TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-cm9w-c4rj-r2cf
Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component
Aliases: CVE-2022-24722
Severity: HIGH
CVSS score: 8.1
CWE: CWE-79
Published: 2022-03-02T22:24:05Z

This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display.

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github/view_component](http://github.com/github/view_component) project
Vulnerability: GHSA-v8mp-hhjq-h4cj
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0965
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:46Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.ofd` file upload.
Vulnerability: GHSA-6xhf-x49c-m5m6
Summary: Github Token Leak in aegir
Aliases: CVE-2017-16225
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2018-07-24T20:04:11Z

Affected versions of `aegir` bundle and publish the current users github token to npm when `aegir-release` is executed.


## Recommendation

Update to version 12.0.8 or later.

If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.
Vulnerability: GHSA-fvwr-h9xh-m6wc
Summary: Denial of Service in @commercial/subtext
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T20:33:17Z

Versions of `@commercial/subtext` prior to 5.1.1 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 5.1.1 or later.
Vulnerability: GHSA-gmxv-xf2q-6j8m
Summary: Cross-Site Scripting in m-server
Aliases: CVE-2018-16484
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2019-02-07T18:16:16Z

Versions of `m-server` before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that `m-server` is serving.


## Recommendation

Update to version 1.4.2 or later.
Vulnerability: GHSA-9wv8-jgw4-4g28
Summary: High severity vulnerability that affects festivaltts4r
Severity: HIGH
CVSS score: 0
Published: 2018-08-15T20:04:13Z

Withdrawn, accidental duplicate publish.

The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.
Vulnerability: GHSA-rmff-f8w9-c9rm
Summary: Data races in max7301
Aliases: CVE-2020-36472
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-362
Published: 2021-08-25T20:59:22Z

The `ImmediateIO` and `TransactionalIO` types implement `Sync` for all contained
`Expander<EI>` types regardless of if the `Expander` itself is safe to use
across threads.

As the `IO` types allow retrieving the `Expander`, this can lead to non-thread
safe types being sent across threads as part of the `Expander` leading to data
races.
Vulnerability: GHSA-r8f7-9pfq-mjmv
Summary: Improper Certificate Validation in node-sass
Aliases: CVE-2020-24025
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-295
Published: 2022-02-09T22:22:24Z

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
Vulnerability: GHSA-6f54-3qr9-pjgj
Summary: Unauthenticated Access Via OAI-PMH
Aliases: CVE-2020-5228
Severity: HIGH
CVSS score: 7.6
CWE: CWE-862
Published: 2020-01-30T21:22:06Z

### Impact

Media publication via OAI-PMH allows unauthenticated public access to all media and metadata by default. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge.


### Patches

The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.

### Workarounds

In the organization security configuration (`etc/security/mh_default_org.xml`), change the roles required for accessing `/oaipmh` from `ROLE_ANONYMOUS` to `ROLE_ADMIN`.

### References

- [Public access configuration in the organization's security configuration](https://github.com/opencast/opencast/blob/1fb812c7810c78f09f29a7f455ff920417924307/etc/security/mh_default_org.xml#L271-L276)

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-3627-w2qr-5fxr
Summary: Downloads Resources over HTTP in fuseki
Aliases: CVE-2016-10576
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:52:07Z

Affected versions of `fuseki` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fuseki`.


## Recommendation

Update to version 1.0.1 or later.
Vulnerability: GHSA-w364-8vfv-gvf5
Summary: Downloads Resources over HTTP in phantomjs-cheniu
Aliases: CVE-2016-10661
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:52Z

Affected versions of `phantomjs-cheniu` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `phantomjs-cheniu`.


## Recommendation

No patch is currently available for this vulnerability.

