TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-52qp-jpq7-6c54
Summary: Insecure Deserialization of untrusted data in rmccue/requests
Aliases: CVE-2021-29476
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-04-29T21:52:30Z

### Impact
Unserialization of untrusted data.

### Patches
The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.

### References
Publications about the vulnerability:
* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
* https://github.com/ambionics/phpggc/issues/52
* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/
* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
* https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf
* https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f

Originally fixed in WordPress 5.5.2:
* https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
* https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/

Related Security Advisories:
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032
* https://nvd.nist.gov/vuln/detail/CVE-2020-28032

Notification to the Requests repo including a fix in:
* https://github.com/rmccue/Requests/pull/421 and
* https://github.com/rmccue/Requests/pull/422

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Request](https://github.com/WordPress/Requests/)
Vulnerability: GHSA-64q9-f38h-9mwx
Summary: Protection Mechanism Failure in Jenkins Doktor Plugin
Aliases: CVE-2022-25204
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-693
Published: 2022-02-16T00:01:18Z

Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists.
Vulnerability: GHSA-g8q2-24jh-5hpc
Summary: High severity vulnerability that affects jquery-ui
Severity: HIGH
CVSS score: 0
Published: 2018-07-27T14:47:52Z

Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
Vulnerability: GHSA-86r9-39j9-99wp
Summary: Elliptic Curve Key Disclosure in go-jose
Aliases: CVE-2016-9121
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-326
Published: 2021-06-23T17:17:52Z

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
Vulnerability: GHSA-h29f-7f56-j8wh
Summary: Moderate severity vulnerability that affects sinatra
Aliases: CVE-2018-7212
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2018-02-20T19:23:20Z

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.
Vulnerability: GHSA-365p-96qv-xr7g
Summary: ASP.NET Core allow an elevation of privilege
Aliases: CVE-2018-0787
Severity: HIGH
CVSS score: 8.8
CWE: CWE-640
Published: 2018-10-16T19:56:59Z

ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Vulnerability: GHSA-cmhx-cq75-c4mj
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2019-0820
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-400
Published: 2021-08-04T21:03:46Z

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Vulnerability: GHSA-35rf-v2jv-gfg7
Summary: Privilege escalation to cluster admin on multi-tenant environments
Aliases: CVE-2021-41254
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2021-11-15T17:35:33Z

Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges.

### Impact

Multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue.

### Exploit 

To exploit the command injection, first we create a secret with a shell command:

```sh
kubectl create secret generic exploit-token --from-literal=token=" || kubectl api-versions"
```

Then we create a Service Account that refers to the above Secret:

```yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: exploit
  namespace: default
automountServiceAccountToken: false
secrets:
- name: exploit-token
```

And finally a Kustomization that runs under the above Service Account:

```yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: exploit
  namespace: default
spec:
  interval: 5m
  path: "./deploy/"
  sourceRef:
    kind: GitRepository
    name: app
  serviceAccountName: exploit
```

When kustomize-controller reconciles the above Kustomization, it will execute the shell command from the secret.

### Patches

This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image.

### Workarounds

To prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used.

