Resources over HTTP in gfe-sass
Aliases: CVE-2017-16040
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:12:12Z

Affected versions of `gfe-sass` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `gfe-sass`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-8qpm-5c82-rf96
Summary: Prototype Pollution in backbone-query-parameters
Aliases: CVE-2021-20085
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2021-05-06T15:52:02Z

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicious user to inject properties into Object.prototype.
Vulnerability: GHSA-qvp5-mm7v-4f36
Summary: Cross-site Scripting in Strapi
Aliases: CVE-2020-27666
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-10-29T19:40:08Z

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
Vulnerability: GHSA-7rp6-w7mg-h8rw
Summary: XML External Entity Reference in Apache Jena
Aliases: CVE-2021-39239
Severity: HIGH
CVSS score: 0
CWE: CWE-611
Published: 2021-09-20T20:22:05Z

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
Vulnerability: GHSA-jj6m-r8jc-2gp7
Summary: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings 
Aliases: CVE-2021-32699
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-405
Published: 2021-06-23T18:03:18Z

### Impact
All versions of Pterodactyl Wings preior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding.

### Patches
Users should upgrade to `1.4.4`.

### Workarounds
There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.

### For more information
If you have any questions or comments about this advisory:
* Contact us on [Discord](https://discord.gg/pterodactyl)
* Email us at `dane ät pterodactyl dot io`
Vulnerability: GHSA-7wjx-3g7j-8584
Summary: Denial of Service in Action Controller Token Authentication
Aliases: CVE-2021-22904
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-05T19:49:12Z

Impact
------
Impacted code uses `authenticate_or_request_with_http_token` or
`authenticate_with_http_token` for request authentication.  Impacted code will
look something like this:

```
class PostsController < ApplicationController
  before_action :authenticate

  private

  def authenticate
    authenticate_or_request_with_http_token do |token, options|
      # ...
    end
  end
end
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
The following monkey patch placed in an initializer can be used to work around
the issue:

```ruby
module ActionController::HttpAuthentication::Token
  AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 5-2-http-authentication-dos.patch - Patch for 5.2 series
* 6-0-http-authentication-dos.patch - Patch for 6.0 series
* 6-1-http-authentication-dos.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.

Credits
-------
Thank you to https://hackerone.com/wonda_tea_coffee for reporting this issue!
Vulnerability: GHSA-86gw-g9jv-8vfg
Summary:  Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0833
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:57:55Z

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0848.
Vulnerability: GHSA-7r83-w6r8-fh6w
Summary: Reflected Cross-site Scripting (XSS) in ACS Commons
Aliases: CVE-2021-21043
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-787, CWE-79
Published: 2021-05-13T22:31:14Z

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.
Vulnerability: GHSA-fhvj-7f9p-w788
Summary: Buffer overflow in arr
Aliases: CVE-2020-35887
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-120
Published: 2021-08-25T20:48:54Z

An issue was discovered in the arr crate through 2020-08-25 for Rust. There is a buffer overflow in Index and IndexMut.
Vulnerability: GHSA-rwqq-p4p9-5wpq
Summary: Wechat-php-sdk is affected by a Cross Site Scripting vulnerability.
Aliases: CVE-2021-43678
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-07T00:00:29Z

Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.
Vulnerability: GHSA-q7j5-9j77-g4gq
Summary: Remote code execution in turn extension for TYPO3
Aliases: CVE-2020-15515
Severity: HIGH
CVSS score: 8.8
CWE: CWE-74
Published: 2020-07-29T18:07:41Z

The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.
Vulnerability: GHSA-qc22-qwm9-j8rx
Summary: Remote Code Execution in npm-groovy-lint
Severity: CRITICAL
CVSS score: 0
CWE: CWE-20
Published: 2021-12-20T16:59:31Z

Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable.
Vulnerability: GHSA-p6jh-p7q8-pcrg
Summary: Prototype Pollution in nodee-utils
Aliases: CVE-2020-7722
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:26:21Z

All versions of package nodee-utils below version 1.2.3 are vulnerable to Prototype Pollution via the deepSet function.
Vulnerability: GHSA-xwr3-fmgj-mmfr
Summary: Moderate severity vulnerability that affects bio-basespace-sdk
Aliases: CVE-2013-7111
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

The put_call function in the API client (api/api_client.rb) in the BaseSpace Ruby SDK (aka bio-basespace-sdk) gem 0.1.7 for Ruby uses the API_KEY on the command line, which allows remote attackers to obtain sensitive information by listing the processes.
Vulnerability: GHSA-566m-qj78-rww5
Summary: Regular Expression Denial of Service in postcss
Aliases: CVE-2021-23382
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-01-07T00:21:36Z

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).
Vulnerability: GHSA-p99v-5w3c-jqq9
Summary: Bypass of access control in Django
Aliases: CVE-2021-33571
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2021-06-10T17:21:12Z