As this package is just a fork of Medium's [`phantomjs-prebuilt`](https://github.com/Medium/phantomjs) package, the best mitigation is currently to install the `Medium` version of [`phantomjs-prebuilt`](https://github.com/Medium/phantomjs). This can be done via the following command:
```
npm i phantomjs-prebuilt
```
Vulnerability: GHSA-78rc-8c29-p45g
Summary: High severity vulnerability that affects actionpack
Aliases: CVE-2016-2098
Severity: HIGH
CVSS score: 7.3
CWE: CWE-20
Published: 2017-10-24T18:33:35Z

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Vulnerability: GHSA-q263-fvxm-m5mw
Summary: Heap out of bounds access in MakeEdge in TensorFlow
Aliases: CVE-2020-26271
Severity: LOW
CVSS score: 4.4
CWE: CWE-908, CWE-125
Published: 2020-12-10T19:07:34Z

### Impact
Under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The [`MakeEdge` function](https://github.com/tensorflow/tensorflow/blob/3616708cb866365301d8e67b43b32b46d94b08a0/tensorflow/core/common_runtime/graph_constructor.cc#L1426-L1438) creates an edge between one output tensor of the `src` node (given by `output_index`) and the input slot of the `dst` node (given by `input_index`). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding `DataType` values and comparing these for equality:

```cc
  DataType src_out = src->output_type(output_index);
  DataType dst_in = dst->input_type(input_index);
  //...
```

However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays.

In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library.

### Patches
We have patched the issue in GitHub commit [0cc38aaa4064fd9e79101994ce9872c6d91f816b](https://github.com/tensorflow/tensorflow/commit/0cc38aaa4064fd9e79101994ce9872c6d91f816b) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-23vf-5g53-hm9q
Summary: Directory Traversal in list-n-stream
Aliases: CVE-2017-16084
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T14:57:31Z

Affected versions of `list-n-stream` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to version 0.0.11 or later.
Vulnerability: GHSA-jwqm-c9f2-2cq3
Summary: Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit 
Aliases: CVE-2019-10240
Severity: HIGH
CVSS score: 8.1
CWE: CWE-319, CWE-829, CWE-494
Published: 2019-04-15T16:19:23Z

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
Vulnerability: GHSA-xrg3-hmf3-rvgw
Summary: Path Traversal in rust-embed
Aliases: CVE-2021-45712
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-01-06T22:03:56Z

An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode.
Vulnerability: GHSA-4m72-rmm9-2qjr
Summary: Moderate severity vulnerability that affects feedparser
Aliases: CVE-2011-1158
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-23T19:51:43Z

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
Vulnerability: GHSA-c332-w4jm-55wv
Summary: Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Aliases: CVE-2021-31409
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-04T17:42:02Z

Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Vulnerability: GHSA-r9cr-hvjj-496v
Summary: Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
Aliases: CVE-2022-24730
Severity: HIGH
CVSS score: 7.7
CWE: CWE-284, CWE-22
Published: 2022-03-24T00:04:03Z

### Impact

All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server.

A malicious Argo CD user who has been granted [`get` access for a repository](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) containing a Helm chart can craft an API request to the `/api/v1/repositories/{repo_url}/appdetails` endpoint to leak the contents of out-of-bounds files from the repo-server.

The malicious payload would reference an out-of-bounds file, and the contents of that file would be returned as part of the response. Contents from a non-YAML file may be returned as part of an error message. The attacker would have to know or guess the location of the target file.

Sensitive files which could be leaked include files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any secrets which have been mounted as files on the repo-server.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.6
* v2.1.11

The patches do two things:
 1) prevent path traversal
 2) limit `/api/v1/repositories/{repo_url}/appdetails` access to users who either A) have been granted Application `create` privileges or B) have been granted Application `get` privileges _and_ are requesting details for a `repo_url` that has already been used for the given Application

### Workarounds

The only certain way to avoid the vulnerability is to upgrade. 

