TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-j7px-6hwj-hpjg
Summary: Open Redirect in OAuth2 Proxy
Aliases: CVE-2020-11053
Severity: HIGH
CVSS score: 7.1
CWE: CWE-601
Published: 2021-12-20T17:59:10Z

### Impact
As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access.
This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites.

However, by crafting a redirect URL with HTML encoded whitespace characters (eg. `%0a`, `%0b`,`%09`,`%0d`) the validation could be bypassed and allow a redirect to any URL provided.

### Patches
@rootxharsh and @iamnoooob provided this patch as potential solution:
```
From 4b941f56eda310b5c4dc8080b7635a6bfabccad4 Mon Sep 17 00:00:00 2001
From: Harsh Jaiswal <harsh@pop-os.localdomain>
Date: Fri, 1 May 2020 20:38:31 +0530
Subject: [PATCH] Fixes redirect issue

---
 oauthproxy.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/oauthproxy.go b/oauthproxy.go
index 1e9bb7c..f8beb4d 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -577,8 +577,9 @@ func validOptionalPort(port string) bool {

 // IsValidRedirect checks whether the redirect URL is whitelisted
 func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
+       matched, _ := regexp.MatchString(`^/\s+/|\\`, redirect)
        switch {
-       case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"):
+       case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !matched:
                return true
        case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
                redirectURL, err := url.Parse(redirect)
--
2.17.1
```

This issue was also reported to us separately by @mik317 several hours later

The fix was implemented in [#xxx]() and released as version 5.1.1
Vulnerability: GHSA-86fh-j58m-7pf5
Summary: Improper Privilege Management in Apache Ozone
Aliases: CVE-2021-36372
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-273
Published: 2021-11-23T17:57:14Z

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Vulnerability: GHSA-jr34-mff8-pc6f
Summary: SQL Injection in Cloud Native Computing Foundation Harbor
Aliases: CVE-2019-19029
Severity: MODERATE
CVSS score: 7.2
CWE: CWE-89
Published: 2021-05-18T18:27:36Z

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability: GHSA-prg5-hg25-8grq
Summary: Ability to switch channels via GET parameter enabled in production environments
Aliases: CVE-2020-5218
Severity: LOW
CVSS score: 4.4
CWE: CWE-444
Published: 2020-01-31T18:00:58Z

### Impact

This vulnerability gives the ability to switch channels via the `_channel_code` GET parameter in production environments. This was meant to be enabled only when `%kernel.debug%` is set to true. 

However, if no `sylius_channel.debug` is set explicitly in the configuration, the default value which is `%kernel.debug%` will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false.

### Patches

Patch has been provided for Sylius 1.3.x and newer - **1.3.16, 1.4.12, 1.5.9, 1.6.5**. Versions older than 1.3 are not covered by our security support anymore.

### Workarounds

Unsupported versions could be patched by adding the following configuration to run in production:

```yaml
sylius_channel:
    debug: false
```
Vulnerability: GHSA-hwvq-6gjx-j797
Summary: Special Element Injection in notebook
Aliases: CVE-2021-32798
Severity: CRITICAL
CVSS score: 10
CWE: CWE-79
Published: 2021-08-23T19:40:38Z

### Impact

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

### Patches

5.7.11, 6.4.1

### References

[OWASP Page on Injection Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html#injection-prevention-rules)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google


### Example:

A notebook with the following content in a cell and it would display an alert when opened for the first time in Notebook (in an untrusted state):

```
{ "cell_type": "code", "execution_count": 0, "metadata": {}, "outputs": [ { "data": { "text/html": [ "<select><iframe></select><img src=x: onerror=alert('xss')>\n"], "text/plain": [] }, "metadata": {}, "output_type": "display_data" } ], "source": [ "" ] }
````
Vulnerability: GHSA-m3q7-rj8g-m457
Summary: Moderate severity vulnerability that affects ember-source
Aliases: CVE-2015-7565
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-08-28T22:33:24Z

Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.
Vulnerability: GHSA-75cq-g75g-rxff
Summary: use-after-free vulnerability in Rust array-queue
Aliases: CVE-2020-35900
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-416
Published: 2021-08-25T21:00:43Z