In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .
Vulnerability: GHSA-9gqg-3fxr-9hv7
Summary: Cross site scripting in apache-airflow
Aliases: CVE-2017-17836
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-79
Published: 2019-01-25T16:19:09Z

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.
Vulnerability: GHSA-cqqh-49mx-fq63
Summary: Prototype Pollution in merge
Aliases: CVE-2021-3645
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-1321, CWE-915
Published: 2021-09-13T20:16:54Z

merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-265q-28rp-chq5
Summary: Insecure Entropy Source - Math.random() in node-uuid
Aliases: CVE-2015-8851
Severity: HIGH
CVSS score: 7.5
CWE: CWE-331
Published: 2020-04-16T03:14:50Z

Affected versions of `node-uuid` consistently fall back to using `Math.random` as an entropy source instead of `crypto`, which may result in guessable UUID's.



## Recommendation

Update to version 1.4.4 or later.
Vulnerability: GHSA-m6rw-m2v9-7hx4
Summary: OS Command Injection in wifiscanner
Aliases: CVE-2020-15362
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-17T21:00:59Z

wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code.
Vulnerability: GHSA-59cf-m7v5-wh5w
Summary: Cross-Site Scripting in SVG Sanitizer
Aliases: CVE-2020-11070
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-05-13T22:17:34Z

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting.

An updated version 1.0.3 is available from the TYPo3 extension manager and at https://extensions.typo3.org/extension/download/svg_sanitizer/1.0.3/zip/
Users of the extension are advised to update the extension as soon as possible.
Vulnerability: GHSA-3xph-cp8f-2229
Summary: Prototype Pollution in @fabiocaccamo/utils.js
Aliases: CVE-2021-3815
Severity: HIGH
CVSS score: 8
CWE: CWE-1321
Published: 2021-12-10T20:31:32Z

utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Vulnerability: GHSA-h7qw-mxrm-c6h2
Summary: Unauthenticated crypto and weak IV in Magento\Framework\Encryption
Aliases: CVE-2016-6485
Severity: HIGH
CVSS score: 7.5
CWE: CWE-327
Published: 2019-11-20T01:33:05Z

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
Vulnerability: GHSA-97cc-825c-399g
Summary: Cross site scripting in remdex/livehelperchat
Aliases: CVE-2021-4050
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-10T20:33:29Z

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-cff4-rrq6-h78w
Summary: Command Injection in command-exists
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2019-06-03T17:31:26Z

Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.


## Recommendation

Update to version 1.2.4 or later.
Vulnerability: GHSA-9gqr-xp86-f87h
Summary: Code injection in npm git
Aliases: CVE-2021-23632
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-94, CWE-78
Published: 2022-03-18T00:01:11Z

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.
Vulnerability: GHSA-qc84-gqf4-9926
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utils
Aliases: CVE-2022-23639
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119, CWE-362
Published: 2022-02-16T22:36:21Z

### Impact

The affected version of this crate incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. 

However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`.

This can cause the following problems:

- Unaligned memory accesses
- Data race

Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue.

32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue.
32-bit targets with `Atomic{I,U}64` and `{i,u}64` have the same alignment are also not affected by this issue.

The following is a complete list of the builtin targets that may be affected. (last update: nightly-2022-02-11)

- armv7-apple-ios (tier 3)
- armv7s-apple-ios (tier 3)
- i386-apple-ios (tier 3)
- i586-unknown-linux-gnu
- i586-unknown-linux-musl
- i686-apple-darwin (tier 3)
- i686-linux-android
- i686-unknown-freebsd
- i686-unknown-haiku (tier 3)
- i686-unknown-linux-gnu
- i686-unknown-linux-musl
- i686-unknown-netbsd (tier 3)
- i686-unknown-openbsd (tier 3)
- i686-wrs-vxworks (tier 3)

([script to get list](https://gist.github.com/taiki-e/3c7891e8c5f5e0cbcb44d7396aabfe10))

### Patches

This has been fixed in crossbeam-utils 0.8.7.

Affected 0.8.x releases have been yanked.

### References

https://github.com/crossbeam-rs/crossbeam/pull/781
Vulnerability: GHSA-xrjf-phvv-r4vr
Summary: Command injection in strapi
Aliases: CVE-2022-0764
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-77, CWE-78
Published: 2022-02-27T00:00:15Z

When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular [link](https://github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.js#L13), this happens due to improper sanitization of user input.
Vulnerability: GHSA-567x-m4wm-87v8
Summary: Infinite loop in Apache Tika
Aliases: CVE-2021-28657
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835, CWE-400
Published: 2021-05-10T15:23:25Z

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.
Vulnerability: GHSA-m5vx-8chx-qvmm
Summary: Form validation can be skipped
Aliases: CVE-2021-32697
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2021-06-22T15:15:08Z

### Impact
By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators.
We consider the severity _low_ because it is not possible to _change_ any form values since the form state is secured with an HMAC that is still verified.
That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent.