To mitigate the problem, you can 
* avoid storing secrets in git
* avoid mounting secrets as files on the repo-server
* avoid decrypting secrets into files on the repo-server
* carefully [limit who has `get` access for repositories](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions)

### References

* [Security documentation for the repo-server component](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#git-helm-repositories)
* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#)

### For more information

Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Vulnerability: GHSA-qrrc-ww9x-r43g
Summary: Improper Input Validation in Docker Engine
Aliases: CVE-2020-13401
Severity: HIGH
CVSS score: 6
CWE: CWE-20
Published: 2022-02-15T01:57:18Z

An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
Vulnerability: GHSA-4mpj-488r-vh6m
Summary: Path traversal in Neo4j Graph Database
Aliases: CVE-2021-42767
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-22
Published: 2022-02-01T22:01:14Z

### Impact
Directory Traversal Vulnerabilities found in several functions of apoc plugins in Neo4j Graph database. The attacker can retrieve and download files from outside the configured directory on the affected server. Under some circumstances, the attacker can also create files.

### Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability (for Neo4j 4.2, 4.3, and 4.4 bundled with APOC, upgrade to the appropriate patched version):
3.5 - bundle n/a, standalone 3.5.0.17
4.2 - bundle 4.2.13, standalone 4.2.10
4.3 - bundle 4.3.9, standalone 4.3.0.4
4.4 - bundle 4.4.2, standalone 4.4.0.1

### Workarounds
If you cannot upgrade the library, you can control the [allowlist of the functions](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist) that can be used in your system:


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)
* Email us at [security@neo4j.com](mailto:security@neo4j.com)

### Credits
We want to publicly recognize the contribution of Nicolai Grødum from the Red Team of PwC Norway for reporting this issue and following the responsible disclosure [policy](https://neo4j.com/trust-center/responsible-disclosure/).
Vulnerability: GHSA-qcgx-crrx-38v5
Summary: Denial of service in DataCommunicator class in Vaadin 8
Aliases: CVE-2021-33609
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-400
Published: 2021-10-13T18:54:09Z

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Vulnerability: GHSA-33c7-2mpw-hg34
Summary: Log injection in uvicorn
Aliases: CVE-2020-7694
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94, CWE-116
Published: 2020-07-29T18:07:16Z

This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request crafted URLs with percent-encoded escape sequences, the logging component will log the URL after it's been processed with urllib.parse.unquote, therefore converting any percent-encoded characters into their single-character equivalent, which can have special meaning in terminal emulators. By requesting URLs with crafted paths, attackers can: * Pollute uvicorn's access logs, therefore jeopardising the integrity of such files. * Use ANSI sequence codes to attempt to interact with the terminal emulator that's displaying the logs (either in real time or from a file).
Vulnerability: GHSA-x4rg-4545-4w7w
Summary: Improper Input Validation and Excessive Iteration in Go Facebook Thrift
Aliases: CVE-2019-3564
Severity: HIGH
CVSS score: 7.5
CWE: CWE-834, CWE-20, CWE-755
Published: 2022-02-15T01:57:18Z

Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
Vulnerability: GHSA-pc4w-8v5j-29w9
Summary: Deserialization of Untrusted Data in Neo4j
Aliases: CVE-2021-34371
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-09-01T18:31:29Z

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.
Vulnerability: GHSA-pgjj-866w-fc5c
Summary: Risk of code injection
Aliases: CVE-2021-21278
Severity: HIGH
CVSS score: 8.6
CWE: CWE-74
Published: 2021-10-12T16:03:43Z

### Impact
Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues

### Patches
Temporarily removed the problematic route and added a `no-new-func` rule to eslint
Self-built users should upgrade to 7f1c430 and later as soon as possible

### Credits
Tencent Woodpecker Security Team

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues)
* Email us at [i@diygod.me](mailto:i@diygod.me)
Vulnerability: GHSA-2xv3-h762-ccxv
Summary: Out-of-bounds Read in concat-with-sourcemaps
Severity: MODERATE
CVSS score: 0
CWE: CWE-125
Published: 2019-05-29T19:18:02Z

Versions of `concat-with-sourcemaps` before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator.


