TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-gpqc-4pp7-5954
Summary: Authentication Bypass by CSRF Weakness
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-352
Published: 2021-11-18T20:15:35Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
Spree 4.1 users should update to spree_auth_devise 4.1.1
Older Spree version users should update to spree_auth_devise 4.0.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-592v-7frm-h44q
Summary: Cross-site scripting in LavaLite-CMS
Aliases: CVE-2020-23700
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-09-08T17:25:36Z

Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
Vulnerability: GHSA-rhq2-3vr9-6mcr
Summary: Files on the host computer can be accessed from the Gradio interface
Aliases: CVE-2021-43831
Severity: HIGH
CVSS score: 8.3
CWE: CWE-22
Published: 2022-01-21T23:43:33Z

### Impact
This is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces using `gradio<2.4.8`. Because of the way that static files were being served, someone who generated a public Gradio link and shared it with others would potentially be exposing the files on the computer that generated the link, while the link was active. An attacker would be able to view the contents of a file on the computer if they knew the exact relative filepath. We do not have any evidence that this was ever exploited, but we treated the issue seriously and immediately took steps to mitigate it (see below)

### Response
1. We worked with @haby0 to immediately patch the issue and released a new version, `gradio 2.5.0`, within 24 hours of the issue being brought to our attention 
2. We enabled a notification that is printed to anyone using an older version of gradio telling them to upgrade (see screenshot below)
3. We expanded our test suite to test for this vulnerability ensuring that our patch does not get reverted in future releases of `gradio`

![image](https://user-images.githubusercontent.com/1778297/146251425-f36b519b-6d4a-4dfb-8d89-c1ed005979d3.png)

### Patches
The problem has been patched in `gradio>=2.5.0`.
Vulnerability: GHSA-9hx9-w2j6-rw76
Summary: Low severity vulnerability that affects show_in_browser
Aliases: CVE-2013-2105
Severity: LOW
CVSS score: 0
CWE: CWE-59
Published: 2017-10-24T18:33:37Z

The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.
Vulnerability: GHSA-g95p-88p4-76cm
Summary: Cross-site Scripting in Gitea
Aliases: CVE-2021-28378
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-09-27T20:17:39Z

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
Vulnerability: GHSA-xx8c-m748-xr4j
Summary: Access Restriction Bypass in kubernetes
Aliases: CVE-2016-1905
Severity: MODERATE
CVSS score: 7.7
CWE: CWE-284
Published: 2022-02-15T01:57:18Z

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
Vulnerability: GHSA-3pph-2595-cgfh
Summary: There is a XML external entity expansion (XXE) vulnerability in Apache Solr 
Aliases: CVE-2018-1308
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-17T19:55:46Z

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
Vulnerability: GHSA-w9mf-24h3-9wxf
Summary: Downloads Resources over HTTP in windows-iedriver
Aliases: CVE-2016-10689
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:41:58Z

Affected versions of `windows-iedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-iedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-mv26-cx23-vrfg
Summary: Server-Side Request Forgery in @peertube/embed-api
Aliases: CVE-2022-0508
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-918
Published: 2022-02-09T00:00:31Z

@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery.
Vulnerability: GHSA-435p-f82x-mxwm
Summary: Command injection in Yamale
Aliases: CVE-2021-38305
Severity: HIGH
CVSS score: 7.8
CWE: CWE-434, CWE-78
Published: 2021-08-11T15:19:23Z

23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale.
Vulnerability: GHSA-pwr6-p3fh-grc2
Summary: Deserialization of Untrusted Data in Magnolia CMS
Aliases: CVE-2021-46364
Severity: HIGH
CVSS score: 7.8
CWE: CWE-502
Published: 2022-02-12T00:00:37Z

A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.
Vulnerability: GHSA-55xh-53m6-936r
Summary: Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
Severity: MODERATE
CVSS score: 0
CWE: CWE-347
Published: 2021-06-01T21:17:36Z

### Impact

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. 

This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth and there is no impact on the integrity of decrypted plaintext.

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. 

For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to process per message. This configuration provides customers with a way to limit the number of AWS KMS Decrypt API calls that the ESDK will make per message. This setting will reject messages with more EDKs than the configured limit.

Finally, this update adds early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.

### Patches

Fixed in versions 1.9 and 2.2. We recommend that all users upgrade to address these issues.