An issue was discovered in the array-queue crate through 2020-09-26 for Rust. A pop_back() call may lead to a use-after-free.
Vulnerability: GHSA-q7pf-qr96-2vq5
Summary: Moderate severity vulnerability that affects io.swagger:swagger-codegen and io.swagger:swagger-parser
Aliases: CVE-2017-1000208
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2018-10-19T16:46:41Z

A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Vulnerability: GHSA-6gv8-p3vj-pxvr
Summary: Null pointer dereference in `UncompressElement`
Aliases: CVE-2021-37649
Severity: HIGH
CVSS score: 7.7
CWE: CWE-476
Published: 2021-08-25T14:43:27Z

### Impact
The code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference: 

```python
import tensorflow as tf

data = tf.data.Dataset.from_tensors([0.0])
tf.raw_ops.UncompressElement(
  compressed=tf.data.experimental.to_variant(data),
  output_types=[tf.int64],
  output_shapes=[2])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/data/experimental/compression_ops.cc#L50-L53) obtains a pointer to a `CompressedElement` from a `Variant` tensor and then proceeds to dereference it for decompressing. There is no check that the `Variant` tensor contained a `CompressedElement`, so the pointer is actually `nullptr`.

### Patches
We have patched the issue in GitHub commit [7bdf50bb4f5c54a4997c379092888546c97c3ebd](https://github.com/tensorflow/tensorflow/commit/7bdf50bb4f5c54a4997c379092888546c97c3ebd).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-x8h6-xgqx-jqgp
Summary: Undefined behavior and `CHECK`-fail in `FractionalMaxPoolGrad`
Aliases: CVE-2021-29580
Severity: LOW
CVSS score: 2.5
CWE: CWE-908
Published: 2021-05-21T14:26:26Z

### Impact
The implementation of `tf.raw_ops.FractionalMaxPoolGrad` triggers an undefined behavior if one of the input tensors is empty:

```python
import tensorflow as tf

orig_input = tf.constant([2, 3], shape=[1, 1, 1, 2], dtype=tf.int64)
orig_output = tf.constant([], dtype=tf.int64) 
out_backprop = tf.zeros([2, 3, 6, 6], dtype=tf.int64)
row_pooling_sequence = tf.constant([0], shape=[1], dtype=tf.int64)
col_pooling_sequence = tf.constant([0], shape=[1], dtype=tf.int64)

tf.raw_ops.FractionalMaxPoolGrad(
  orig_input=orig_input, orig_output=orig_output, out_backprop=out_backprop,
  row_pooling_sequence=row_pooling_sequence,
  col_pooling_sequence=col_pooling_sequence, overlapping=False)
```

The code is also vulnerable to a denial of service attack as a `CHECK` condition becomes false and aborts the process

```python
import tensorflow as tf

orig_input = tf.constant([1], shape=[1], dtype=tf.int64)
orig_output = tf.constant([1], shape=[1], dtype=tf.int64)
out_backprop = tf.constant([1, 1], shape=[2, 1, 1, 1], dtype=tf.int64)
row_pooling_sequence = tf.constant([1], shape=[1], dtype=tf.int64) 
col_pooling_sequence = tf.constant([1], shape=[1], dtype=tf.int64)

tf.raw_ops.FractionalMaxPoolGrad(
  orig_input=orig_input, orig_output=orig_output, out_backprop=out_backprop,
  row_pooling_sequence=row_pooling_sequence,
  col_pooling_sequence=col_pooling_sequence, overlapping=False)
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/169054888d50ce488dfde9ca55d91d6325efbd5b/tensorflow/core/kernels/fractional_max_pool_op.cc#L215) fails to validate that input and output tensors are not empty and are of the same rank. Each of these unchecked assumptions is responsible for the above issues.

### Patches
We have patched the issue in GitHub commit [32fdcbff9d06d010d908fcc4bd4b36eb3ce15925](https://github.com/tensorflow/tensorflow/commit/32fdcbff9d06d010d908fcc4bd4b36eb3ce15925).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-64gv-qg2v-vxv6
Summary: Array size is not checked in sized-chunks
Aliases: CVE-2020-25793
Severity: HIGH
CVSS score: 7.5
CWE: CWE-129
Published: 2021-08-25T20:45:04Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with From<InlineArray<A, T>>.
Vulnerability: GHSA-43f8-p5w3-5m25
Summary: SSRF by connecting to privileged ports
Aliases: CVE-2018-7667
Severity: MODERATE
CVSS score: 0
CWE: CWE-918
Published: 2021-02-11T21:20:40Z

### Impact
All users are affected.

### Patches
* Unsuccessfully patched by 0fae40fb, included in version [4.4.0](https://github.com/vrana/adminer/releases/tag/v4.4.0).
* Patched by 35bfaa75, included in version [4.7.8](https://github.com/vrana/adminer/releases/tag/v4.7.8).