## Recommendation

Update to version 1.0.6 or later.
Vulnerability: GHSA-48mj-p7x2-5jfm
Summary: Basic auth bypass in esphome
Aliases: CVE-2021-41104
Severity: HIGH
CVSS score: 7.5
CWE: CWE-306
Published: 2021-09-29T17:09:14Z

### Impact

Anyone with web_server enabled and HTTP basic auth configured on 2021.9.1 or older

`web_server` allows OTA update without checking user defined basic auth username & password

### Patches

Patch released in 2021.9.2

### Workarounds

Disable/remove `web_server`
Vulnerability: GHSA-gjcw-v447-2w7q
Summary: Forgeable Public/Private Tokens in jws
Aliases: CVE-2016-1000223
Severity: HIGH
CVSS score: 8.7
Published: 2020-09-01T15:23:18Z

Affected versions of the `jws` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the end result is a complete authentication bypass with minimal effort.




## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-pv8x-p9hq-j328
Summary: Arbitrary Code Execution in mathjs
Aliases: CVE-2017-1001003
Severity: CRITICAL
CVSS score: 0
CWE: CWE-88
Published: 2017-12-18T22:27:53Z

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.


## Recommendation

Upgrade to version 3.17.0 or later.
Vulnerability: GHSA-2mxc-m4c3-wqhq
Summary: Malicious Package in ruffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:50:46Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-j3qq-qvc8-c6g7
Summary: Malicious Package in foever
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:15:09Z

All versions of `foever` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-536f-268f-6gxc
Summary: Malicious Package in buffermxor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:17:36Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vcfp-ppqw-mf23
Summary: Downloads Resources over HTTP in fis-sass-all
Aliases: CVE-2016-10686
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2018-08-17T20:20:46Z

Affected versions of `fis-sass-all` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fis-sass-all`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5gm6-r79q-hfgw
Summary: Denial of service in direct_mail
Aliases: CVE-2020-12697
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-770
Published: 2021-05-24T16:58:32Z

The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
Vulnerability: GHSA-38cr-2ph5-frr9
Summary: Apache Struts REST Plugin can potentially allow a DoS attack
Aliases: CVE-2018-1327
Severity: HIGH
CVSS score: 7.5
CWE: CWE-91
Published: 2018-10-16T19:35:26Z

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
Vulnerability: GHSA-35q2-47q7-3pc3
Summary: Potential exponential regex in monitor mode
Aliases: CVE-2021-29469
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2021-04-27T15:56:03Z

### Impact
When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

### Patches
The problem was fixed in commit [`2d11b6d`](https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e) and was released in version `3.1.1`.

### References
#1569 (GHSL-2021-026)
Vulnerability: GHSA-85fq-56wq-gmcf
Summary: Hijacked Environment Variables in mariadb
Aliases: CVE-2017-16046
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-18T18:28:17Z

The `mariadb` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-r838-q6jp-58xx
Summary: Improper Restriction of Excessive Authentication Attempts in py-bcrypt
Aliases: CVE-2013-1895
Severity: HIGH
CVSS score: 7.5
CWE: CWE-307
Published: 2021-10-12T16:31:22Z

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Vulnerability: GHSA-ccrp-c664-8p4j
Summary: Cross-Site Scripting in markdown-to-jsx
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T21:17:36Z

Versions of `markdown-to-jsx` prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.


## Recommendation

Upgrade to version 6.11.4 or later.
Vulnerability: GHSA-jh82-c5jw-pxpc
Summary: Denial of Service in Onionshare
Aliases: CVE-2022-21689
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-01-21T23:20:27Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/).

- Vulnerability ID: OTF-012
- Vulnerability type: Denial of Service
- Threat level: Moderate

## Description:

The receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script.

