TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-f78g-q7r4-9wcv
Summary: Division by 0 in `FractionalAvgPool`
Aliases: CVE-2021-29550
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:23:41Z

### Impact
An attacker can cause a runtime division by zero error and denial of service in `tf.raw_ops.FractionalAvgPool`:

```python
import tensorflow as tf

value = tf.constant([60], shape=[1, 1, 1, 1], dtype=tf.int32)
pooling_ratio = [1.0, 1.0000014345305555, 1.0, 1.0]
pseudo_random = False
overlapping = False
deterministic = False
seed = 0
seed2 = 0

tf.raw_ops.FractionalAvgPool(
  value=value, pooling_ratio=pooling_ratio, pseudo_random=pseudo_random,
  overlapping=overlapping, deterministic=deterministic, seed=seed, seed2=seed2)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_avg_pool_op.cc#L85-L89) computes a divisor quantity by dividing two user controlled values:

```cc                     
for (int i = 0; i < tensor_in_and_out_dims; ++i) {
  output_size[i] = static_cast<int>(std::floor(input_size[i] / pooling_ratio_[i]));
  DCHECK_GT(output_size[i], 0); 
} 
``` 
    
The user controls the values of `input_size[i]` and `pooling_ratio_[i]` (via the `value.shape()` and `pooling_ratio` arguments). If the value in `input_size[i]` is smaller than the `pooling_ratio_[i]`, then the floor operation results in `output_size[i]` being 0. The `DCHECK_GT` line is a no-op outside of debug mode, so in released versions of TF this does not trigger.

Later, these computed values [are used as arguments](https://github.com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_avg_pool_op.cc#L96-L99) to [`GeneratePoolingSequence`](https://github.com/tensorflow/tensorflow/blob/acc8ee69f5f46f92a3f1f11230f49c6ac266f10c/tensorflow/core/kernels/fractional_pool_common.cc#L100-L108). There, the first computation is a division in a modulo operation:

```cc
std::vector<int64> GeneratePoolingSequence(int input_length, int output_length,
                                           GuardedPhiloxRandom* generator,
                                           bool pseudo_random) {
  ...
  if (input_length % output_length == 0) {
    diff = std::vector<int64>(output_length, input_length / output_length);
  }
  ...
}
```

Since `output_length` can be 0, this results in runtime crashing.

### Patches
We have patched the issue in GitHub commit [548b5eaf23685d86f722233d8fbc21d0a4aecb96](https://github.com/tensorflow/tensorflow/commit/548b5eaf23685d86f722233d8fbc21d0a4aecb96).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-x3wr-v4wx-5qpc
Summary: Prototype Pollution
Aliases: CVE-2021-25948
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-06-21T17:14:01Z

Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-rpxh-vg2x-526v
Summary: List of order ids, number, items total and token value exposed for unauthorized uses via new API
Aliases: CVE-2021-32720
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-06-29T03:12:04Z

### Impact

Part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. 

### Patches

The problem has been patched at Sylius 1.9.5 and 1.10.0

### Workarounds
There are a few ways to fix this without updating the code. 

The first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. In order to achieve it one has to add the configuration in `config/packages/security.yaml`:
```yaml
    access_control:
        # ... 
        - { path: "%sylius.security.new_api_shop_regex%/orders", role: IS_AUTHENTICATED_ANONYMOUSLY, methods: [POST] }
        - { path: "%sylius.security.new_api_shop_regex%/orders", role: ROLE_USER, methods: [GET] }
```
This would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only.

The second possible solution is to decorate the `\Sylius\Bundle\ApiBundle\Doctrine\QueryCollectionExtension\OrdersByLoggedInUserExtension` and throw `Symfony\Component\Security\Core\Exception\AccessDeniedException` if the class is executed for unauthorized user.
Vulnerability: GHSA-w7q9-xr2x-wh7x
Summary: Moderate severity vulnerability that affects delayed_job_web
Aliases: CVE-2017-12097
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-03-05T19:06:00Z

An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Vulnerability: GHSA-r2wf-q3x4-hrv9
Summary: Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)
Aliases: CVE-2019-10770
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-779
Published: 2020-01-27T19:28:20Z

Versions of Ratpack from 0.9.10 through 1.7.5 are vulnerable to [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html) (aka. XSS) in the development error handler. An attacker can utilize this to perform XSS when an exception message contains untrusted data.

As a simplistic example:
```java
RatpackServer startedServer = RatpackServer.start(server -> {
    server.handlers(chain -> chain.all(ctx -> {
        // User supplied query parameter
        String message = ctx.getRequest().getQueryParams().get("message");
        // User supplied data appended to the message in an exception
        throw new RuntimeException("An error occurred: " + message);
    }));
});
```

### Impact

 - Cross-Site Scripting

### Patches

This vulnerability has been patched in Ratpack version 1.7.6.

### Workarounds

If you are unable to update your version of Ratpack, we recommend the following workarounds and mitigations.

 - Ensure that development mode is disabled in production.
 - Don't use real customer data (ie. untrusted user input) in development.

### References

 - [Ratpack development mode](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#development-boolean-)
 - [Code Patch - a3cbb13](https://github.com/ratpack/ratpack/commit/a3cbb13be1527874528c3b99fc33517c0297b6d3)

### For more information

If you have any questions or comments about this advisory:
 - Open an issue in [ratpack/ratpack](https://github.com/ratpack/ratpack/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)
 - Ask in our [Slack channel](https://slack-signup.ratpack.io/)
Vulnerability: GHSA-8796-gc9j-63rv
Summary: File upload local preview can run embedded scripts after user interaction
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-74
Published: 2021-05-17T20:51:16Z

### Impact

When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.

### Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.

### Workarounds

There are no known workarounds.
Vulnerability: GHSA-jrcf-4jp8-m28v
Summary: miow invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2020-35921
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-188
Published: 2021-08-25T20:50:35Z

An issue was discovered in the miow crate before 0.3.6 for Rust. It has false expectations about the std::net::SocketAddr memory representation.
Vulnerability: GHSA-9697-98pf-4rw7
Summary: Heap OOB in `UpperBound` and `LowerBound`
Aliases: CVE-2021-37670
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2021-08-25T14:41:44Z

### Impact
An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `tf.raw_ops.UpperBound`:

