TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-hv5f-73mr-7vvj
Summary: Cross-site Scripting in Mattermost
Aliases: CVE-2021-37860
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-09-23T23:11:06Z

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
Vulnerability: GHSA-pq5x-rprq-8jrj
Summary: Directory Traversal in exxxxxxxxxxx
Aliases: CVE-2017-16130
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T22:06:14Z

Affected versions of `exxxxxxxxxxx` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

This vulnerability is only effective for files that have a file extension, which provides a partial mitigation. 

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jvpp-hxjj-5ccc
Summary: Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
Aliases: CVE-2015-7559
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-306, CWE-20
Published: 2019-08-01T19:17:45Z

It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
Vulnerability: GHSA-7j44-fv4x-79g9
Summary: Improper Input Validation in once_cell
Aliases: CVE-2019-16141
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-20
Published: 2021-08-25T20:44:18Z

An issue was discovered in the once_cell crate before 1.0.1 for Rust. There is a panic during initialization of Lazy.
Vulnerability: GHSA-xh99-hw7h-wf63
Summary: Unchecked validity of Facing values in PlayerActionPacket
Severity: HIGH
CVSS score: 7.5
Published: 2022-01-13T22:25:44Z

### Impact
A remote attacker may crash a server by sending `PlayerActionPacket` with invalid facing values (e.g. negative), specifically with `START_BREAK` or `CRACK_BLOCK` actions, or with a `UseItemTransactionData` (typically in `InventoryTransactionPacket`).

### Patches
f126479c37ff00a717a828f5271cf8e821d12d6c

### Workarounds
Using a plugin, cancel `DataPacketReceiveEvent` if the packet is `PlayerActionPacket` and the facing is outside the range 0-5 when receiving START_BREAK or CRACK_BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-c9hw-wf7x-jp9j
Summary: Improper Privilege Management in Tomcat
Aliases: CVE-2020-1938
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-269
Published: 2020-06-15T18:51:21Z

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: returning arbitrary files from anywhere in the web application, processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Vulnerability: GHSA-qw36-p97w-vcqr
Summary: Cookie persistence after password changes in symfony/security-bundle
Aliases: CVE-2021-41268
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-384
Published: 2021-11-24T20:05:22Z

Description
-----------

Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password. 

Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.

Resolution
----------

Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc) for branch 5.3.

Credits
-------

We would like to thank Thibaut Decherit for reporting the issue and Wouter J for fixing the issue.
Vulnerability: GHSA-fp52-qw33-mfmw
Summary: Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault
Aliases: CVE-2020-16250
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-290, CWE-345
Published: 2021-08-02T17:11:41Z

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..
Vulnerability: GHSA-83pq-466j-fc6j
Summary: Prototype Pollution in sahmat
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:17:50Z

All versions of `sahmat ` are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-jh5x-hfhg-78jq
Summary: Deserialization of Untrusted Data in Archive_Tar
Aliases: CVE-2020-28948
Severity: HIGH
CVSS score: 7.8
CWE: CWE-502
Published: 2021-04-22T16:20:50Z

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. See: https://github.com/pear/Archive_Tar/issues/33
Vulnerability: GHSA-5p3x-r448-pc62
Summary: Improper Verification of Cryptographic Signature in PySAML2
Aliases: CVE-2021-21239
Severity: LOW
CVSS score: 6.5
CWE: CWE-347
Published: 2021-01-21T14:12:18Z

### Impact

All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 <= 6.4.1` does not ensure that a signed SAML document is correctly signed. The default `CryptoBackendXmlSec1` backend is using the `xmlsec1` binary to verify the signature of signed SAML documents, but by default, `xmlsec1` accepts any type of key found within the given document. `xmlsec1` needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature.

### Patches

Users should upgrade to pysaml2 `v6.5.0`.

### Workarounds

No workaround provided at this point.