## Technical description:

The following script uses GNU parallel and curl with around 6000 requests in parallel to send 10000 requests. A change in the `ulimit -n` configuration is required for it to work. This is sufficient to block file upload on a (public) receive instance.

```
seq 10000 | parallel --max-args 0 --jobs 6000 "curl -i -s -x socks5h://localhost:9150 -k -X $'POST' -H $'Host: csqrp3qciewvj5axph4o62jnr6aevhmpxfkydmi3256bprhbusr2ltid.onion' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------19182376703918074873375387042' -H $'Content-Length: 329' -H $'Connection: close' --data-binary $'-----------------------------19182376703918074873375387042\x0d\x0aContent-Disposition: form-data; name=\"file[]\"; filename=\"poc.txt\"\x0d\x0aContent-Type: text/plain\x0d\x0a\x0d\x0aA\x0d\x0a-----------------------------19182376703918074873375387042\x0d\x0aContent-Disposition: form-data; name=\"text\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------19182376703918074873375387042--\x0d\x0a' $'http://csqrp3qciewvj5axph4o62jnr6aevhmpxfkydmi3256bprhbusr2ltid.onion/upload-ajax'"
```

Attack duration was around 80 seconds.

Cases where over 99 requests were sent per second:

```
Every 0.1s: ls | grep...   onionvm: Tue Oct 5 12:17:00 2021
78
```

Cases where files were successfully written to disk:

```
Every 0.1s: ls | wc -w   onionvm: Tue Oct 5 12:17:00 2021
8399
```

This means that during the attack time 1601 requests of 10000 were dropped. We tried to upload multiple files in the web interface during the attack and were not successful.

The failsafe is used to prevent creating more than 100 directories per second:

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/receive_mode.py#L386-L427

The limit of 100 requests/second is significantly lower than the possible network bandwidth and greatly reduces the attack complexity for denial of service. Our test was conducted over the tor network, which showed no limitation for the required bandwidth.

## Impact:

An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.

## Recommendation:

- Remove this limitation, or
- Derive directory name from milliseconds
Vulnerability: GHSA-3pwh-5mmc-mwrx
Summary: Denial of Service in nes
Aliases: CVE-2017-16025
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:06:33Z

Affected versions of `nes` are vulnerable to denial of service when given an invalid `cookie` header, and websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to throw and exit.


## Recommendation

Update to version 6.4.1 or later.
Vulnerability: GHSA-fxpg-gg9g-76gj
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2010-3082
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-23T19:52:42Z

Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.
Vulnerability: GHSA-w3jx-wv97-67ph
Summary: Cross-site scripting in Dutchcoders transfer.sh
Aliases: CVE-2021-33496
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-29T21:25:27Z

Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.
Vulnerability: GHSA-wpww-4jf4-4hx8
Summary: Edit feed settings  and others, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
Aliases: CVE-2020-15273
Severity: LOW
CVSS score: 7.3
CWE: CWE-79
Published: 2020-11-04T21:08:38Z

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

Impact: XSS via Arbitrary script execution.
Attack vector is: Administrator must be logged in.
Components are: Edit feed settings, Edit widget area, Sub site new registration, New category registration
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by Aquilao Null
Vulnerability: GHSA-7gm7-8q8v-9gf2
Summary: Server-Side Request Forgery (SSRF) in Shopware
Aliases: CVE-2022-24871
Severity: HIGH
CVSS score: 7.2
CWE: CWE-918
Published: 2022-04-22T21:04:07Z

### Impact

The  attacker can abuse the Admin SDK functionality on the server to read or update internal resources.

### Patches

We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-3p94-vj97-fm4q
Summary: OS Command Injection in fsa
Aliases: CVE-2020-7615
Severity: MODERATE
CVSS score: 7.8
CWE: CWE-78
Published: 2021-12-09T19:56:44Z

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.
Vulnerability: GHSA-rrfp-j2mp-hq9c
Summary: Segfault in `tf.quantization.quantize_and_dequantize`
Aliases: CVE-2020-15265
Severity: LOW
CVSS score: 5.9
CWE: CWE-125
Published: 2020-11-13T17:13:04Z

### Impact
An attacker can pass an invalid `axis` value to `tf.quantization.quantize_and_dequantize`:

```python
tf.quantization.quantize_and_dequantize(
    input=[2.5, 2.5], input_min=[0,0], input_max=[1,1], axis=10)
```