Customers leveraging the ESDK’s streaming features have several options to protect signature validation. One is to ensure that client code reads to the end of the stream before using released plaintext. With this release, using the new API for streaming and falling back to the non-streaming decrypt API for signed messages prevents using any plaintext from signed data before the signature is validated. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

Users processing ESDK messages from untrusted sources should use the new maximum encrypted data keys parameter. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

### Workarounds

None

### For more information

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#digital-sigs

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x
Vulnerability: GHSA-fwcm-636p-68r5
Summary: Server-side request forgery in CarrierWave
Aliases: CVE-2021-21288
Severity: LOW
CVSS score: 0
CWE: CWE-918
Published: 2021-02-08T19:16:26Z

### Impact
[CarrierWave download feature](https://github.com/carrierwaveuploader/carrierwave#uploading-files-from-a-remote-location) has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform.

### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).

### Workarounds
Using proper network segmentation and applying the principle of least privilege to outbound connections from application servers can reduce the severity of SSRF vulnerabilities. Ideally the vulnerable gem should run on an isolated server without access to any internal network resources or cloud metadata access.

### References
[Server-Side Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [CarrierWave repo](https://github.com/carrierwaveuploader/carrierwave)
* Email me at [mit.shibuya@gmail.com](mailto:mit.shibuya@gmail.com)
Vulnerability: GHSA-8p7v-2jvj-v54r
Summary: Moderate severity vulnerability that affects apache-airflow
Aliases: CVE-2019-0216
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2019-04-12T20:42:25Z

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Vulnerability: GHSA-8xpj-9j9g-fc9r
Summary: SQL Injection in elide-datastore-aggregation
Aliases: CVE-2022-24827
Severity: HIGH
CVSS score: 8.1
CWE: CWE-89
Published: 2022-04-08T22:43:17Z

### Impact
When leveraging the following together:

- Elide Aggregation Data Store for Analytic Queries
- Parameterized Columns (A column that requires a client provided parameter)
- A parameterized column of type TEXT

There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection.  A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns.  This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters.

### Patches
A [fix](https://github.com/yahoo/elide/pull/2581) is provided in [Elide 6.1.4](https://github.com/yahoo/elide/releases/tag/6.1.4).

### Workarounds
The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted).   Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [elide](https://github.com/yahoo/elide)
* Contact us in [Discord](https://discord.com/invite/3vh8ac57cc)
Vulnerability: GHSA-4rjf-mxfm-98h5
Summary: SQL injection vulnerability in the policy admin tool in Apache Ranger
Aliases: CVE-2016-2174
Severity: HIGH
CVSS score: 7.2
CWE: CWE-89
Published: 2018-10-17T17:21:29Z

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
Vulnerability: GHSA-4qwp-7c67-jmcc
Summary: Unauthenticated remote code execution in Ignition
Aliases: CVE-2021-3129
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-03-29T20:23:46Z

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Vulnerability: GHSA-hc92-9h3m-c39j
Summary: Incorrect cast in anymap
Aliases: CVE-2021-38187
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-681, CWE-704
Published: 2021-08-25T20:55:45Z

An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64.
Vulnerability: GHSA-66mv-xh68-h6v2
Summary: Denial of Service in @commercial/hapi
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:48:53Z

Affected versions of `@commercial/hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to versions 16.8.2, 17.9.2, 18.4.1, 19.1.1 or later.
Vulnerability: GHSA-8f89-2fwj-5v5r
Summary: Improper Input Validation in klona
Aliases: CVE-2020-8125
Severity: HIGH
CVSS score: 9.8
CWE: CWE-20
Published: 2021-04-13T15:41:24Z

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
Vulnerability: GHSA-3wc8-659g-r88q
Summary: Low severity vulnerability that affects org.springframework.batch:spring-batch-core
Aliases: CVE-2019-3774
Severity: LOW
CVSS score: 0
CWE: CWE-611
Published: 2019-01-25T16:18:56Z

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability: GHSA-phj8-4cq3-794g
Summary: Unencrypted storage of client side sessions
Aliases: CVE-2021-29481
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-312
Published: 2021-07-01T17:02:13Z

### Impact

The default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies.

Note: the documentation does point this out and encourage users to add an encryption key, but it is not mandatory.

For this to be a vulnerability, some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example, the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies.

The proposed change is to change the default behaviour to use a randomly generated encryption key. This would mean that sessions do not survive app restarts, but this is already the behaviour given the random signing key.

### Patches

As of version 1.9.0, a securely randomly generated signing key is used.

### Workarounds

Supply an encryption key, as per the documentation recommendation.