### References

This issue has been reported in the past at the xmlsec1 mailing list:
https://www.aleksey.com/pipermail/xmlsec/2013/009717.html

### Credits

- Brian Wolff

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2)
* Email us at [the incident-response address](mailto:incident-response@idpy.org)
Vulnerability: GHSA-j8jw-g6fq-mp7h
Summary: SQL injection in hibernate-core
Aliases: CVE-2020-25638
Severity: HIGH
CVSS score: 7.4
CWE: CWE-89
Published: 2022-02-09T22:57:29Z

"A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity."
Vulnerability: GHSA-pjwm-rvh2-c87w
Summary: Embedded malware in ua-parser-js
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2021-10-22T20:38:14Z

The npm package `ua-parser-js` had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/faisalman/ua-parser-js/issues/536) for details as they unfold.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xm7f-x4wx-wmgv
Summary: Out-of-bounds Read in byte
Severity: MODERATE
CVSS score: 0
CWE: CWE-125
Published: 2019-06-04T15:47:43Z

Versions of `byte` before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length



## Recommendation

Update to version 1.4.1 or later.
Vulnerability: GHSA-957j-59c2-j692
Summary: Prototype pollution vulnerability in 'getobject'
Aliases: CVE-2020-28282
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-10-12T16:26:37Z

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-8wcc-f2vq-h4gx
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0370
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-28T23:06:22Z

Stored XSS is found in Settings>Live help configuration>Personal Theme>static content. Under the NAME field put a payload {{constructor.constructor('alert(1)')()}} while creating content, and you will see that the input gets stored, and every time the user visits, the payload gets executed.
Vulnerability: GHSA-w47j-hqpf-qw9w
Summary: Out of bounds read in lazy-init
Aliases: CVE-2021-25901
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-125
Published: 2021-08-25T20:52:59Z

An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race.
Vulnerability: GHSA-9fg5-f5pj-rwcc
Summary: Hijacked Environment Variables in gruntcli
Aliases: CVE-2017-16058
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-11-09T17:43:52Z

The `gruntcli` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-x3rh-m7vp-35f2
Summary: Operation on a Resource after Expiration or Release in Jetty Server
Aliases: CVE-2019-17638
Severity: CRITICAL
CVSS score: 9.4
CWE: CWE-675, CWE-672
Published: 2020-08-05T14:52:59Z

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.).
Vulnerability: GHSA-57v4-m9jx-mh8r
Summary: Improper Input Validation
Aliases: CVE-2021-3499
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-863
Published: 2021-06-08T23:05:19Z

A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall rules when there is multiple DNS rules. It could lead to potentially lose of confidentiality, integrity or availability of a service.
Vulnerability: GHSA-pg59-2f92-5cph
Summary: Heap buffer overflow in Tensorflow
Aliases: CVE-2020-15196
Severity: HIGH
CVSS score: 8.5
CWE: CWE-119, CWE-122, CWE-125
Published: 2020-09-25T18:28:21Z

### Impact
The `SparseCountSparseOutput` and `RaggedCountSparseOutput` implementations don't validate that the `weights` tensor has the same shape as the data. The check exists for `DenseCountSparseOutput`, where both tensors are fully specified:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L110-L117

In the sparse and ragged count weights are still accessed in parallel with the data:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L199-L201

But, since there is no validation, a user passing fewer weights than the values for the tensors can generate a read from outside the bounds of the heap buffer allocated for the weights.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)
Vulnerability: GHSA-5p9j-w2wx-qx4c
Summary: Open Redirect in django-spirit
Aliases: CVE-2022-0869
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-03-07T00:00:40Z

django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.
Vulnerability: GHSA-v99v-xgjx-7m7g
Summary: Malicious Package in asnyc
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T18:40:47Z

All versions of `asnyc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-72cx-5ff9-4hhc
Summary: Cross-site scripting in markdown2 for python
Aliases: CVE-2009-3724
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-21T01:54:03Z

python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.
Vulnerability: GHSA-6h7w-fc84-x7p6
Summary: StaticFile.fromUrl can leak presence of a directory
Aliases: CVE-2021-32643
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-22
Published: 2021-05-28T15:54:39Z

### Impact

`StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority.  The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL.  If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response.  The contents and other metadata about the directory are not exposed.

