TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-xv69-f7x5-r4qw
Summary: Cross-Site Scripting via Attribute Set Name
Aliases: CVE-2019-8145
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2019-11-12T22:59:43Z

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products.
Vulnerability: GHSA-pf8f-w267-mq2h
Summary: The rack-cors rubygem may allow directory traveral
Aliases: CVE-2019-18978
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2019-11-15T20:26:59Z

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Vulnerability: GHSA-9px9-73fg-3fqp
Summary: Null pointer dereference in Grappler's `IsConstant`
Aliases: CVE-2022-23589
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-476
Published: 2022-02-09T23:29:14Z

### Impact
Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a `SavedModel` file (fixing the first one would trigger the same dereference in the second place):

First, during [constant folding](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/constant_folding.cc#L3466-L3497), the `GraphDef` might not have the required nodes for the binary operation:

```cc
  NodeDef* mul_left_child = node_map_->GetNode(node->input(0));
  NodeDef* mul_right_child = node_map_->GetNode(node->input(1));
  // One child must be constant, and the second must be Conv op.
  const bool left_child_is_constant = IsReallyConstant(*mul_left_child);
  const bool right_child_is_constant = IsReallyConstant(*mul_right_child);
```

If a node is missing, the correposning `mul_*child` would be null, and the dereference in the subsequent line would be incorrect.

We have a similar issue during [`IsIdentityConsumingSwitch`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/mutable_graph_view.cc#L59-L74):

```cc
  NodeDef* input_node = graph.GetNode(tensor_id.node());
  return IsSwitch(*input_node);
```

### Patches
We have patched the issue in GitHub commits [0a365c029e437be0349c31f8d4c9926b69fa3fa1](https://github.com/tensorflow/tensorflow/commit/0a365c029e437be0349c31f8d4c9926b69fa3fa1) and [045deec1cbdebb27d817008ad5df94d96a08b1bf](https://github.com/tensorflow/tensorflow/commit/045deec1cbdebb27d817008ad5df94d96a08b1bf).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-76qf-6mvw-c5hm
Summary: Malicious Package in js-base64-int
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:45:42Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-4p8f-mmfj-r45g
Summary: Cross-site scripting in fat_free_crm
Aliases: CVE-2018-20975
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-21T16:15:04Z

Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.
Vulnerability: GHSA-856x-cp3q-47vg
Summary: Insecure Default Configuration in airbrake
Aliases: CVE-2016-10530
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2019-02-18T23:58:13Z

Affected versions of `airbrake` default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information.


## Recommendation

Update to version 0.4.0 or later, or upgrade from the now-deprecated `airbrake` module to its replacement, [`airbrake-js`](https://www.npmjs.com/package/airbrake-js).
Vulnerability: GHSA-qw5h-7f53-xrp6
Summary: Stack overflow in `ParseAttrValue` with nested tensors
Aliases: CVE-2021-29615
Severity: LOW
CVSS score: 2.5
CWE: CWE-674
Published: 2021-05-21T14:28:45Z

### Impact
The implementation of [`ParseAttrValue`](https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input.

### Patches
We have patched the issue in GitHub commit [e07e1c3d26492c06f078c7e5bf2d138043e199c1](https://github.com/tensorflow/tensorflow/commit/e07e1c3d26492c06f078c7e5bf2d138043e199c1).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-86ch-6w7v-v6xf
Summary: Denial of Service in soketi
Aliases: CVE-2022-21667
Severity: HIGH
CVSS score: 7.5
CWE: CWE-755
Published: 2022-01-08T00:24:44Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

There was a wrong behavior when reading POST requests, making the server crash if it couldn't read the body. In case a POST request was sent to any endpoint of the server with an empty body, **even unauthenticated with the Pusher Protocol**, it would simply just crash the server for trying to send a response after the request closed.

All users that run the server are affected by it and it's highly recommended to upgrade to the latest patch.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Updating to at least 0.24.1 or the latest version.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No. Upgrading is the only solution.

### References
_Are there any links users can visit to find out more?_

https://github.com/soketi/soketi/releases/tag/0.24.1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issues board](https://github.com/soketi/soketi/issues)
* Email us at [alex@renoki.org](mailto:alex@renoki.org)
Vulnerability: GHSA-48w2-rm65-62xx
Summary: Inconsistent Interpretation of HTTP Requests in puma
Aliases: CVE-2021-41136
Severity: LOW
CVSS score: 3.7
CWE: CWE-444
Published: 2021-10-12T17:53:00Z

### Impact

Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior.