### References

- https://github.com/ratpack/ratpack/pull/1590
Vulnerability: GHSA-54cr-gv8w-8324
Summary: Malicious Package in xoc
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:36:22Z

Version 1.0.7 of `xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.7 of this module is found installed you will want to replace it with a version before or after 1.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-9wcg-jrwf-8gg7
Summary: Prototype Pollution in express-fileupload
Aliases: CVE-2020-7699
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2020-08-05T14:53:16Z

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
Vulnerability: GHSA-m242-wc86-8768
Summary: Moderate severity vulnerability that affects python-fedora
Aliases: CVE-2017-1002150
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2018-07-13T15:17:05Z

python-fedora 0.8.0 and lower is vulnerable to an open redirect resulting in loss of CSRF protection
Vulnerability: GHSA-vm28-mrm7-fpjq
Summary: High severity vulnerability that affects sfpagent
Aliases: CVE-2014-2888
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2017-10-24T18:33:36Z

lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.
Vulnerability: GHSA-g3qw-9pgp-xpj4
Summary: Out-of-bounds Read in njwt
Severity: LOW
CVSS score: 0
CWE: CWE-125
Published: 2020-09-01T21:08:44Z

Versions of `njwt` prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the `base64urlEncode` function. 

On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability.


## Recommendation

Upgrade to version 1.0.0.
Vulnerability: GHSA-27pv-q55r-222g
Summary: Path traversal in github.com/ipfs/go-ipfs
Aliases: CVE-2020-26279
Severity: HIGH
CVSS score: 7.7
CWE: CWE-22
Published: 2021-06-23T17:27:44Z

### Impact
It is currently possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when `ipfs get` is done on an affected DAG.

1. The only affected command is `ipfs get`.
2. The gateway is not affected.

### Patches
Traversal fix patched in https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227
`tar-utils` patch applied to go-ipfs via https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2

### Workarounds
Upgrade to go-ipfs 0.8 or later.

### References
Binaries for the patched versions of go-ipfs are available on the IPFS distributions site, https://dist.ipfs.io/go-ipfs

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
* Email us at [security@ipfs.io](mailto:security@ipfs.io)
Vulnerability: GHSA-h896-mx9x-g32g
Summary: XML External Entity injection in Apache Camel
Aliases: CVE-2019-0188
Severity: HIGH
CVSS score: 0
CWE: CWE-611
Published: 2019-05-29T18:15:50Z

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
Vulnerability: GHSA-vfq6-hq5r-27r6
Summary: Potential account hijack via password reset form in Django
Aliases: CVE-2019-19844
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-640
Published: 2020-01-16T22:35:12Z

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Vulnerability: GHSA-2h3h-vw8r-82rp
Summary: Weak JSON Web Token in yapi-vendor
Aliases: CVE-2021-27884
Severity: MODERATE
CVSS score: 5.1
CWE: CWE-330
Published: 2021-03-26T16:49:26Z

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has been patched in version 1.9.3.
Vulnerability: GHSA-4mrx-6fxm-8jpg
Summary: Buffer Overflow in vyper
Aliases: CVE-2022-24788
Severity: HIGH
CVSS score: 7.1
CWE: CWE-119, CWE-120
Published: 2022-04-20T20:31:44Z

### Impact
Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun.

### Patches
0.3.2 (as of https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b)

### Workarounds
Use .vy interfaces.
Vulnerability: GHSA-4gwh-2pqx-f5cc
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-44277
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-12-03T20:48:42Z

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
Vulnerability: GHSA-76wf-9vgp-pj7w
Summary: Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
Severity: MODERATE
CVSS score: 0
Published: 2022-02-11T23:26:12Z

### Summary

The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker with read access to an encrypted S3 bucket was able to recover the plaintext without accessing the encryption key.

### Risk/Severity

The vulnerability poses insider risks/privilege escalation risks, circumventing KMS controls for stored data.

### Impact

The issue has been fully mitigated by AWS as of Aug. 5th by disallowing the header in question.

The S3 crypto library tries to store an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext in an offline attack, if the hash is readable to the attacker. In order to be impacted by this issue, the attacker has to be able to guess the plaintext as a whole. The attack is theoretically valid if the plaintext entropy is below the key size, i.e. if it is easier to brute force the plaintext instead of the key itself, but practically feasible only for short plaintexts or plaintexts otherwise accessible to the attacker in order to create a rainbow table.

The issue has been fixed server-side by AWS as of Aug 5th, by blocking the related metadata field. No S3 objects are affected anymore.

### Mitigation

The header in question is no longer served by AWS, making this attack fully mitigated as of Aug. 5th.