### Workarounds
Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).

### References
* http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt
* https://sourceforge.net/p/adminer/bugs-and-features/769/
* https://gusralph.info/adminer-ssrf-bypass-cve-2018-7667/ (CVE-2020-28654)

### For more information
If you have any questions or comments about this advisory:
* Comment at 35bfaa75.
Vulnerability: GHSA-hf64-x4gq-p99h
Summary: Out-of-bounds Read
Aliases: CVE-2020-35655
Severity: HIGH
CVSS score: 5.4
CWE: CWE-125
Published: 2021-03-18T19:55:34Z

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
Vulnerability: GHSA-g8j8-mgh9-q77p
Summary: File upload leading to RCE in MCMS
Aliases: CVE-2021-46036
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2022-02-19T00:01:25Z

An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
Vulnerability: GHSA-wm77-q74p-5763
Summary: Path Traversal in superstatic
Severity: HIGH
CVSS score: 0
CWE: CWE-177
Published: 2018-07-27T17:06:03Z

Affected of `superstatic` are vulnerable to path traversal when used on Windows. 

Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).


## Recommendation

Update to version 5.0.2 or later.
Vulnerability: GHSA-x88j-93vc-wpmp
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2011-4136
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2018-07-23T19:52:39Z

django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
Vulnerability: GHSA-753c-phhg-cj29
Summary: Improper Neutralization of Special Elements used in a Command
Aliases: CVE-2021-23352
Severity: HIGH
CVSS score: 0
CWE: CWE-89, CWE-77
Published: 2021-03-12T23:01:49Z

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath option parameter which when the .image(), .svg() or .dot() functions are called, is executed by the childprocess.exec function.
Vulnerability: GHSA-fm9p-5m9f-rq85
Summary: Out-of-bounds write
Aliases: CVE-2019-0915
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:03Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-xfv3-rrfm-f2rv
Summary: Information Exposure in Netty
Aliases: CVE-2015-2156
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2020-06-30T21:01:21Z

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Vulnerability: GHSA-hwpc-8xqv-jvj4
Summary: XStream is vulnerable to a Remote Command Execution attack
Aliases: CVE-2021-21345
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-94
Published: 2021-03-22T23:28:38Z

### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21345](https://x-stream.github.io/CVE-2021-21345.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-mh74-4m5g-fcjx
Summary: Malicious users could control the content of invitation emails
Aliases: CVE-2021-29432
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-04-19T14:54:24Z

### Impact

A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example.

### Patches

Fixed in 4469d1d, 6b405a8, 65a6e91.

Note that these patches include changes to the *default* email templates. If these templates have been locally modified, they must also be updated.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: GHSA-9fcc-7g44-mxrj
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0942
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via uploading files with files in `.xsd`, `.asa`, and `.aspx` formats.
Vulnerability: GHSA-f522-ffg8-j8r6
Summary: Regular Expression Denial of Service in is-my-json-valid
Aliases: CVE-2016-2537
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2017-10-24T18:33:35Z

Version of `is-my-json-valid` before 1.4.1 or 2.17.2 are vulnerable to regular expression denial of service (ReDoS) via the email validation function.


## Recommendation

Update to version 1.4.1, 2.17.2 or later.
Vulnerability: GHSA-g8jx-66p8-vcm2
Summary: SQL injection in pimcore/pimcore
Aliases: CVE-2021-23405
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2021-07-13T17:42:31Z

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
Vulnerability: GHSA-m56g-3g8v-2rxw
Summary: XSS in Adminer
Aliases: CVE-2020-35572
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-02-11T20:46:53Z

**Withdrawn:** Duplicate of GHSA-9pgx-gcph-mpqr.

Adminer before 4.7.9 allows XSS via the history parameter to the default URI.
Vulnerability: GHSA-m434-m5pv-p35w
Summary: Insufficient user authorization in Moodle
Aliases: CVE-2022-0333
Severity: LOW
CVSS score: 3.8
CWE: CWE-863
Published: 2022-01-28T22:08:02Z