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

This vulnerability was patched in Puma 5.5.1 and 4.3.9.

### Workarounds

This vulnerability only affects Puma installations without any proxy in front.

Use a proxy which does not forward LF characters as line endings.

Proxies which do not forward LF characters as line endings:

* Nginx
* Apache (>2.4.25)
* Haproxy
* Caddy
* Traefik

### Possible Breakage

If you are [dealing with legacy clients that want to send `LF` as a line ending](https://stackoverflow.com/questions/43574428/have-apache-accept-lf-vs-crlf-in-request-headers) in an HTTP header, this will cause those clients to receive a `400` error.

### References

* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability: GHSA-6g87-ff9q-v847
Summary: High severity vulnerability that affects websockets
Aliases: CVE-2018-1000518
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-09-17T20:46:52Z

The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable via sending a specially crafted frame on an established connection. This vulnerability appears to have been fixed in version 5.0
Vulnerability: GHSA-8rc5-hx3v-2jg7
Summary: Sanitizer bypass in svg-sanitizer
Aliases: CVE-2019-10772
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-02-27T20:36:29Z

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.
Vulnerability: GHSA-2x83-r56g-cv47
Summary: High severity vulnerability that affects org.apache.httpcomponents:httpclient
Aliases: CVE-2012-6153
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2018-10-17T00:05:15Z

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
Vulnerability: GHSA-wfhx-6pcm-7m55
Summary: Path Traversal in ponse
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T16:46:22Z

Versions of `ponse` prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 2.0.2 or later.
Vulnerability: GHSA-6g88-99wj-8mgg
Summary: Command injection in Apache Flink
Aliases: CVE-2020-1960
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-74
Published: 2021-05-21T19:20:35Z

A vulnerability in Apache Flink where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reporter_name>.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX, allowing extraction of credentials and any other transferred data.
Vulnerability: GHSA-ff29-f57w-2mm3
Summary: Downloads Resources over HTTP in geoip-lite-country
Aliases: CVE-2016-10568
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:03Z

Affected versions of `geoip-lite-country` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 1.1.4 or later.
Vulnerability: GHSA-c538-924g-99q4
Summary: Session Fixation in Apache Zeppelin
Aliases: CVE-2017-12619
Severity: HIGH
CVSS score: 8.1
CWE: CWE-384
Published: 2019-04-24T16:06:59Z

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
Vulnerability: GHSA-6mcm-j9cj-3vc3
Summary: Infinite loop in Apache MINA
Aliases: CVE-2021-41973
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-835
Published: 2021-11-03T17:30:35Z

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Vulnerability: GHSA-h2x7-2ff6-v32p
Summary: Incorrect routing of some HTTP requests when using httpauth
Severity: HIGH
CVSS score: 0
Published: 2022-02-11T23:39:57Z

### Impact
Incorrect routing of some HTTP requests when using httpauth

### Patches
Upgrade to version 0.7.2 for fix

### Workarounds
None

### References
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [nbosscher@blue-giraffe.ca](mailto:nbosscher@blue-giraffe.ca)
Vulnerability: GHSA-9qrh-qjmc-5w2p
Summary: Denial-of-Service when binding invalid parameters in sqlite3
Aliases: CVE-2022-21227
Severity: HIGH
CVSS score: 7.5
CWE: CWE-248
Published: 2022-04-28T20:25:23Z

Affected versions of sqlite3 will experience a fatal error when supplying a specific object in the parameter array. This error causes the application to crash and could not be caught. Users of `sqlite3` v5.0.0, v5.0.1 and v5.0.2 are affected by this. This issue is fixed in v5.0.3. All users are recommended to upgrade to v5.0.3 or later. Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters as a workaround.
Vulnerability: GHSA-cjjc-xp8v-855w
Summary: Panic in malformed cerftificate
Aliases: CVE-2020-7919
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2021-06-23T18:02:39Z

The Helm core maintainers have identified a high severity security vulnerability in Go's `crypto` package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.

Thanks to @ravin9249 for identifying the vulnerability.

### Impact

Go before 1.12.16 and 1.13.x before 1.13.7 (and the `crypto/cryptobyte` package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service.

### Patches

A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+.

### Workarounds

No workaround is available. Users are urged to upgrade.