This results in accessing [a dimension outside the rank of the input tensor](https://github.com/tensorflow/tensorflow/blob/0225022b725993bfc19b87a02a2faaad9a53bc17/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L74) in the C++ kernel implementation:
```
const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);
```

However, [`dim_size` only does a `DCHECK`](https://github.com/tensorflow/tensorflow/blob/0225022b725993bfc19b87a02a2faaad9a53bc17/tensorflow/core/framework/tensor_shape.cc#L292-L307) to validate the argument and then uses it to access the corresponding element of an array:
```
int64 TensorShapeBase<Shape>::dim_size(int d) const {
  DCHECK_GE(d, 0);
  DCHECK_LT(d, dims());
  DoStuffWith(dims_[d]);
}
```

Since in normal builds, `DCHECK`-like macros are no-ops, this results in segfault and access out of bounds of the array.

### Patches

We have patched the issue in eccb7ec454e6617738554a255d77f08e60ee0808 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in #42105
Vulnerability: GHSA-3wcq-x3mq-6r9p
Summary: Potential memory exposure in dns-packet
Aliases: CVE-2021-23386
Severity: HIGH
CVSS score: 7.7
CWE: CWE-200, CWE-908
Published: 2021-05-24T19:51:04Z

This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
Vulnerability: GHSA-8xqr-4cpm-wx7g
Summary: Cross-Site Scripting in react-svg
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-05-31T23:47:27Z

Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.


## Recommendation

Update to version 2.2.18 or later.
Vulnerability: GHSA-rmm5-g63h-m6g9
Summary: Moderate severity vulnerability that affects ro.pippo:pippo-core
Aliases: CVE-2018-20059
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2018-12-19T19:24:39Z

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
Vulnerability: GHSA-c545-c4f9-rf6v
Summary: Heap OOB in TFLite
Aliases: CVE-2021-37685
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2021-08-25T14:40:09Z

### Impact
TFLite's [`expand_dims.cc`](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/expand_dims.cc#L36-L50) contains a vulnerability which allows reading one element outside of bounds of heap allocated data:

```cc
  if (axis < 0) { 
    axis = input_dims.size + 1 + axis;
  }   
  TF_LITE_ENSURE(context, axis <= input_dims.size);

  TfLiteIntArray* output_dims = TfLiteIntArrayCreate(input_dims.size + 1);
  for (int i = 0; i < output_dims->size; ++i) {
    if (i < axis) {
      output_dims->data[i] = input_dims.data[i];
    } else if (i == axis) {
      output_dims->data[i] = 1;
    } else {
      output_dims->data[i] = input_dims.data[i - 1];
    }
  }
```

If `axis` is a large negative value (e.g., `-100000`), then after the first `if` it would still be negative. The check following the `if` statement will pass and the `for` loop would read one element before the start of `input_dims.data` (when `i = 0`).

### Patches
We have patched the issue in GitHub commit [d94ffe08a65400f898241c0374e9edc6fa8ed257](https://github.com/tensorflow/tensorflow/commit/d94ffe08a65400f898241c0374e9edc6fa8ed257).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-6qqf-vvcr-7qrv
Summary: Cryptographically Weak PRNG in generate-password
Severity: MODERATE
CVSS score: 0
CWE: CWE-338
Published: 2019-05-23T09:27:22Z

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.


## Recommendation

Update to version 1.4.1 or later.
Vulnerability: GHSA-jpj5-hg26-6jgc
Summary: Cross-site Scripting in Alist
Aliases: CVE-2022-26533
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1.
Vulnerability: GHSA-jgcr-fg3g-qvw8
Summary: Improper permission handling in Apache Solr
Aliases: CVE-2021-29262
Severity: HIGH
CVSS score: 7.5
CWE: CWE-279, CWE-522
Published: 2021-05-10T15:18:17Z

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
Vulnerability: GHSA-73q4-j324-2qcc
Summary: Incorrect authorization in Drupal core
Aliases: CVE-2022-25270
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863
Published: 2022-02-18T00:00:36Z