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Vulnerability: GHSA-mx9f-w8qq-q5jf
Summary: Low severity vulnerability that affects rest-client
Aliases: CVE-2015-3448
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log.
Vulnerability: GHSA-v8w9-2789-6hhr
Summary: Deserialization of Untrusted Data in bson
Aliases: CVE-2020-7610
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2021-05-07T16:04:54Z

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.
Vulnerability: GHSA-qv32-7r6p-xhhh
Summary: Moderate severity vulnerability that affects com.adobe.xmp:xmpcore
Aliases: CVE-2016-4216
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-19T16:39:29Z

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability: GHSA-h289-x5wc-xcv8
Summary: Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket
Severity: MODERATE
CVSS score: 0
CWE: CWE-295
Published: 2022-02-16T22:56:21Z

### Impact

If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults. When looking up a WSS endpoint using the DNS TXT record method described in [XEP-0156: Discovering Alternative XMPP Connection Methods](https://xmpp.org/extensions/xep-0156.html) the ServerName field was incorrectly being set to the name of the server returned by the TXT record request, not the name of the initial server we were attempting to connect to. This means that any attacker that can spoof a DNS record (ie. in the absence of DNSSEC, DNS-over-TLS, DNS-over-HTTPS, or similar technologies) could redirect the user to a server of their choosing and as long as it had a valid TLS certificate for itself the connection would succeed, resulting in a MITM situation.

### Patches

All users should upgrade to v0.21.1.

### Workarounds

To work around the issue, manually specify a TLS configuration with the correct hostname.

### References

- https://mellium.im/cve/cve-2022-24968/
- https://nvd.nist.gov/vuln/detail/CVE-2022-24968

### For more information

If you have any questions or comments about this advisory:
* Reach out on XMPP to [sam@samwhited.com](xmpp:sam@samwhited.com?msg)
* Email us at [sam@samwhited.com](mailto:sam@samwhited.com)
Vulnerability: GHSA-crv7-7245-f45f
Summary: Improper Handling of Length Parameter Inconsistency in Compress
Aliases: CVE-2021-35516
Severity: HIGH
CVSS score: 7.5
CWE: CWE-130, CWE-770
Published: 2021-08-02T16:55:15Z

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Vulnerability: GHSA-7hmh-8gwv-mfvq
Summary: SQL Injection in Kylin
Aliases: CVE-2020-1937
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-89
Published: 2020-07-27T22:51:47Z

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
Vulnerability: GHSA-xw4p-crpj-vjx2
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-39152
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502, CWE-918
Published: 2021-08-25T14:46:59Z

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39152](https://x-stream.github.io/CVE-2021-39152.html).

### Credits
m0d9 of the Security Team of Alibaba Cloud found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-cfx7-2xpc-8w4h
Summary: Division by zero in TFLite's implementation of `BatchToSpaceNd`
Aliases: CVE-2021-29593
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:27:01Z

### Impact
The implementation of the `BatchToSpaceNd` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/b5ed552fe55895aee8bd8b191f744a069957d18d/tensorflow/lite/kernels/batch_to_space_nd.cc#L81-L82):

```cc
TF_LITE_ENSURE_EQ(context, output_batch_size % block_shape[dim], 0);
output_batch_size = output_batch_size / block_shape[dim];
```

An attacker can craft a model such that one dimension of the `block` input is 0. Hence, the corresponding value in `block_shape` is 0.

### Patches
We have patched the issue in GitHub commit [2c74674348a4708ced58ad6eb1b23354df8ee044](https://github.com/tensorflow/tensorflow/commit/2c74674348a4708ced58ad6eb1b23354df8ee044).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-89v2-g37m-g3ff
Summary: Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli
Severity: MODERATE
CVSS score: 0
CWE: CWE-347
Published: 2021-06-01T21:18:53Z

### Impact

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. 

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. 

For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to process per message. This configuration provides customers with a way to limit the number of AWS KMS Decrypt API calls that the ESDK will make per message. This setting will reject messages with more EDKs than the configured limit.

Finally, this update adds early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.

### Patches

Fixed in versions 1.9 and 2.2. We recommend that all users upgrade to address these issues.