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-sa
spec:
  validationFailureAction: enforce
  background: false
  rules:
    - name: validate-sa
      match:
        resources:
          kinds:
            - ServiceAccount
          namespaces:
            - tenant1
            - tenant2
        subjects:
          - kind: User
            name: some@tenant1.com
          - kind: User
            name: some@tenant2.com
          - kind: ServiceAccount
            name: kustomize-controller
            namespace: flux-system
          - kind: ServiceAccount
            name: helm-controller
            namespace: flux-system
      validate:
        message: "Invalid service account"
        pattern:
          X(secrets): "*?"
```

### References

Disclosed by ADA Logics in a security audit of the Flux project sponsored by CNCF and facilitated by OSTIF.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [kustomize-controller repository](http://github.com/fluxcd/kustomize-controller)
Vulnerability: GHSA-g5gj-9ggf-9vmq
Summary: Infinite certificate chain depth results in OctoRPKI running forever
Aliases: CVE-2021-3908
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2021-11-10T20:38:53Z

OctoRPKI does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end.

## Patches 

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-pq4w-qm9g-qx68
Summary: Insufficient Nonce Validation in Eclipse Milo Client
Aliases: CVE-2019-19135
Severity: HIGH
CVSS score: 7.4
CWE: CWE-330, CWE-522
Published: 2020-03-16T22:46:50Z

### Impact
Credential replay affecting those connected to a server when *all 3* of the following conditions are met:
- `SecurityPolicy` is `None`
- using username/password or X509-based authentication
- the server has a defect causing it to send null/empty or zeroed nonces 

### Patches
The problem has been patched in version `0.3.6`. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version `0.3.7`.

### Workarounds
Do not use username/password or X509-based authentication with `SecurityPolicy` of `None`.

### References
https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf

### For more information
If you have any questions or comments about this advisory:
* Open an issue at [https://github.com/eclipse/milo/issues](https://github.com/eclipse/milo/issues)
* Email [the mailing list](mailto:milo-dev@eclipse.org)
Vulnerability: GHSA-cfm4-qjh2-4765
Summary: Improper Verification of Cryptographic Signature in node-forge
Aliases: CVE-2022-24771
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2022-03-18T23:09:54Z

### Impact

RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### References

For more information, please see
["Bleichenbacher's RSA signature forgery based on implementation error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
by Hal Finney.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
Vulnerability: GHSA-jpcq-cgw6-v4j6
Summary: Potential XSS vulnerability in jQuery
Aliases: CVE-2020-11023
Severity: MODERATE
CVSS score: 6.9
CWE: CWE-79
Published: 2020-04-29T22:19:14Z

### Impact
Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-q66c-h853-gqw2
Summary: AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
Aliases: CVE-2016-4432
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-287
Published: 2018-10-16T19:49:48Z

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Vulnerability: GHSA-4g4c-8gqh-m4vm
Summary: Inclusion of Functionality from Untrusted Control Sphere in Ruby
Aliases: CVE-2019-13589
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-829
Published: 2019-07-16T00:41:55Z

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
Vulnerability: GHSA-p692-7mm3-3fxg
Summary: actionpack is vulnerable to remote bypass authentication
Aliases: CVE-2015-7576
Severity: LOW
CVSS score: 3.7
Published: 2017-10-24T18:33:36Z

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Vulnerability: GHSA-g4cp-h53p-v3v8
Summary: Allocation of Resources Without Limits or Throttling in Undertow
Aliases: CVE-2020-10705
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2021-04-30T17:28:42Z

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.
Vulnerability: GHSA-x6m6-5hrf-fh6r
Summary: Denial of Service in markdown-it-toc-and-anchor
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-09-01T21:26:50Z

All versions of `markdown-it-toc-and-anchor` are vulnerable to Denial of Service. Parsing markdown containing `**text**+\n@[toc]` causes the application to enter and infinite loop.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-vj3f-3286-r4pf
Summary: Path Traversal in Docker
Aliases: CVE-2014-9356
Severity: HIGH
CVSS score: 5.9
CWE: CWE-22
Published: 2021-05-18T21:09:17Z

Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.
Vulnerability: GHSA-vq23-5h4f-vwpv
Summary: Update unsound DrainFilter and RString::retain
Aliases: CVE-2020-36212
Severity: HIGH
CVSS score: 0
CWE: CWE-672
Published: 2021-08-25T21:01:35Z

An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop.
Vulnerability: GHSA-qqgx-2p2h-9c37
Summary: Prototype Pollution
Aliases: CVE-2020-7788
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2020-12-10T16:53:45Z

### Overview
The `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.

If an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.

### Patches

This has been patched in 1.3.6

### Steps to reproduce

payload.ini
```
[__proto__]
polluted = "polluted"
```

poc.js:
```
var fs = require('fs')
var ini = require('ini')

var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
console.log(parsed)
console.log(parsed.__proto__)
console.log(polluted)
```