### Proof of concept

A [Proof of concept](https://github.com/sophieschmieg/exploits/tree/master/aws_s3_crypto_poc) is available in a separate github repository, this particular issue can be found at [here](https://github.com/sophieschmieg/exploits/blob/master/aws_s3_crypto_poc/exploit/hash_exploit.go):

```golang
func HashExploit(bucket string, key string, input *OfflineAttackInput) (string, error) {
	_, header, err := input.S3Mock.GetObjectDirect(bucket, key)
	length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length"))
	plaintextMd5 := header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Md5")
	blocks := length / 16
	possiblePlaintextNum := 1
	segNum := len(input.PossiblePlaintextSegments)
	for i := 0; i < blocks; i++ {
		possiblePlaintextNum *= segNum
	}
	for i := 0; i < possiblePlaintextNum; i++ {
		w := i
		guess := ""
		for j := 0; j < blocks; j++ {
			guess += input.PossiblePlaintextSegments[w%segNum]
			w /= segNum
		}
		guessMd5 := md5.Sum([]byte(guess))
		if plaintextMd5 == base64.StdEncoding.EncodeToString(guessMd5[:]) {
			return guess, nil
		}
	}
	return "", fmt.Errorf("No plaintext found!")
}
```

The PoC will only work on old versions of the library, as the hash has been removed from being calculated as well.
Vulnerability: GHSA-v3j6-xf77-8r9c
Summary: Use-after-free in actix-http
Aliases: CVE-2020-35901
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2021-08-25T20:49:39Z

An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. There is a use-after-free in BodyStream.
Vulnerability: GHSA-fwr5-q9rx-294f
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2010-4534
Severity: MODERATE
CVSS score: 0
Published: 2018-07-23T19:51:40Z

The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.
Vulnerability: GHSA-39wj-j3jc-858m
Summary: XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic
Aliases: CVE-2020-35124
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2021-01-19T20:43:56Z

### Impact
This is a cross-site scripting vulnerability which affects every version of Mautic and could allow an attacker unauthorised administrator level access to Mautic.

This vulnerability was reported by Naveen Sunkavally at Horizon3.ai.

### Patches
Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Post in https://forum.mautic.org/c/support
* Email us at security@mautic.org
Vulnerability: GHSA-95cg-3r4g-7w6j
Summary: Malicious Package in js-rha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:01:29Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-p9j6-4pjr-gp48
Summary: Path Traversal in MPXJ
Aliases: CVE-2020-35460
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2020-12-18T18:28:23Z

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
Vulnerability: GHSA-7cr9-rmqr-fpqp
Summary: Path traversal in FreeTAKServer-UI
Aliases: CVE-2022-25511
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2022-03-12T00:00:37Z

An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.
Vulnerability: GHSA-wv4p-jp67-jr97
Summary: Data races in magnetic
Aliases: CVE-2020-35925
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-362
Published: 2021-08-25T20:50:05Z

An issue was discovered in the magnetic crate before 2.0.1 for Rust. MPMCConsumer and MPMCProducer allow cross-thread sending of a non-Send type.
Vulnerability: GHSA-cwfw-4gq5-mrqx
Summary: Regular Expression Denial of Service (ReDoS) in braces
Aliases: CVE-2018-1109
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2022-01-06T20:42:03Z

A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability: GHSA-6xh7-4v2w-36q6
Summary: ASP.NET Core fails to properly validate web requests
Aliases: CVE-2017-0247
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-10-16T19:58:05Z

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.
Vulnerability: GHSA-w7q7-vjp8-7jv4
Summary: SQL Injection in typeorm
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2019-06-06T15:30:16Z

Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

Upgrade to version 0.1.15
Vulnerability: GHSA-www2-v7xj-xrc6
Summary: High severity vulnerability that affects urllib3
Aliases: CVE-2018-20060
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-200
Published: 2018-12-12T15:52:07Z

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.
Vulnerability: GHSA-8v67-x8q5-3x3g
Summary: Cross-Site Scripting in simditor
Aliases: CVE-2018-19048
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-05-14T04:01:27Z

Versions of `simditor` prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with `innerHTML`, allowing attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.3.22 or later.
Vulnerability: GHSA-wv67-q8rr-grjp
Summary: Prototype Pollution in jquery
Aliases: CVE-2019-5428
Severity: MODERATE
CVSS score: 0
Published: 2019-04-23T15:59:10Z

Versions of `jquery`  prior to 3.4.0 are vulnerable to Prototype Pollution. The extend() method allows an attacker to modify the prototype for `Object` causing changes in properties that will exist on all objects.