### References

- https://nvd.nist.gov/vuln/detail/CVE-2020-7919
- https://github.com/helm/helm/pull/8288

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [the Helm repository](https://github.com/helm/helm/issues)
* For security-specific issues, email us at <cncf-helm-security@lists.cncf.io>
Vulnerability: GHSA-3448-vfvv-xp9g
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-17197
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-835
Published: 2018-12-26T17:45:07Z

A carefully crafted or corrupt sqlite file can cause an infinite loop in Apache Tika's SQLite3Parser in versions 1.8-1.19.1 of Apache Tika.
Vulnerability: GHSA-wqh4-27cc-j8f2
Summary: Hijacked Environment Variables in nodeffmpeg
Aliases: CVE-2017-16069
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:36:48Z

The `nodeffmpeg` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-7fm6-gxqg-2pwr
Summary: Code Injection in total.js
Aliases: CVE-2021-23389
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-12-10T17:26:06Z

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Vulnerability: GHSA-qpqh-46qj-vwcw
Summary: Cross-site Scripting in docsify
Aliases: CVE-2020-7680
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-18T01:53:18Z

docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
Vulnerability: GHSA-5hr6-vc97-qxxh
Summary: XML Injection in Crafter CMS Crafter Studio 3.0.1
Aliases: CVE-2017-15685
Severity: HIGH
CVSS score: 8.6
CWE: CWE-91
Published: 2022-02-09T23:08:01Z

Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
Vulnerability: GHSA-v7x3-7hw7-pcjg
Summary: Moderate severity vulnerability that affects renovate
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2019-10-21T16:02:33Z

## Go Modules Vulnerability Disclosure

### Impact

Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.

### Patches

The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.

### Workarounds

Disable Go Modules support.

### References

Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Renovate](http://github.com/renovatebot/renovate)
* Email us at [support@renovatebot.com](mailto:support@renovatebot.com)
Vulnerability: GHSA-9c2p-jw8p-f84v
Summary: SQL Injection in sequelize
Aliases: CVE-2016-10556
Severity: CRITICAL
CVSS score: 0
CWE: CWE-89
Published: 2019-02-18T23:54:24Z

Affected versions of `sequelize` cast arrays to strings and fail to properly escape the resulting SQL statement, resulting in a SQL injection vulnerability.


## Proof of Concept
In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped.

Example Query:
```
database.query('SELECT * FROM TestTable WHERE Name IN (:names)', {
  replacements: {
    names: directCopyOfUserInput
  }
});
```

If the user inputs the value of `:names` as:
```
["test", "'); DELETE TestTable WHERE Id = 1 --')"]
```

The resulting SQL statement will be:
```
SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')
```
As the backslash has no special meaning in PostgreSQL, MSSQL, or SQLite, the statement will delete the record in TestTable with an Id of 1.


## Recommendation

Update to version 3.20.0 or later.
Vulnerability: GHSA-q44v-xc3g-v7jq
Summary: Moderate severity vulnerability that affects org.owasp.antisamy:antisamy
Aliases: CVE-2017-14735
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-18T17:22:11Z

OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of &colon; to construct a javascript: URL.
Vulnerability: GHSA-h5mp-5q4p-ggf5
Summary: Prototype Pollution in lodash.defaultsdeep
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T18:07:05Z

Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-f5cf-f7px-xpmh
Summary: Moderate severity vulnerability that affects org.apache.qpid:proton-j
Aliases: CVE-2016-2166
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2018-10-16T19:50:27Z

The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.
Vulnerability: GHSA-776r-w3v9-96mv
Summary: Directory Traversal in censorify.tanisjr
Aliases: CVE-2017-16157
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:46:16Z

Affected versions of `censorify.tanisjr` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-35mm-cc6r-8fjp
Summary: Cross-site scripting in actionpack
Aliases: CVE-2020-8264
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-07T20:58:47Z

In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Vulnerability: GHSA-j7m2-58wv-9v79
Summary: Vulnerability in Torpedo Query
Aliases: CVE-2019-11343
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-02-10T20:47:29Z

Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.
Vulnerability: GHSA-2hxv-mx8x-mcj9
Summary: Spina vulnerable to a cross-site request forgery (CSRF) vulnerability
Aliases: CVE-2015-4619
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2018-08-28T22:34:22Z

Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
Vulnerability: GHSA-w5m2-299g-rff5
Summary: Page Compare Reflected Cross-site Scripting (XSS) vulnerability
Aliases: CVE-2022-28820
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-26T12:59:00Z

### Impact

ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in `/apps/acs-commons/content/page-compare.html` endpoint via the `a` and `b` GET parameters. User input submitted via these parameters is not validated or sanitized.

An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.