Customers leveraging the ESDK’s streaming features have several options to protect signature validation. One is to ensure that client code reads to the end of the stream before using released plaintext. With this release, using the new API for streaming and falling back to the non-streaming decrypt API for signed messages prevents using any plaintext from signed data before the signature is validated. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

Users processing ESDK messages from untrusted sources should use the new maximum encrypted data keys parameter. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

### Workarounds

None

### For more information

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#digital-sigs

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x
Vulnerability: GHSA-8ffc-79xg-29w8
Summary: Code Injection in Apache Cassandra
Aliases: CVE-2021-44521
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-94
Published: 2022-02-12T00:00:48Z

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Vulnerability: GHSA-qr28-7j6p-9hmv
Summary: Content Injection via TileJSON attribute in mapbox.js
Aliases: CVE-2017-1000042
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-09T17:47:45Z

Versions 1.x prior to 1.6.5 and 2.x prior to 2.1.7 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.tileLayer` are used to load untrusted TileJSON content from a non-Mapbox URL, it is possible for a malicious user with control over the TileJSON content to inject script content into the "attribution" value of the TileJSON which will be executed in the context of the page using Mapbox.js.



## Recommendation

Version 2.x: Update to version 2.1.7 or later.
Version 1.x: Update to version 1.6.5 or later.
Vulnerability: GHSA-gf7x-2j2x-7f73
Summary: Missing authorization in xwiki-platform
Aliases: CVE-2022-23617
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-862
Published: 2022-02-09T21:41:46Z

### Impact

Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page.

### Patches

It has been patched in XWiki 13.2CR1 and 12.10.6

### Workarounds

There is no workaround beside patching.

### References

https://jira.xwiki.org/browse/XWIKI-18430

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-jf43-3v8j-qwwr
Summary: Data races in multiqueue
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T20:59:56Z

Affected versions of multiqueue unconditionally implemented `Send` for types used in queue implementations (`InnerSend<RW, T>`, `InnerRecv<RW, T>`, `FutInnerSend<RW, T>`, `FutInnerRecv<RW, T>`).

This allows users to send non-Send types to other threads, which can lead to data race bugs or other undefined behavior.
Vulnerability: GHSA-q43c-g2g7-6gxj
Summary: Cross-Site Request Forgery (CSRF) in keystone
Aliases: CVE-2017-16570
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2017-11-30T23:14:47Z

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Request Forgery (CSRF). The package fails to validate the presence of the `X-CSRF-Token` header, which may allow attackers to carry actions on behalf of other users on all endpoints.


## Recommendation

Update to version 4.0.0 or later.
Vulnerability: GHSA-pch5-whg9-qr2r
Summary: netmask npm package vulnerable to octal input data
Aliases: CVE-2021-29418
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-03-29T21:32:05Z

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. This (in some situations) allows attackers to bypass access control that is based on IP addresses. NOTE: this issue exists because of an incomplete fix for CVE-2021-28918.
Vulnerability: GHSA-mj63-64x7-57xf
Summary: Path traversal in impacket
Aliases: CVE-2021-31800
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2021-06-18T18:43:14Z

Multiple path traversal vulnerabilities exist in smbserver.py in Impacket before 0.9.23. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.
Vulnerability: GHSA-pfwp-8pq4-g7pv
Summary: Moderate severity vulnerability that affects com.alipay.sofa:hessian
Aliases: CVE-2019-9212
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-184, CWE-502
Published: 2019-03-06T17:36:08Z

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget.
Vulnerability: GHSA-j378-6mmw-hqfr
Summary: Denial of service vulnerability exists when System.IO.Pipelines improperly handles requests
Aliases: CVE-2018-8409
Severity: HIGH
CVSS score: 7.5
Published: 2018-10-16T19:56:38Z

A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET Core 2.1, System.IO.Pipelines, ASP.NET Core 2.1.
Vulnerability: GHSA-6rg3-8h8x-5xfv
Summary: Unchecked hostname resolution could allow access to local network resources by users outside the local network
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-284, CWE-441
Published: 2021-06-23T18:04:50Z

### Impact
A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible.

This vulnerability requires valid authentication credentials and is therefore **not exploitable by unauthenticated users**. If you are running an instance for yourself or other trusted individuals this impact is unlikely to be of major concern to you. However, you should still upgrade for security sake.