## Recommendation

Upgrade to version 3.4.0 or later.
Vulnerability: GHSA-98vv-pw6r-q6q4
Summary: Uncontrolled Resource Consumption in pillow
Aliases: CVE-2021-23437
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-125
Published: 2021-09-07T23:08:10Z

The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Vulnerability: GHSA-3jq8-jg75-rqv6
Summary: Moderate severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17195
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863, CWE-319
Published: 2018-12-20T22:02:45Z

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. Mitigation: The fix to apply Cross-Origin Resource Sharing (CORS) policy request filtering was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-wm47-8v5p-wjpj
Summary: Possible request smuggling in HTTP/2 due missing validation
Aliases: CVE-2021-21295
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-444
Published: 2021-03-09T18:49:49Z

### Impact
If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up.  This is fine as long as the request is not proxied through as HTTP/1.1.
If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling.  

In a proxy case, users  may assume the content-length is validated somehow, which is not the case.  If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked.

An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1.   A sample attack request looks like:

```
POST / HTTP/2
:authority:: externaldomain.com
Content-Length: 4

asdfGET /evilRedirect HTTP/1.1
Host: internaldomain.com
```

Users are only affected if all of this is `true`:
 * `HTTP2MultiplexCodec` or `Http2FrameCodec` is used
 * `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects
 * These  HTTP/1.1 objects are forwarded to another remote peer.
 

### Patches
This has been patched in 4.1.60.Final

### Workarounds
The user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

### References
Related change to workaround the problem: https://github.com/Netflix/zuul/pull/980
Vulnerability: GHSA-8r7q-r9mx-35rh
Summary: Mishandling of format strings in rusqlite
Aliases: CVE-2020-35869
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-134
Published: 2021-08-25T20:47:18Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated because rusqlite::trace::log mishandles format strings.
Vulnerability: GHSA-c4hh-fg8x-6h9p
Summary: Malicious Package in buffer-xnr
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:57:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-3x83-p476-vv95
Summary: Downloads Resources over HTTP in selenium-standalone-painful
Aliases: CVE-2016-10679
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:40Z

Affected versions of `selenium-standalone-painful` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-standalone-painful`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-778x-2mqv-w6xw
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2016-8629
Severity: MODERATE
CVSS score: 0
CWE: CWE-284
Published: 2018-10-18T16:48:01Z

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
Vulnerability: GHSA-79gr-58r3-pwm3
Summary: Forbid serializing AbstractAdapter and TagAwareAdapter instances
Aliases: CVE-2019-18889
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2019-12-02T18:07:16Z

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
Vulnerability: GHSA-wwwg-6r7f-9c9h
Summary: Malicious Package in file-logging
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:43:28Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-cxvr-r92m-q9hw
Summary: XSS in Dolibarr
Aliases: CVE-2020-13094
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-05-21T21:08:47Z

Dolibarr before 11.0.4 allows XSS.
Vulnerability: GHSA-vv38-4xcj-q4rw
Summary: Cross-site Scripting in Apache Knox SSO
Aliases: CVE-2021-42357
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-21T23:52:00Z

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.
Vulnerability: GHSA-33gc-6cw9-w3g4
Summary: Deserialization of Untrusted Data in topthink/framework
Aliases: CVE-2021-36564
Severity: CRITICAL
CVSS score: 0
CWE: CWE-502
Published: 2021-12-10T20:23:19Z

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
Vulnerability: GHSA-jg4f-jqm5-4mgq
Summary: Ansible fails to properly sanitize fact variables sent from the Ansible controller
Aliases: CVE-2016-8628
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-77
Published: 2018-10-10T17:23:14Z

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Vulnerability: GHSA-xj7h-g7rh-gjcw
Summary: Cross-site Scripting in Subrion CMS
Aliases: CVE-2020-18324
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the `q` parameter in the Kickstart template.
Vulnerability: GHSA-69r6-7h4f-9p7q
Summary: Malicious Package in discord.js-user
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T20:41:01Z

All versions of `discord.js-user` contain malicious code. The package uploads the user's Discord token to a remote server.