### Patches

This issue has been resolved in 5.2.0.

### Workarounds

None 

### References

N/A

### For more information

If you have any questions or comments about this advisory open an issue in acs-aem-commons.

### Credit

This issue was discovered and reported by Black Lantern Security.

https://hackerone.com/reports/1466020
Vulnerability: GHSA-29fh-xcjr-p7rx
Summary: Malicious Package in web3-eht
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:02:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-c3m8-x3cg-qm2c
Summary: Configuration Override in helmet-csp
Severity: MODERATE
CVSS score: 6.5
Published: 2020-09-03T20:39:53Z

Versions of `helmet-csp` before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the `default-src` CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.


## Recommendation

Upgrade to version 2.9.1 or later. Setting the `browserSniff` configuration to `false` in vulnerable versions also mitigates the issue.
Vulnerability: GHSA-m94c-37g6-cjhc
Summary: Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Aliases: CVE-2021-37695
Severity: HIGH
CVSS score: 7.3
CWE: CWE-79
Published: 2021-08-23T19:42:15Z

### Affected packages
The vulnerability has been discovered in [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin. All plugins with [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin dependency are affected:

* [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)
* [Link](https://ckeditor.com/cke4/addon/link)
* [Flash](https://ckeditor.com/cke4/addon/flash)
* [Iframe](https://ckeditor.com/cke4/addon/iframe)
* [Forms](https://ckeditor.com/cke4/addon/forms)
* [Page Break](https://ckeditor.com/cke4/addon/pagebreak)

### Impact
A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Mika Kulmala ([kulmik](https://github.com/kulmik)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-xjrr-xv9m-4pw5
Summary: High severity vulnerability that affects com.alibaba:fastjson
Aliases: CVE-2017-18349
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2018-10-24T19:42:03Z

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
Vulnerability: GHSA-7q8g-gpfp-v8gx
Summary: Insertion of Sensitive Information into Log File in Apache NiFi
Aliases: CVE-2020-1942
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-532
Published: 2022-01-06T20:40:58Z

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.
Vulnerability: GHSA-46j2-xjgp-jrfm
Summary: Information disclosure issue in Active Resource
Aliases: CVE-2020-8151
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-863
Published: 2020-05-21T21:09:38Z

There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.
Vulnerability: GHSA-x95h-979x-cf3j
Summary: Policies not properly enforced in bluemonday
Aliases: CVE-2021-42576
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2021-10-19T20:15:30Z

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
Vulnerability: GHSA-7f63-h6g3-7cwm
Summary: Cross Site Scripting (XSS) in @finastra/ssr-pages
Aliases: CVE-2022-24717
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-01T22:09:25Z

A cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function.

### References
- https://github.com/Finastra/ssr-pages/pull/2
- https://github.com/Finastra/ssr-pages/pull/2/commits/133606ffaec2edd9918d9fba5771ed21da7876a5
- https://github.com/Finastra/ssr-pages/commit/98abc59e28fec48246be0d59ac144675d6361073
Vulnerability: GHSA-hrfh-fp4x-crrq
Summary: Persistent XSS in newsletter module in Shopware
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-11-13T18:26:06Z

### Impact
Persistent XSS in newsletter module

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Vulnerability: GHSA-v8wr-r69p-mmwx
Summary: Unrestricted Upload of File with Dangerous Type in Drupal core
Aliases: CVE-2020-13675
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434, CWE-284
Published: 2022-02-12T00:00:47Z

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Vulnerability: GHSA-v588-qcp3-jv46
Summary: Path Traversal in serve
Aliases: CVE-2019-5415
Severity: HIGH
CVSS score: 0
CWE: CWE-548
Published: 2019-03-25T18:03:58Z

Versions of `serve` prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a `/./`, which allows attackers to access hidden folders and files.


## Recommendation

Upgrade to version 7.0.1 or later.
Vulnerability: GHSA-x5h4-9gqw-942j
Summary: Improper Verification of Cryptographic Signature in aws-encryption-sdk
Severity: MODERATE
CVSS score: 0
CWE: CWE-347
Published: 2021-06-01T21:17:53Z

### Impact

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. 

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. 

For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to process per message. This configuration provides customers with a way to limit the number of AWS KMS Decrypt API calls that the ESDK will make per message. This setting will reject messages with more EDKs than the configured limit.

Finally, this update adds early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.

### Patches

Fixed in versions 1.9 and 2.2. We recommend that all users upgrade to address these issues.