### Patches
Users should upgrade to the latest version of Wings.

### Workarounds
There is no workaround available that does not involve modifying Panel or Wings code.
Vulnerability: GHSA-q9cp-mc96-m4w2
Summary: XML External Entity in Dashboard Widget
Aliases: CVE-2020-26229
Severity: LOW
CVSS score: 3.7
CWE: CWE-611
Published: 2020-11-23T21:18:44Z

### Problem
It has been discovered that RSS widgets are susceptible to XML external entity processing.
This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions.

At least with _libxml2_ version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed.

### Solution
Update to TYPO3 version 10.4.10 that fixes the problem described.
Vulnerability: GHSA-rjmq-6v55-4rjv
Summary: Improper Authorization in org.cometd.oort
Aliases: CVE-2022-24721
Severity: HIGH
CVSS score: 8.1
CWE: CWE-863
Published: 2022-03-15T19:02:36Z

### Impact
Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels.
By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's (possibly sensitive) data.
By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure.
The issue impacts any version up to 5.0.10, 6.0.5 and 7.0.5.

### Patches
The issue has been fixed in 5.0.11, 6.0.6 and 7.0.6.

### Workarounds
The workaround is to install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.
This workaround could be implemented in any affected version.

### References
cometd/cometd#1146

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@webtide.com](mailto:security@webtide.com)

### Credits
https://www.redteam-pentesting.de/
Vulnerability: GHSA-65rm-h285-5cc5
Summary: Improper Certificate Validation in Twisted
Aliases: CVE-2019-12855
Severity: HIGH
CVSS score: 7.4
CWE: CWE-295
Published: 2019-08-16T14:02:35Z

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
Vulnerability: GHSA-8mjx-h23h-w2pg
Summary: Double free in stack_dst
Aliases: CVE-2021-28034
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-09-01T18:30:44Z

An issue was discovered in the stack_dst crate before 0.6.1 for Rust. Because of the push_inner behavior, a double free can occur upon a val.clone() panic.
Vulnerability: GHSA-6w83-22gj-5pv9
Summary: Directory Traversal in cyber-js
Aliases: CVE-2017-16093
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-27T14:06:00Z

Affected versions of `cyber-js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-v33x-prhc-gph5
Summary: Insufficiently Protected Credentials and Improper Authentication in Spring Security
Aliases: CVE-2019-11272
Severity: HIGH
CVSS score: 7.3
CWE: CWE-287, CWE-522
Published: 2019-06-27T17:24:58Z

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.
Vulnerability: GHSA-mqvp-7rrg-9jxc
Summary: Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad
Aliases: CVE-2022-26336
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20, CWE-770
Published: 2022-03-05T00:00:44Z

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
Vulnerability: GHSA-6qq8-5wq3-86rp
Summary: Open redirect in Traefik
Aliases: CVE-2020-15129
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-02-11T23:19:21Z

## Summary

There exists a potential open redirect vulnerability in Traefik's handling of the `X-Forwarded-Prefix` header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

## Details

The Traefik API dashboard component doesn't validate that the value of the header `X-Forwarded-Prefix` is a site relative path and will redirect to any header provided URI.

e.g.

```
$ curl --header 'Host:traefik.localhost' --header 'X-Forwarded-Prefix:https://example.org' 'http://localhost:8081'
<a href="https://example.org/dashboard/">Found</a>.`
```

### Impact
A successful exploitation of an open redirect can be used to entice victims to disclose sensitive information.

### Workarounds

By using the `headers` middleware, the request header `X-Forwarded-Prefix` value can be overridden by the value `.` (dot)

- https://docs.traefik.io/v2.2/middlewares/headers/#customrequestheaders
- https://docs.traefik.io/v1.7/basics/#custom-headers

### For more information

If you have any questions or comments about this advisory, open an issue in [Traefik](https://github.com/containous/traefik/issues).