```
> node poc.js
{}
{ polluted: 'polluted' }
{ polluted: 'polluted' }
polluted
```
Vulnerability: GHSA-m7h5-fjjq-559f
Summary: SQL Injection in topthink/thinkphp
Aliases: CVE-2020-20120
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-09-30T17:11:11Z

ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.
Vulnerability: GHSA-mc8v-mgrf-8f4m
Summary: Clarify Content-Type handling
Aliases: CVE-2021-41190
Severity: LOW
CVSS score: 3
CWE: CWE-843
Published: 2021-11-18T16:13:08Z

### Impact
In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently.

### Patches
The OCI Distribution Specification will be updated to require that a `mediaType` value present in a manifest or index match the Content-Type header used during the push and pull operations.

### Workarounds
Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.

### References
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/opencontainers/distribution-spec/
* Email us at security@opencontainers.org
Vulnerability: GHSA-9xww-fwh9-95c5
Summary: Malicious Package in uglyfi-js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:43:59Z

Version 3.4.6 of `uglyfi-js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-5854-jvxx-2cg9
Summary: Denial of Service in subtext
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:46:57Z

Versions of `subtext` >=4.1.0 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/subtext`. Please update your dependencies to use `@hapi/subtext`.
Vulnerability: GHSA-9cxh-gqpx-qc5m
Summary: Credential Disclosure in System.DirectoryServices.Protocols
Aliases: CVE-2021-41355
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-200
Published: 2021-10-12T17:49:25Z

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux.

### Patches
Any .NET application that uses `System.DirectoryServices.Protocols` with a vulnerable version listed below on system based on Linux.

Package name | Vulnerable versions | Secure versions
------------ | ---------------- | -------------------------
System.DirectoryServices.Protocols | 5.0.0  | 5.0.1

### Other Details

- Announcement for this issue can be found at dotnet/announcements#202
- An Issue for this can be found at https://github.com/dotnet/runtime/issues/60301
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355
Vulnerability: GHSA-hr3h-x6gq-rqcp
Summary: Cross site scripting via HTML attributes in the back end
Aliases: CVE-2021-35955
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-79
Published: 2021-08-25T14:45:01Z

### Impact

It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end).

Installations are only affected if there are untrusted back end users who have the rights to modify HTML fields (e.g. TinyMCE).

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7

### Workarounds

Disable all fields that allow HTML for untrusted back end users or disable the login for these users.

### References

https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

### Credits

Thanks to Mikhail Khramenkov and Moritz Vondano for reporting this security issue.
Vulnerability: GHSA-79p8-4cwq-rhqh
Summary: Directory Traversal in jn_jj_server
Aliases: CVE-2017-16210
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:40:07Z

Affected versions of `jn_jj_server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4w5x-x539-ppf5
Summary: Incorrect handling of credential expiry by NATS Server
Aliases: CVE-2020-26892
Severity: HIGH
CVSS score: 5.9
CWE: CWE-798
Published: 2022-02-11T23:42:20Z


## Problem Description

NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.

The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API.

A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this.  The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it.

The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.


## Affected versions

#### JWT library

 * all versions prior to 1.1.0
 * fixed after nats-io/jwt PR 103 landed (2020-10-06)

#### NATS Server

 * Version 2 prior to 2.1.9
   + 2.0.0 through and including 2.1.8 are vulnerable.
 * fixed with nats-io/nats-server PRs 1632, 1635, 1645


## Impact

Time-based credential expiry did not work.