Customers leveraging the ESDK’s streaming features have several options to protect signature validation. One is to ensure that client code reads to the end of the stream before using released plaintext. With this release, using the new API for streaming and falling back to the non-streaming decrypt API for signed messages prevents using any plaintext from signed data before the signature is validated. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

Users processing ESDK messages from untrusted sources should use the new maximum encrypted data keys parameter. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

### Workarounds

None

### For more information

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#digital-sigs

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x
Vulnerability: GHSA-pcm6-g2qp-9gw8
Summary: Cap-Strap gem for Ruby places credentials on the useradd command line
Aliases: CVE-2014-4992
Severity: HIGH
CVSS score: 7.8
CWE: CWE-200
Published: 2018-03-16T01:13:46Z

lib/cap-strap/helpers.rb in the cap-strap gem 0.1.5 for Ruby places credentials on the useradd command line, which allows local users to obtain sensitive information by listing the process.
Vulnerability: GHSA-x54v-qxxr-93qc
Summary: Missing release of memory in sized-chunks
Aliases: CVE-2020-25795
Severity: HIGH
CVSS score: 7.5
CWE: CWE-401
Published: 2021-08-25T20:45:01Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, insert_from can have a memory-safety issue upon a panic.
Vulnerability: GHSA-g2f6-v5qh-h2mq
Summary: Nexus Repository Manager 3 - Remote Code Execution 
Aliases: CVE-2020-10199
Severity: HIGH
CVSS score: 8.8
CWE: CWE-917
Published: 2020-04-14T15:27:05Z

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
Vulnerability: GHSA-pccr-q7v9-5f27
Summary: Improper Input Validation and Path Traversal in Apache Solr
Aliases: CVE-2021-44548
Severity: HIGH
CVSS score: 9.8
CWE: CWE-20, CWE-22, CWE-40
Published: 2022-01-06T21:32:35Z

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.
Vulnerability: GHSA-gf2j-f278-xh4v
Summary: Division by zero in TFLite
Aliases: CVE-2022-23557
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-369
Published: 2022-02-09T23:47:57Z

### Impact 
An attacker can craft a TFLite model that would trigger a division by zero in [`BiasAndClamp` implementation](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/lite/kernels/internal/common.h#L75):

```cc
inline void BiasAndClamp(float clamp_min, float clamp_max, int bias_size,
                         const float* bias_data, int array_size,
                         float* array_data) {
  // ...
  TFLITE_DCHECK_EQ((array_size % bias_size), 0);
  // ...
} 
```
  
There is no check that the `bias_size` is non zero.
  
### Patches
We have patched the issue in GitHub commit [8c6f391a2282684a25cbfec7687bd5d35261a209](https://github.com/tensorflow/tensorflow/commit/8c6f391a2282684a25cbfec7687bd5d35261a209).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability: GHSA-4x6v-rwh4-55jw
Summary: Pomelo allows external control of critical state data
Aliases: CVE-2019-18954
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-668
Published: 2019-12-02T18:16:34Z

Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input.
Vulnerability: GHSA-3hq6-rmv7-39vh
Summary: Injection in op-browser
Aliases: CVE-2020-7625
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:45:28Z

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.
Vulnerability: GHSA-2j58-pwwv-x666
Summary: Cross-Site Request Forgery in sqlite-web
Aliases: CVE-2021-23404
Severity: HIGH
CVSS score: 7.6
CWE: CWE-352
Published: 2021-09-09T17:10:35Z

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.
Vulnerability: GHSA-qv2g-99x4-45x6
Summary: Malicious npm package: discord-fix
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2021-01-29T18:12:07Z

The npm `discord-fix` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m4fw-77v7-924m
Summary: Moderate severity vulnerability that affects qutebrowser
Aliases: CVE-2018-1000559
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-13T15:47:57Z

qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).
Vulnerability: GHSA-h4m5-qpfp-3mpv
Summary: Directory Traversal in Babel
Aliases: CVE-2021-42771
Severity: HIGH
CVSS score: 7.8
CWE: CWE-22
Published: 2021-10-21T17:49:59Z

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
Vulnerability: GHSA-pvhp-v9qp-xf5r
Summary: High severity vulnerability that affects django-piston and django-tastypie
Aliases: CVE-2011-4103
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2018-07-23T19:50:48Z

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

Django Tastypie has a very similar vulnerability.
Vulnerability: GHSA-r8wq-qrxc-hmcm
Summary: ReDoS in LDAP schema parser
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1333
Published: 2021-11-29T17:58:59Z

https://github.com/python-ldap/python-ldap/issues/424

### Impact
The LDAP schema parser of python-ldap 3.3.1 and earlier are vulnerable to a regular expression denial-of-service attack. The issue affects clients that use ``ldap.schema`` package to parse LDAP schema definitions from an untrusted source.