### Patches
https://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246

### Workarounds
Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data.
Alternatively a custom Finisher can be added as first finisher.

### References
This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567
Original report: https://tickets.neos.io/#ticket/zoom/411 (internal)
Vulnerability: GHSA-c5hx-w945-j4pq
Summary: Memory flaw in zeroize_derive
Aliases: CVE-2021-45706
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-01-06T22:08:33Z

An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
Vulnerability: GHSA-gp6m-vqhm-5cm5
Summary: XML Entity Expansion
Aliases: CVE-2021-25951
Severity: HIGH
CVSS score: 7.5
CWE: CWE-776, CWE-611
Published: 2021-07-02T18:37:31Z

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references.
Vulnerability: GHSA-pf8j-vhg8-xmc3
Summary: Injection in karma-mojo
Aliases: CVE-2020-7626
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:42:58Z

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.
Vulnerability: GHSA-wg85-p6j7-gp3w
Summary: Moderate severity vulnerability that affects simplemde
Aliases: CVE-2018-19057
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-21T22:21:25Z

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
Vulnerability: GHSA-jmxr-w2jc-qp7w
Summary: Improper Input Validation in Jenkins Promoted Builds Plugin
Aliases: CVE-2022-29049
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20
Published: 2022-04-13T00:00:16Z

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions defined in Job DSL, allowing attackers with Job/Configure permission to create a promotion with an unsafe name.
Vulnerability: GHSA-wx3q-6x7x-jjw4
Summary: Downloads Resources over HTTP in mystem
Aliases: CVE-2016-10664
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:39Z

Affected versions of `mystem` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-q2xp-75m7-gv52
Summary: Moderate severity vulnerability that affects net.sf.robocode:robocode.api
Aliases: CVE-2019-10648
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-862, CWE-20
Published: 2019-04-02T15:36:49Z

Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
Vulnerability: GHSA-3hfw-x7gx-437c
Summary: Path traversal in Matrix Synapse
Aliases: CVE-2021-41281
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-11-23T21:58:56Z

### Impact

Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory, potentially outside the media store directory.

The last two directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact.

Homeservers with the media repository disabled are unaffected. Homeservers configured with a federation whitelist are also unaffected.

### Patches
Server administrators should upgrade to 1.47.1 or later.

### Workarounds
Server administrators using a reverse proxy could, at the expense of losing media functionality, block the following endpoints:

* `/_matrix/media/r0/download/{serverName}/{mediaId}`
* `/_matrix/media/r0/download/{serverName}/{mediaId}/{fileName}`
* `/_matrix/media/r0/thumbnail/{serverName}/{mediaId}`

Alternatively, non-containerized deployments can be adapted to use the hardened systemd config, located at `contrib/systemd/override-hardened.conf`.

### References
n/a

### For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Vulnerability: GHSA-2jfv-g3fh-xq3v
Summary: Excessive memory usage in tokio-rustls
Aliases: CVE-2020-35875
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-08-25T20:46:54Z

An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. Excessive memory usage may occur when data arrives quickly.
Vulnerability: GHSA-h5wh-7h2j-h999
Summary: Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon
Aliases: CVE-2022-27817
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-668
Published: 2022-04-15T00:00:40Z

SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.
Vulnerability: GHSA-mrvj-7q4f-5p42
Summary: Cross-site scripting in eZ Platform Kernel
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2021-03-19T19:56:42Z

### Impact
In file upload it is possible by certain means to upload files like .html and .js. These may contain XSS exploits which will be run when links to them are accessed by victims.

### Patches
The fix consists simply of adding common types of scriptable file types to the configuration of the already existing filetype blacklist feature. See "Patched versions". As such, this can also be done manually, without installing the patched versions. This may be relevant if you are currently running a considerably older version of the kernel package and don't want to upgrade it at this time. Please see the settting "ezsettings.default.io.file_storage.file_type_blacklist" at:
https://github.com/ezsystems/ezplatform-kernel/blob/master/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml#L109

### Important note
You should adapt this setting to your needs. Do not add file types to the blacklist that you actually need to be able to upload. For instance, if you need your editors to be able to upload SVG files, then don't blacklist that. Instead, you could e.g. use an approval workflow for such content.
Vulnerability: GHSA-vcjf-mgcg-jxjq
Summary: Cross-site Scripting in CKEditor 4.0
Aliases: CVE-2020-9281
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-07T16:32:17Z

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Vulnerability: GHSA-jj8r-p9f5-fmvv
Summary: Cross-site Scripting in TYPO3 extension
Aliases: CVE-2021-36785
Severity: MODERATE
CVSS score: 8.5
CWE: CWE-79
Published: 2021-08-30T17:22:25Z

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.