## Workaround

Have credentials which only expire after fixes can be deployed.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.
Vulnerability: GHSA-968f-66r5-5v74
Summary: HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
Aliases: CVE-2019-16789
Severity: HIGH
CVSS score: 7.1
CWE: CWE-444
Published: 2020-01-06T18:44:21Z

### Impact

The patches introduced to fix https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 were not complete and still would allow an attacker to smuggle requests/split a HTTP request with invalid data.

This updates the existing CVE with ID: CVE-2019-16789

### Patches

Waitress version 1.4.2 has been updated to now validate HTTP headers better to avoid the issue, completely fixing all known issues with whitespace.

### Workarounds

There are no work-arounds, upgrading to Waitress 1.4.2 is highly recommended.

### References

See https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4 for more information on the security issue.

### For more information

If you have any questions or comments about this advisory:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: GHSA-ff5x-w9wg-h275
Summary: Holder can generate proof of ownership for credentials it does not control in vp-toolkit
Severity: HIGH
CVSS score: 0
Published: 2020-03-06T01:15:46Z

### Impact
The [`verifyVerifiablePresentation()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-presentation-signer.ts#L97) method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the [`credentialSubject.id`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L150) DID matches the signer of the VP proof.

The **verifier** is impacted by this vulnerability.

### Patches
Patch will be available in version 0.2.2.

### Workarounds
- Compute the address out of the `verifiablePresentation.proof.n.verificationMethod` using `getAddressFromPubKey()` from `crypt-util@0.1.5` and match it with the `credentialSubject.id` address from the credential.

### References
[Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/14)

### For more information
If you have any questions or comments about this advisory:
* Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/14)
* [Contact me](https://github.com/rabomarnix)
Vulnerability: GHSA-89gc-6cw6-4vch
Summary: Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI
Aliases: CVE-2016-9177
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-10-04T19:53:35Z

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Vulnerability: GHSA-f9cv-665r-275h
Summary: Prototype Pollution in merge-change
Aliases: CVE-2021-23421
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-09-01T18:36:01Z

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
Vulnerability: GHSA-gvff-25cc-4f66
Summary: Path Traversal in restify-swagger-jsdoc
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T17:15:56Z

Versions of `restify-swagger-jsdoc` prior to 3.2.1 are vulnerable to Path Traversal.  The package fails to properly sanitize URLs, which may allow attackers to access server files outside the `swagger-ui` folder by using relative paths.  



## Recommendation

Upgrade to version 3.2.1 or later.
Vulnerability: GHSA-rvpq-5xqx-pfpp
Summary: High severity vulnerability that affects rails
Aliases: CVE-2006-4111
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:38Z

Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOAD_PATH variable, a different vulnerability than CVE-2006-4112.
Vulnerability: GHSA-gm8g-xhh8-rmwr
Summary: Prototype Pollution in doc-path
Aliases: CVE-2020-7772
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-10T19:17:25Z

This affects the package doc-path before 2.1.2.
Vulnerability: GHSA-h9jc-284h-533g
Summary: Context isolation bypass via contextBridge in Electron
Aliases: CVE-2020-4077
Severity: HIGH
CVSS score: 7.7
CWE: CWE-501
Published: 2020-07-07T00:01:10Z

### Impact
Apps using both `contextIsolation` and `contextBridge` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-vf94-36g5-69v8
Summary: Division by zero in TFLite's implementation of `DepthToSpace`
Aliases: CVE-2021-29595
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:27:49Z

### Impact
The implementation of the `DepthToSpace` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/depth_to_space.cc#L63-L69):