## Credit

This issue was found by the GitHub Application Security Team and reported on behalf of the GHAS by the GitHub Security Lab Team.
Vulnerability: GHSA-rc75-cf5c-mxvh
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Aliases: CVE-2019-10755
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-338
Published: 2019-11-06T17:06:28Z

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Vulnerability: GHSA-h73q-5wmj-q8pj
Summary: Cross site scripting in datatables.net 
Aliases: CVE-2021-23445
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-09-29T17:11:28Z

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Vulnerability: GHSA-mhp6-pxh8-r675
Summary: Cross site scripting in Angular
Aliases: CVE-2020-7676
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-06-18T14:19:58Z

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
Vulnerability: GHSA-c5x2-p679-95wc
Summary: Null pointer dereference in `SparseTensorSliceDataset`
Aliases: CVE-2021-37647
Severity: HIGH
CVSS score: 7.7
CWE: CWE-476
Published: 2021-08-25T14:43:32Z

### Impact
When a user does not supply arguments that determine a valid sparse tensor, `tf.raw_ops.SparseTensorSliceDataset` implementation can be made to dereference a null pointer:

```python
import tensorflow as tf

tf.raw_ops.SparseTensorSliceDataset(
  indices=[[],[],[]],
  values=[1,2,3],
  dense_shape=[3,3])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L240-L251) has some argument validation but fails to consider the case when either `indices` or `values` are provided for an empty sparse tensor when the other is not.

If `indices` is empty (as in the example above), then [code that performs validation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L260-L261) (i.e., checking that the indices are monotonically increasing) results in a null pointer dereference: 

```cc
    for (int64_t i = 0; i < indices->dim_size(0); ++i) {
      int64_t next_batch_index = indices->matrix<int64>()(i, 0);
      ...
    }
```

If `indices` as provided by the user is empty, then `indices` in the C++ code above is backed by an empty `std::vector`, hence calling `indices->dim_size(0)` results in null pointer dereferencing (same as calling `std::vector::at()` on an empty vector).

### Patches
We have patched the issue in GitHub commit [02cc160e29d20631de3859c6653184e3f876b9d7](https://github.com/tensorflow/tensorflow/commit/02cc160e29d20631de3859c6653184e3f876b9d7).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-cq6w-w5rj-p9x8
Summary: Cross-site Scripting in Froala Editor
Aliases: CVE-2021-30109
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-06T17:47:05Z

Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.
Vulnerability: GHSA-fxq4-r6mr-9x64
Summary: CSRF Vuln can expose user's QRcode
Severity: LOW
CVSS score: 0
CWE: CWE-352
Published: 2021-04-08T16:46:00Z

### Impact
When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to two-factor authentication codes. Note that the /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.

### Patches
This is fixed in the upcoming 4.0.0 release.

### Workarounds
You can provide your own URL for fetching the QRcode by defining SECURITY_TWO_FACTOR_QRCODE_URL and providing your own implementation (that presumably required a POST with CSRF protection). This would require changing the two-factor setup template as well.

### References
None.

### For more information
If you have any questions or comments about this advisory:
* Read this pull request: #423
Vulnerability: GHSA-jpwg-6gf5-5vh9
Summary: Out of bounds write in reorder
Aliases: CVE-2021-29942
Severity: HIGH
CVSS score: 7.3
CWE: CWE-787
Published: 2021-08-25T20:54:10Z

An issue was discovered in the reorder crate through 1.1.0 for Rust. swap_index can return uninitialized values if an iterator returns a len() that is too large.
Vulnerability: GHSA-2m8h-fgr8-2q9w
Summary: Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized
Aliases: CVE-2016-9878
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-10-04T20:29:55Z

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
Vulnerability: GHSA-cpgw-2wxr-pww3
Summary: Open Redirect
Aliases: CVE-2018-15178
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-06-29T18:32:39Z

Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\ substring in the user/login redirect_to parameter, related to the function isValidRedirect in routes/user/auth.go.
Vulnerability: GHSA-7h6j-2268-fhcm
Summary: Improper Certificate Handling
Aliases: CVE-2020-9321
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-200, CWE-295
Published: 2021-09-02T22:00:01Z

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.
Vulnerability: GHSA-29vr-79w7-p649
Summary: Incorrect Authorization in Gerapy
Aliases: CVE-2021-44597
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-863
Published: 2022-03-11T00:02:00Z

An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in project_configure function.
Vulnerability: GHSA-3h9m-9g3g-5wqx
Summary: Malicious Package in buffer-xov
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:13:14Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-hhh6-cm2m-3fhc
Summary: Allocation of Resources Without Limits or Throttling in iText
Aliases: CVE-2022-24196
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-770
Published: 2022-02-02T00:01:45Z

iText v7.1.17 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.