This affects http4s versions:
* 0.21.7 through 0.21.23
* 0.22.0-M1 through 0.22.0-M8
* 0.23.0-M1
* 1.0.0-M1 through 1.0.0-M22

### Patches

The [patch](https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9) is available in the following versions:

* v0.21.24
* v0.22.0-RC1
* v0.23.0-RC1
* v1.0.0-M23

Note: a previous version of this advisory incorrectly referred to 0.22.0-M9 and 0.23.0-M2.

### Workarounds

Don't call `StaticFile.fromUrl` with non-file URLs.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the http4s repository](https://github.com/http4s/http4s)
* Disclose further vulnerabilities according to the [http4s security policy](https://github.com/http4s/http4s/blob/main/SECURITY.md)
Vulnerability: GHSA-8xj3-7258-w4q2
Summary: Directory Traversal in dasafio
Aliases: CVE-2017-16179
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:51:22Z

Affected versions of `dasafio` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-h96w-mmrf-2h6v
Summary: Improper Input Validation in Twisted
Aliases: CVE-2020-10108
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20, CWE-444
Published: 2020-03-31T15:42:42Z

In Twisted Web through 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
Vulnerability: GHSA-p9gf-gmfv-398m
Summary: Double free in slice_deque
Aliases: CVE-2021-29938
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:54:16Z

An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drain_filter upon a panic in a predicate function.
Vulnerability: GHSA-8c8c-4vfj-rrpc
Summary: Reflected Cross-Site Scripting in redis-commander
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T19:05:11Z

Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander.

Mitigating factors:
Flash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the [Flash NPAPI Windows plugin](https://get.adobe.com/flashplayer/otherversions/)

## Proof of concept

```
http://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\%22))}%20catch(e)%20{alert(document.domain);}//
```


## Recommendation

No direct patch for this vulnerability is currently available.

At this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.
Vulnerability: GHSA-w6j8-jc36-x5q9
Summary: Improper Neutralization of Text-Values in Object Version Preview
Aliases: CVE-2021-39166
Severity: HIGH
CVSS score: 8
CWE: CWE-79
Published: 2021-09-01T18:22:09Z

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources.
Vulnerability: GHSA-4943-9vgg-gr5r
Summary: Cross-site Scripting in quill
Aliases: CVE-2021-3163
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-10T15:38:12Z

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted `onloadstart` attribute of an IMG element) in a text field. No patch exists and no further releases are planned.

This CVE is disputed. Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser. More information can be found [here](https://github.com/quilljs/quill/issues/3364).
Vulnerability: GHSA-j5qg-46p9-w2rp
Summary: Malicious Package in jekyll-for-github-projects
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T00:33:32Z

Version 0.2.12 of `jekyll-for-github-projects` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-c697-r227-pq6h
Summary: Unrestricted Upload of File with Dangerous Type in pimcore
Aliases: CVE-2022-0263
Severity: HIGH
CVSS score: 7.8
CWE: CWE-434
Published: 2022-01-21T23:33:58Z

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore
Vulnerability: GHSA-4fx9-vc88-q2xc
Summary: Infinite loop in Pillow
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2022-03-11T23:39:27Z

JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.

If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.
Vulnerability: GHSA-23gj-368h-92pq
Summary: Path Traversal in DKPro Core
Aliases: CVE-2019-11082
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-05-29T18:05:11Z

core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.
Vulnerability: GHSA-cff7-6h4q-q5pj
Summary: Lacked element count during splitting of JWE string
Aliases: CVE-2019-18848
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-20
Published: 2019-11-14T15:25:51Z

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
Vulnerability: GHSA-35g4-qx3c-vjhx
Summary: Automatic room upgrade handling can be used maliciously to bridge a room non-consentually 
Aliases: CVE-2021-32659
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-306
Published: 2021-06-21T17:09:22Z

### Impact

If a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any mailcious admin of a bridged room can repoint the traffic to a different room without the new room being aware.


### Patches

Versions 2.6.1 and greater are patched.

### Workarounds

Disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. 

### References

The issue is patched by https://github.com/matrix-org/matrix-appservice-bridge/pull/330

### For more information]

If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: GHSA-6vfc-qv3f-vr6c
Summary: Uncontrolled Resource Consumption in markdown-it
Aliases: CVE-2022-21670
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-01-12T22:20:22Z

### Impact

Special patterns with length > 50K chars can slow down parser significantly.

```js
const md = require('markdown-it')();

md.render(`x ${' '.repeat(150000)} x  \nx`);
```


### Patches

Upgrade to v12.3.2+

### Workarounds

No.