```cc
const int block_size = params->block_size;
...
const int input_channels = input->dims->data[3];
... 
int output_channels = input_channels / block_size / block_size;
``` 

An attacker can craft a model such that `params->block_size` is 0.

### Patches
We have patched the issue in GitHub commit [106d8f4fb89335a2c52d7c895b7a7485465ca8d9](https://github.com/tensorflow/tensorflow/commit/106d8f4fb89335a2c52d7c895b7a7485465ca8d9).
    
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-5xmj-wm96-fmw8
Summary: Moderate severity vulnerability that affects actionpack
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:54:37Z

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.
Vulnerability: GHSA-h6gw-r52c-724r
Summary: NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-476, CWE-824
Published: 2022-02-09T23:38:36Z

### Impact 
The [code for boosted trees in TensorFlow](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/kernels/boosted_trees/stats_ops.cc) is still missing validation. This allows malicious users to read and write outside of bounds of heap allocated data as well as trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures).

This follows after CVE-2021-41208 where these APIs were still vulnerable to multiple security issues.

**Note**: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs.  Instead, please use the downstream [TensorFlow Decision Forests](https://github.com/tensorflow/decision-forests) project which is newer and supports more features. 
  
These APIs are now deprecated in TensorFlow 2.8. We will remove TensorFlow's boosted trees APIs in subsequent releases.
  
### Patches
We have patched the known issues in multiple GitHub commits.
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

This should allow users to use existing boosted trees APIs for a while until they migrate to [TensorFlow Decision Forests](https://github.com/tensorflow/decision-forests), while guaranteeing that known vulnerabilities are fixed.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
These vulnerabilities have been reported by Yu Tian of Qihoo 360 AIVul Team and Faysal Hossain Shezan from University of Virginia. Some of the issues have been discovered internally after a careful audit of the APIs.
Vulnerability: GHSA-2gw2-8q9w-cw8p
Summary: Ruby-ffi has a DLL loading issue 
Aliases: CVE-2018-1000201
Severity: HIGH
CVSS score: 7.8
CWE: CWE-426
Published: 2018-08-31T14:55:43Z

ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
Vulnerability: GHSA-4qq9-rrq6-48ff
Summary: Moderate severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17193
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-12-20T22:02:39Z

The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-2fqw-684c-pvp7
Summary: An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
Aliases: CVE-2020-35213
Severity: HIGH
CVSS score: 8.1
CWE: CWE-74
Published: 2021-12-17T20:40:50Z

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
Vulnerability: GHSA-jgm9-xpfj-4fq6
Summary: Path traversal in Onionshare
Aliases: CVE-2022-21693
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-22
Published: 2022-01-21T23:20:19Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-013
- Vulnerability type: Improper Hardening
- Threat level: Low

## Description:

The filesystem restriction could be hardened and should only allow for pre-defined subfolders.

## Technical description:

The Flatpak and Snap configurations allow for read-only access on the whole home folder. The relevant lines in the configuration files are `onionshare/snap/snapcraft.yaml#L20` and `onionshare/flatpak/org.onionshare.OnionShare.yaml#L19` , respectively.

The encapsulation of filesystem access via these mechanisms should be restricted to pre-defined folders and not allow for access to (configuration) files outside the Onionshare-specific folders.

Sadly Snap does not allow for further restriction to specific folders and therefore cannot be further hardened. By default both frameworks disallow access to hidden folders and therefore reduce the potential impact.

## Impact:

An adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced.

## Recommendation:

- Reduce read access in Flatpak configuration.
Vulnerability: GHSA-m358-g4rp-533r
Summary: SQL Injection in Casdoor
Aliases: CVE-2022-24124
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2022-02-01T00:49:39Z

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Vulnerability: GHSA-qfxv-qqvg-24pg
Summary: OS Command Injection in im-metadata
Aliases: CVE-2019-10788
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:17:36Z

im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
Vulnerability: GHSA-2p99-6f47-8x9j
Summary: Malicious Package in asnc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:38:39Z

All versions of `asnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-j239-4gqg-5j54
Summary: Inadequate Encryption Strength
Aliases: CVE-2017-1000486
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-326
Published: 2021-06-03T19:22:22Z

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
Vulnerability: GHSA-c8xf-m4ff-jcxj
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2016-1000339
Severity: MODERATE
CVSS score: 5.3
Published: 2018-10-17T16:23:38Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
Vulnerability: GHSA-57hg-26h7-9qgv
Summary: pimcore is vulnerable to Cross-site Scripting
Aliases: CVE-2022-0256
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-21T23:48:07Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-m6m5-pp4g-fcc8
Summary: S3 storage write is not aborted on errors leading to unbounded memory usage
Severity: HIGH
CVSS score: 7.5
CWE: CWE-772
Published: 2021-10-06T17:47:35Z

### Impact

Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.
```
storage.imapsql local_mailboxes {
  ...
  msg_store s3 {
    ...
  }
}
```

### Patches

The relevant commit is pushed to master and will be included in the 0.5.1 release.

No special handling of the issue has been done due to the small amount of affected users.

### Workarounds

None.

### References

* Original report: https://github.com/foxcpp/maddy/issues/395
* Fix: https://github.com/foxcpp/maddy/commit/07c8495ee4394fabbf5aac4df8aebeafb2fb29d8
Vulnerability: GHSA-xhg2-rvm8-w2jh
Summary: Cross-site Request Forgery (CSRF)
Aliases: CVE-2019-13209
Severity: HIGH
CVSS score: 8.7
CWE: CWE-352, CWE-79