## Recommendation

Remove the package from your environment. Ensure any compromised tokens are invalidated.
Vulnerability: GHSA-f2vv-v9cg-qhh7
Summary: Assertion failure based denial of service in Tensorflow
Aliases: CVE-2022-21737
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-754, CWE-617
Published: 2022-02-09T23:43:48Z

### Impact 
The [implementation of `*Bincount` operations](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/bincount_op.cc) allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail:

```python
import tensorflow as tf

tf.raw_ops.DenseBincount(
  input=[[0], [1], [2]],
  size=[1],
  weights=[3,2,1],
  binary_output=False)
```

There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in `CHECK` failures later when the output tensors get allocated.

### Patches
We have patched the issue in GitHub commit [7019ce4f68925fd01cdafde26f8d8c938f47e6f9](https://github.com/tensorflow/tensorflow/commit/7019ce4f68925fd01cdafde26f8d8c938f47e6f9).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-4fh8-pm7g-pmxq
Summary: Authentication bypass in Apache Hadoop
Aliases: CVE-2018-11764
Severity: HIGH
CVSS score: 8.8
CWE: CWE-306
Published: 2022-02-10T20:28:06Z

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
Vulnerability: GHSA-m2h2-264f-f486
Summary: angular vulnerable to regular expression denial of service (ReDoS)
Aliases: CVE-2022-25844
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-1333
Published: 2022-05-03T00:00:44Z

AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.

**Note:**
1. This package has been deprecated and is no longer maintained.
2. The vulnerable versions are 1.7.0 and higher.
Vulnerability: GHSA-77pc-q5q7-qg9h
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:58:30Z

Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
Vulnerability: GHSA-hqhp-5p83-hx96
Summary: Regular Expression Denial of Service in prismjs
Aliases: CVE-2021-3801
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2021-09-20T20:44:48Z

Prism is a lightweight, robust, and elegant syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.
Vulnerability: GHSA-hf4q-52x6-4p57
Summary: Unrestricted file upload leads to stored cross-site scripting in Microweber
Aliases: CVE-2022-0906
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2022-03-11T00:02:36Z

Microweber prior to version 1.2.12 allows unrestricted file upload, which could lead to stored cross-site scripting.
Vulnerability: GHSA-v567-q267-phpg
Summary: pimcore is vulnerable to Cross-site Scripting
Aliases: CVE-2022-0257
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-21T23:50:11Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-3cj3-jrrp-9rxf
Summary: Unchecked Return Value in xcb
Aliases: CVE-2021-26958
Severity: HIGH
CVSS score: 8.8
CWE: CWE-252
Published: 2021-08-25T20:53:18Z

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.
Vulnerability: GHSA-9xw9-pvgv-6p76
Summary: Insufficient Error Handling in http-proxy
Aliases: CVE-2017-16014
Severity: MODERATE
CVSS score: 0
CWE: CWE-703
Published: 2018-11-09T17:47:52Z

Affected versions of `http-proxy` are vulnerable to a denial of service attack, wherein an attacker can force an error which will cause the server to crash.


## Recommendation

Update to version 0.7.0 or later.
Vulnerability: GHSA-cr79-9pwf-r6f5
Summary: Downloads Resources over HTTP in prince
Aliases: CVE-2016-10591
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:34:24Z

Affected versions of `prince` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `prince`.


## Recommendation

Update to version 1.4.6 or later.
Vulnerability: GHSA-692h-g37c-qv44
Summary: Malicious Package in sj-tw-sec
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:25:30Z

All versions of `sj-tw-sec` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-32hw-3pvh-vcvc
Summary: XSS vulnerability on password reset page
Aliases: CVE-2021-27909
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2021-09-01T18:40:56Z

### Impact
For Mautic versions prior to 3.3.4, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized. 

### Patches

Upgrade to 3.3.4 or 4.0.0

### Workarounds

No

### References

https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-67mm-m3wx-j7fr
Summary: Command injection in gitlog
Aliases: CVE-2021-26541
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-04-13T15:15:29Z

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.
Vulnerability: GHSA-38f5-ghc2-fcmv
Summary: Code Injection in cryo
Aliases: CVE-2018-3784
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2018-08-21T17:02:43Z

All versions of `cryo` are vulnerable to code injection due to an Insecure implementation of deserialization.


## Proof of concept

```
var Cryo = require('cryo');
var frozen = '{"root":"_CRYO_REF_3","references":[{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\"); return 1111;}"},{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\");return 2222;}"},{"contents":{"toString":"_CRYO_REF_0","valueOf":"_CRYO_REF_1"},"value":"_CRYO_OBJECT_"},{"contents":{"__proto__":"_CRYO_REF_2"},"value":"_CRYO_OBJECT_"}]}'
var hydrated = Cryo.parse(frozen);
console.log(hydrated);
```


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.