### References

Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Vulnerability: GHSA-j9xp-92vc-559j
Summary: SQL Injection in sequelize
Aliases: CVE-2019-10748
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-11-06T17:11:10Z

Affected versions of `sequelize` are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.8.11 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.
If you are using `sequelize` 3.x, upgrade to version 3.35.1 or later.
Vulnerability: GHSA-45cp-hpc9-8347
Summary: Malicious Package in css_transform_support
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T19:52:35Z

Version 1.0.2 of `css_transform_support` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-7v5r-r995-q2x2
Summary: SSRF in repository migration
Aliases: CVE-2022-0870
Severity: MODERATE
CVSS score: 5
CWE: CWE-918
Published: 2022-03-12T00:00:34Z

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.
Vulnerability: GHSA-gp32-7h29-rpxm
Summary: Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle
Aliases: CVE-2019-9658
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-611
Published: 2019-03-14T15:39:14Z

Checkstyle prior to 8.18 loads external DTDs by default, which can potentially lead to denial of service attacks or the leaking of confidential information.
Vulnerability: GHSA-g4hj-r7r3-9rwv
Summary: OS Command Injection in gulp-scss-lint
Aliases: CVE-2020-7601
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-98
Published: 2021-05-07T16:15:37Z

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the &quot;exec&quot; function located in &quot;src/command.js&quot; via the provided options.
Vulnerability: GHSA-49r3-3h96-rwj6
Summary: Cross-Site Scripting in ids-enterprise
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-06-13T19:09:31Z

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Vulnerability: GHSA-2563-83p7-f34p
Summary: Malicious Package in requestt
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:24:41Z

All versions of `requestt` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-rh6x-qvg7-rrmj
Summary: High severity vulnerability that affects ansible
Aliases: CVE-2016-3096
Severity: HIGH
CVSS score: 7.8
CWE: CWE-59
Published: 2018-10-10T17:23:45Z

The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.
Vulnerability: GHSA-959j-5g9v-3fpq
Summary: Low severity vulnerability that affects paratrooper-newrelic
Aliases: CVE-2014-1234
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.
Vulnerability: GHSA-phwj-86vx-cfjc
Summary: Cross-site scripting in Apache Jena Fuseki
Aliases: CVE-2021-33192
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-13T15:21:35Z

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive).
Vulnerability: GHSA-p65h-233c-jxvm
Summary: Downloads Resources over HTTP in resourcehacker
Aliases: CVE-2016-10646
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-08-15T19:03:59Z

Affected versions of `resourcehacker` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `resourcehacker`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-673j-qm5f-xpv8
Summary: Arbitrary File Write Vulnerability
Severity: MODERATE
CVSS score: 0
Published: 2022-02-16T00:08:18Z

### Overview
The connection properties for configuring a pgjdbc connection are not meant to be exposed to an unauthenticated attacker. While allowing an attacker to specify arbitrary connection properties could lead to a compromise of a system, that's a defect of an application that allows unauthenticated attackers that level of control.

It's not the job of the pgjdbc driver to decide whether a given log file location is acceptable. End user applications that use the pgjdbc driver must ensure that filenames are valid and restrict unauthenticated attackers from being able to supply arbitrary values. That's not specific to the pgjdbc driver either, it would be true for any library that can write to the application's local file system.

While we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection properties to an attacker safe and we continue to suggest that applications do not allow untrusted users to specify arbitrary connection properties. We are removing them to prevent misuse and their functionality can be delegated to java.util.logging.

If you identify an application that allows remote users to specify a complete JDBC URL or properties without validating it's contents, we encourage you to notify the application owner as that may be a security defect in that specific application.