### Patches
The upcoming release of python-ldap 3.4.0 will contain a workaround to prevent ReDoS attacks. The schema parser refuses schema definitions with an excessive amount of backslashes.

### Workarounds
As a workaround, users can check input for excessive amount of backslashes in schemas. More than a dozen backslashes per line are atypical.

### References
[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [python-ldap](https://github.com/python-ldap/python-ldap) tracker
Vulnerability: GHSA-939m-4xpw-v34v
Summary: Arbitrary Code Execution in blazar-dashboard
Aliases: CVE-2020-26943
Severity: MODERATE
CVSS score: 0
CWE: CWE-94
Published: 2020-10-27T17:55:04Z

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
Vulnerability: GHSA-q27f-v3r6-9v77
Summary: Improper Certificate Validation in EM-HTTP-Request
Aliases: CVE-2020-13482
Severity: HIGH
CVSS score: 7.4
CWE: CWE-295
Published: 2021-05-24T18:13:13Z

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
Vulnerability: GHSA-w8rc-pgxq-x2cj
Summary: Negative charge in shopping cart in Shopizer
Aliases: CVE-2020-11007
Severity: CRITICAL
CVSS score: 6.5
CWE: CWE-20
Published: 2020-04-22T20:59:26Z

### Impact
Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. 

### Patches
Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0

### Workarounds
Without uprading, it's possible to just apply the fixes in the same files it's done for the patch. Or you use javax constraint validation on the quantity parameter.

### References
[Input Validation](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
[Using bean validation constraint](https://javaee.github.io/tutorial/bean-validation002.html)
[Commits with fixes](https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a)
CVE Details below : 
[Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11007)
[NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11007)

### Credits
Found and solved by Yannick Gosset from Aix-Marseille University cybersecurity
master program supervised by Yassine Ilmi
Vulnerability: GHSA-c58c-w527-h77p
Summary: Deserialization of untrusted data in Apache Cayenne
Aliases: CVE-2022-24289
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2022-02-12T00:00:48Z

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.
Vulnerability: GHSA-2gc7-w4hw-rr2m
Summary: class.upload.php in verot.net omits .pht from the set of dangerous file extensions
Aliases: CVE-2019-19634
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2020-02-28T01:10:17Z

class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
Vulnerability: GHSA-g9mp-8g3h-3c5c
Summary: Improper nonce handling: potential overflow, potential state DoS
Severity: MODERATE
CVSS score: 0
Published: 2022-02-15T01:57:18Z

The Go package `github.com/flynn/noise`, a [Noise Protocol](https://noiseprotocol.org/) implementation, has two bugs in nonce handling in versions prior to v1.0.0.

### Issue 1: Potential nonce overflow

If 2^64 (~18.4 quintillion) or more messages are encrypted with `Encrypt` after handshaking, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce, resulting in a potentially catastrophic weakening of the security properties of the symmetric cipher.

This has been resolved in the patched version by returning `ErrMaxNonce` from the `CipherState` `Encrypt` and `Decrypt` methods before the reserved maximum nonce is reached. If this error is encountered, the program should handshake again to start with a fresh `CipherState`.

### Issue 2: Potential denial of service via invalid ciphertext

If an attacker sends an invalid ciphertext into one peer's `Decrypt`, the nonce is incremented unconditionally. This causes a desync of the `CipherState` due to a nonce mismatch between the peers, resulting in a failure to decrypt all subsequent messages. A new handshake will be required to establish a new `CipherState`.

This has been resolved in the patched version by returning authentication errors from `Decrypt` before incrementing the nonce. 

### Patches

Fixed in https://github.com/flynn/noise/pull/44, tagged as v1.0.0.

### Acknowledgements

These issues were discovered during [an audit](https://www.bamsoftware.com/software/dnstt/cure53-turbotunnel-2021.pdf) of a user of this package ([dnstt](https://www.bamsoftware.com/software/dnstt/)). Thanks to UC Berkley for commissioning the audit, and to David Fifield and Nathan Brown for their collaboration on the fixes. The fixed issues are noted in the audit as:

* UCB-02-003 Potential nonce overflow in Noise protocol
* UCB-02-006 DoS due to unconditional nonce increment