Published: 2021-05-18T15:42:40Z

Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher. The attack requires a victim to be logged into a Rancher server, and then to access a third-party site hosted by the exploiter. Once that is accomplished, the exploiter is able to execute commands against the cluster's Kubernetes API with the permissions and identity of the victim.
Vulnerability: GHSA-wq7q-7vfh-2x3h
Summary: Downloads Resources over HTTP in install-nw
Aliases: CVE-2016-10566
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:09Z

Affected versions of `install-nw` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `install-nw`.


## Recommendation

Update to version 1.1.5 or later.
Vulnerability: GHSA-wpg7-2c88-r8xv
Summary: Exposure of Sensitive Information in simple-get
Aliases: CVE-2022-0355
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-01-28T22:54:16Z

In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party.
Vulnerability: GHSA-vx8q-j7h9-vf6q
Summary: Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin
Aliases: CVE-2022-0813
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-03-11T00:02:24Z

PhpMyAdmin before 5.1.3 allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
Vulnerability: GHSA-p62g-jhg6-v3rq
Summary: Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible
Aliases: CVE-2020-10684
Severity: LOW
CVSS score: 7.1
CWE: CWE-94, CWE-862, CWE-362, CWE-250
Published: 2021-04-07T20:37:06Z

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Vulnerability: GHSA-39qv-prmh-x37f
Summary: Prototype Pollution in @strikeentco/set
Aliases: CVE-2021-23497
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2022-02-05T00:00:26Z

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821
Vulnerability: GHSA-wwrj-35w6-77ff
Summary: CSRF vulnerability in save-server
Aliases: CVE-2020-15135
Severity: MODERATE
CVSS score: 6.7
CWE: CWE-352
Published: 2020-08-04T14:54:08Z

### Impact
Versions prior to version v1.05 are affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version v1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version.

This is patched by implementing [Double submit](https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f).

The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including:
- Upload file
- Delete file
- Add redirect


#### If you are logged in as root, this attack is significantly more severe. They can (in addition to the above):
- Create users
- Delete users
- Update users (change password)

If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password.

Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. 
### Patches
This issue has been patched. Update to version v1.0.7 or above to benefit from this fix.

### Workarounds
None. You should upgrade.

### References
What is CSRF: https://owasp.org/www-community/attacks/csrf
Fix type: https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Save-server](https://github.com/Neztore/save-server/)
* Email us at [hi@nezto.re](mailto:hi@nezto.re)
* Join our discord (preferred): [Invite](https://discord.gg/QevWabU)
Vulnerability: GHSA-h2rj-8wgg-mm43
Summary: Cross-site Scripting in craftcms
Aliases: CVE-2021-32470
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-18T17:53:37Z

Craft CMS before 3.6.13 has an XSS vulnerability.
Vulnerability: GHSA-64wv-8vwp-xgw2
Summary: Use of Uninitialized Resource in ash.
Aliases: CVE-2021-45688
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:13:02Z

An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
Vulnerability: GHSA-qr32-j4j6-3m7r
Summary: Command Injection in fs-git
Aliases: CVE-2017-16087
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2019-05-29T20:23:00Z

Affected versions of `fs-git` do not sanitize strings passed into the `buildCommand` method, resulting in arbitrary code execution.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-xpfp-f569-q3p2
Summary: SQL Injection in Django
Aliases: CVE-2021-35042
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-09-22T17:34:49Z

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
Vulnerability: GHSA-5hmm-x8q8-w5jh
Summary: LDAP authentication bypass with empty password
Aliases: CVE-2020-26214
Severity: HIGH
CVSS score: 9.1
CWE: CWE-287
Published: 2020-11-06T17:35:49Z

### Impact
Users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider.

Only deployments where LDAP servers are configured to allow unauthenticated binds (eg. default on Active Directory) are affected.

### Patches
A fix has been implemented that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. See https://github.com/alerta/alerta/pull/1345

### Workarounds
LDAP administrators can disallow unauthenticated bind requests by clients.

### References
https://tools.ietf.org/html/rfc4513#section-5.1.2
https://pypi.org/project/alerta-server/8.1.0/

### For more information
If you have any questions or comments about this advisory:
* Add a comment to the issue [#1277](https://github.com/alerta/alerta/issues/1277)
* Email us at [admin@alerta.dev](mailto:admin@alerta.dev)
Vulnerability: GHSA-8h2g-r292-j8xh
Summary: L7 deny intention results in an allow action
Aliases: CVE-2021-36213
Severity: HIGH
CVSS score: 7.5
Published: 2021-07-19T21:21:12Z

In HashiCorp Consul before 1.10.1 (and Consul Enterprise), xds can generate a situation where a single L7 deny intention (with a default deny policy) results in an allow action.
Vulnerability: GHSA-pvv8-8fx9-h673
Summary: Path Traversal in @backstage/plugin-scaffolder-backend 
Aliases: CVE-2021-41151
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-22
Published: 2021-10-19T15:28:03Z

### Impact

A malicious actor could read sensitive files from the environment where Scaffolder tasks are run. The attack is executed by crafting a custom Scaffolder template with a `publish:github:pull-request` action using a particular source path. When the template is executed the sensitive files would be included in the published pull request.

This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request.

### Patches

The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-cg3q-59w7-rvc2
Summary: Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
Aliases: CVE-2021-3818
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-565
Published: 2021-09-29T17:12:51Z

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability in one application to cause a compromise in another.