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Vulnerability: GHSA-95cm-88f5-f2c7
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-10672
Severity: HIGH
CVSS score: 8.8
Published: 2020-04-23T16:32:59Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
Vulnerability: GHSA-gwp7-vqr5-h33h
Summary: Open Redirect in autobahn
Aliases: CVE-2020-35678
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-04-20T16:13:45Z

Autobahn|Python before 20.12.3 allows redirect header injection.
Vulnerability: GHSA-h362-m8f2-5x7c
Summary: Password Hashing: Do not use MD5
Aliases: CVE-2020-5229
Severity: LOW
CVSS score: 7.7
CWE: CWE-327
Published: 2020-01-30T21:21:58Z

### Impact

User passwords are stored in the database using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially for popular users like the default `admin` user.

This essentially means that for an attacker, it might be feasible to reconstruct a user's password given access to these hashes.

Note that attackers needing access to the hashes means that they must gain access to the database in which these are stored first to be able to start cracking the passwords.


### Patches

The problem is addressed in Opencast 8.1 which now uses the modern and much stronger bcrypt password hashing algorithm for storing passwords. Note, that old hashes remain MD5 until the password is updated.

For a list of users whose password hashes are stored using MD5, take a look at the `/user-utils/users/md5.json` REST endpoint.


### Workarounds

There is no workaround.

### References

- [MD5 (Wikipedia)](https://en.wikipedia.org/wiki/MD5)
- [bcrypt (Wikipedia)](https://en.wikipedia.org/wiki/Bcrypt)
- [How weak is MD5 as a password hashing function?](https://security.stackexchange.com/q/52461)


### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-5jgp-pg4f-q8vj
Summary: Malicious Package in node-ftp
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:55:42Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-g9r4-xpmj-mj65
Summary: Prototype Pollution in handlebars
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:06:32Z

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.


## Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.
Vulnerability: GHSA-gjj5-998g-v36v
Summary: Improper Access Control in Onionshare
Aliases: CVE-2022-21692
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-287
Published: 2022-01-21T23:20:21Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-003
- Vulnerability type: Improper Access Control
- Threat level: Moderate

## Description:

Anyone with access to the chat environment can write messages disguised as another chat participant.

## Technical description:

Prerequisites:

- Alice and Bob are legitimate users
- A third user has access to the chat environment

![otf-003-a](https://user-images.githubusercontent.com/156128/140665707-1ecc897e-d33b-4f5b-b585-eb4475c1599f.png)

This screenshot shows Alice (`glimpse-depress`) and Bob (`blinker-doorpost`) joined a chatroom and are the only participants in the chatroom. Then the non-listed user squad-nursing writes a message in the chatroom without being visible in the list of users. The sending of the message itself is not required but was done here to show the initial access. The non-listed participant now renames himself to Bob and writes another message, seemingly coming from Bob.

This can be reproduced by slightly modifying the client-side JavaScript. The `joined` emit needs to be removed from the `socket.on(connect) `event handler. Therefore a client is not listed in the userlist and has no active session.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/resources/static/js/chat.js#L16-L18

This can be done either via a crafted client or runtime modification of the `chat.js` script in the browser's internal debugger.

It is still possible to call the text method and send text to the chat via websocket.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/chat_mode.py#L131-L139

It is also possible to call the `update_username` function and choose an existing username from the chat.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/chat_mode.py#L141-L162

Afterwards the hidden user can send messages that are displayed as coming from the impersonated user. There is no way to distinguish between the fake and original message.

## Impact:

An adversary with access to the chat environment can impersonate existing chat participants and write messages but not read the conversation. The similar exploit described in OTF-004 (page 19) has only slightly more requirements but also allows for reading.

## Recommendation:

- Implement proper session handling
Vulnerability: GHSA-6w3v-66mj-2qm6
Summary: Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
Aliases: CVE-2018-1298
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-20
Published: 2018-10-19T16:41:46Z

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers". Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be vulnerable.