### Impact
It is possible to specify an arbitrary filename in the loggerFileName connection parameter
"jdbc:postgresql://localhost:5432/test?user=test&password=test&loggerLevel=DEBUG&loggerFile=./blah.jsp&<%Runtime.getRuntime().exec(request.getParameter(\"i\"));%>"

This creates a valid JSP file which could lead to a Remote Code Execution 

### Patches
Problem has been resolved in version 42.3.3

### Workarounds
sanitize the inputs to the driver
Vulnerability: GHSA-gcm9-cc3r-c6vj
Summary: Cross-site Scripting (XSS) in Eclipse Theia
Aliases: CVE-2020-27224
Severity: CRITICAL
CVSS score: 9.6
CWE: CWE-79
Published: 2021-04-13T15:18:09Z

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.
Vulnerability: GHSA-g7q5-pjjr-gqvp
Summary: Regular Expression Denial of Service in tough-cookie
Aliases: CVE-2017-15010
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-07-24T20:14:39Z

Affected versions of `tough-cookie` are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

If node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.


## Recommendation

Update to version 2.3.3 or later.
Vulnerability: GHSA-fw99-f933-rgh8
Summary: Out-of-bounds Read and Out-of-bounds Write in OpenCV
Aliases: CVE-2019-14492
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787, CWE-125
Published: 2021-10-12T22:09:31Z

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Vulnerability: GHSA-5p28-63mc-cgr9
Summary: Cross-Site Scripting bypass in html-purify
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-12-04T20:04:37Z

All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution.

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-jq7p-26h5-w78r
Summary: Out-of-bounds read in Apache Thrift
Aliases: CVE-2019-0210
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2021-05-18T15:32:04Z

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
Vulnerability: GHSA-vpw8-43wm-rxw5
Summary: Double free in endian_trait
Aliases: CVE-2021-29929
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:54:06Z

An issue was discovered in the endian_trait crate through 2021-01-04 for Rust. A double drop can occur when a user-provided Endian impl panics.
Vulnerability: GHSA-pwqj-h62h-q35c
Summary: Directory Traversal in goserv
Aliases: CVE-2017-16133
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:49:03Z

Affected versions of `goserv` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6hw5-6gcx-phmw
Summary: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
Aliases: CVE-2021-38698
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863
Published: 2021-09-08T20:14:56Z

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Vulnerability: GHSA-2hw2-62cp-p9p7
Summary: Access control bypass in Apache ZooKeeper
Aliases: CVE-2019-0201
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-862
Published: 2019-05-29T18:54:11Z

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Vulnerability: GHSA-q8pj-2vqx-8ggc
Summary: Denial of service in css-what
Aliases: CVE-2021-33587
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-07T22:11:39Z

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Vulnerability: GHSA-85r7-w5mv-c849
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2013-0262
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:37Z

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Vulnerability: GHSA-gp6w-ccqv-p7qr
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3729
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-08-25T14:49:58Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-mh33-7rrq-662w
Summary: Improper Certificate Validation
Aliases: CVE-2019-11324
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2019-04-19T16:55:10Z

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
Vulnerability: GHSA-7pr3-p5fm-8r9x
Summary: LiveQuery publishes user session tokens in parse-server
Aliases: CVE-2021-41109
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-09-30T17:09:47Z

### Impact
For regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload.

### Patches
Remove session token from LiveQuery payload.

### Workaround
Set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.
Vulnerability: GHSA-v5m7-53cv-f3hx
Summary: Undefined Behavior crossbeam-channel
Aliases: CVE-2020-15254
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119
Published: 2021-08-25T21:01:13Z

### Impact

The affected version of this crate's the `bounded` channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements.

### Patches

This has been fixed in crossbeam-channel 0.4.4.

We recommend users to upgrade to 0.4.4.

### References

See https://github.com/crossbeam-rs/crossbeam/pull/533, https://github.com/crossbeam-rs/crossbeam/issues/539, and https://github.com/RustSec/advisory-db/pull/425 for more details.
Vulnerability: GHSA-ghm8-mmx7-xvg2
Summary: Information Exposure in Apache Tapestry
Aliases: CVE-2021-30638
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-03-18T17:53:58Z

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.
Vulnerability: GHSA-hv53-q76c-7f8c
Summary: OS Command Injection in OpenTSDB
Aliases: CVE-2020-35476
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-08-02T17:02:21Z

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
Vulnerability: GHSA-wcp5-m52f-mhh5
Summary: Improper Restriction of XML External Entity Reference in MPXJ
Aliases: CVE-2020-25020
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2021-05-07T15:54:36Z

"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components."
Vulnerability: GHSA-wh98-p28r-vrc9
Summary: Exposure of information in Action Pack
Aliases: CVE-2022-23633
Severity: HIGH
CVSS score: 7.4
CWE: CWE-200
Published: 2022-02-11T20:49:14Z

### Impact

Under certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware.  In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request.  This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`.

Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.

### Patches

This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

### Workarounds

Upgrading is highly recommended, but to work around this problem the following middleware can be used:

```ruby
class GuardedExecutor < ActionDispatch::Executor
  def call(env)
    ensure_completed!
    super
  end

  private

    def ensure_completed!
      @executor.new.complete! if @executor.active?
    end
end

# Ensure the guard is inserted before ActionDispatch::Executor
Rails.application.configure do
  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
end
```
Vulnerability: GHSA-868x-rg4c-cjqg
Summary: Allocation of Resources Without Limits or Throttling in Apache Avro
Aliases: CVE-2021-43045
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2022-01-08T00:39:20Z

A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.
Vulnerability: GHSA-j52m-489x-v634
Summary: Double free in linea
Aliases: CVE-2019-16880
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:44:13Z

An issue was discovered in the linea crate through 0.9.4 for Rust. There is double free in the Matrix::zip_elements method.
Vulnerability: GHSA-g973-978j-2c3p
Summary: Denial of Service in SheetJS Pro
Aliases: CVE-2021-32014
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400, CWE-345
Published: 2021-07-22T19:47:15Z

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
Vulnerability: GHSA-vjrq-cg9x-rfjp
Summary: Improper Input Validation in cookie
Aliases: CVE-2017-18589
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-08-25T20:43:02Z

An issue was discovered in the cookie crate before 0.7.6 for Rust. Large integers in the Max-Age of a cookie cause a panic.
Vulnerability: GHSA-49fq-pw77-6qxj
Summary: Use after free in string-interner
Aliases: CVE-2019-16882
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2021-08-25T20:44:15Z

An issue was discovered in the string-interner crate before 0.7.1 for Rust. It allows attackers to read from memory locations associated with dangling pointers, because of a cloning flaw.
Vulnerability: GHSA-5jcf-c5rg-rmm8
Summary: High severity vulnerability that affects paperclip
Aliases: CVE-2017-0889
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2018-01-22T13:31:34Z

Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.
Vulnerability: GHSA-hx6g-q9v2-xh7v
Summary: Information exposure in elgg
Aliases: CVE-2021-3980
Severity: HIGH
CVSS score: 7.5
CWE: CWE-359
Published: 2021-12-16T15:30:48Z

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'.
Vulnerability: GHSA-mv2w-4jqc-6fg4
Summary: Command injection in libvcs and vcspull
Aliases: CVE-2022-21187
Severity: HIGH
CVSS score: 8.1
CWE: CWE-74, CWE-77
Published: 2022-03-15T00:00:53Z

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
Vulnerability: GHSA-xg75-q3q5-cqmv
Summary: Denial of Service in http-swagger
Aliases: CVE-2022-24863
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-755
Published: 2022-04-22T20:55:52Z

### Impact
Allows an attacker to perform a DOS attack consisting of memory exhaustion on the host system.

### Patches
Yes. Please upgrade to v1.2.6.

### Workarounds
A workaround is to restrict the path prefix to the "GET" method. As shown below
```
func main() {
	r := mux.NewRouter()

	r.PathPrefix("/swagger/").Handler(httpSwagger.Handler(
		httpSwagger.URL("http://localhost:1323/swagger/doc.json"), //The url pointing to API definition
		httpSwagger.DeepLinking(true),
		httpSwagger.DocExpansion("none"),
		httpSwagger.DomID("#swagger-ui"),
	)).Methods(http.MethodGet)
```

### References
Reporter dongguangli from https://www.huoxian.cn/ company

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http-swagger](https://github.com/swaggo/http-swagger/issues)