```python
import tensorflow as tf
  
tf.raw_ops.UpperBound(
  sorted_input=[1,2,3],
  values=tf.constant(value=[[0,0,0],[1,1,1],[2,2,2]],dtype=tf.int64),
  out_type=tf.int64)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/searchsorted_op.cc#L85-L104) does not validate the rank of `sorted_input` argument:

```cc
  void Compute(OpKernelContext* ctx) override {
    const Tensor& sorted_inputs_t = ctx->input(0);
    // ...
    OP_REQUIRES(ctx, sorted_inputs_t.dim_size(0) == values_t.dim_size(0),
                Status(error::INVALID_ARGUMENT,
                       "Leading dim_size of both tensors must match."));
    // ...
    if (output_t->dtype() == DT_INT32) {
      OP_REQUIRES(ctx,
                  FastBoundsCheck(sorted_inputs_t.dim_size(1), ...));
      // ...
    }
```

As we access the first two dimensions of `sorted_inputs_t` tensor, it must have rank at least 2.

A similar issue occurs in `tf.raw_ops.LowerBound`.

### Patches
We have patched the issue in GitHub commit [42459e4273c2e47a3232cc16c4f4fff3b3a35c38](https://github.com/tensorflow/tensorflow/commit/42459e4273c2e47a3232cc16c4f4fff3b3a35c38).
  
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-m25q-fwg4-9v2p
Summary: Malicious Package in awesome_react_utility
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:47:07Z

Version 1.0.2 of `awesome_react_utility` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-f8pv-x7h8-687v
Summary: Cross-site scripting in feehicms
Aliases: CVE-2020-19709
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-30T16:22:25Z

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.
Vulnerability: GHSA-qfh2-6f7q-gr86
Summary: Cross-Site Scripting in sexstatic
Aliases: CVE-2018-3755
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-10-01T16:30:38Z

All versions of `sexstatic` are vulnerable to stored cross-site scripting (xss). This is exploitable if an attacker can control a filename that is served by `sexstatic`.



## Recommendation

As there is no fix is currently available for this vulnerability it is our recommendation to not install or used this module at this time.
Vulnerability: GHSA-cm8g-544f-p9x9
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45716
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:03:16Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.
Vulnerability: GHSA-g982-9r8g-6qxw
Summary: Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink
Aliases: CVE-2014-5003
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2018-07-23T19:50:15Z

chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer.
Vulnerability: GHSA-wx69-rvg3-x7fc
Summary: XSS via prototype pollution in NodeBB 
Aliases: CVE-2021-43787
Severity: CRITICAL
CVSS score: 9
CWE: CWE-79
Published: 2021-11-30T22:21:01Z

### Impact
A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report.

### Patches
The vulnerability has been patched as of v1.18.5.

### Workarounds
Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability: GHSA-rgfv-v3jh-7ffp
Summary: Prototype Pollution in deeps
Aliases: CVE-2020-7716
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:11:52Z

All versions of package deeps up to and including version 1.4.5 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-cv25-3gmg-c6m8
Summary: Injection in UserFrosting
Aliases: CVE-2021-25994
Severity: HIGH
CVSS score: 8.8
CWE: CWE-74
Published: 2022-01-06T22:22:32Z

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Vulnerability: GHSA-5qw5-89mw-wcg2
Summary: Out of bounds write in Tensorflow
Aliases: CVE-2022-23566
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2022-02-09T23:55:43Z

### Impact
TensorFlow is vulnerable to a heap OOB write in [Grappler](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/graph_properties.cc#L1132-L1141):

```cc
Status SetUnknownShape(const NodeDef* node, int output_port) {
  shape_inference::ShapeHandle shape = 
      GetUnknownOutputShape(node, output_port);
  InferenceContext* ctx = GetContext(node);
  if (ctx == nullptr) {
    return errors::InvalidArgument("Missing context");
  }
  ctx->set_output(output_port, shape);
  return Status::OK();
}
```

The [`set_output`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.h#L394) function writes to an array at the specified index:

```cc
void set_output(int idx, ShapeHandle shape) { outputs_.at(idx) = shape; }
```

Hence, this gives a malicious user a write primitive.

### Patches
We have patched the issue in GitHub commit [97282c6d0d34476b6ba033f961590b783fa184cd](https://github.com/tensorflow/tensorflow/commit/97282c6d0d34476b6ba033f961590b783fa184cd).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-whcm-29f4-j4mx
Summary: Directory Traversal in zwserver
Aliases: CVE-2017-16149
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:56:50Z

Affected versions of `zwserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-674v-3g2w-84gx
Summary: Sandbox bypass in fenom
Aliases: CVE-2021-46433
Severity: CRITICAL
CVSS score: 10
Published: 2022-03-29T00:01:15Z

In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
Vulnerability: GHSA-43hg-g44q-474q
Summary: Cross Site Scripting (XSS) in XWiki
Aliases: CVE-2021-3137
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-01-29T18:13:03Z

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
Vulnerability: GHSA-r6mv-ppjc-4hgr
Summary: PHP file inclusion via insert tags
Aliases: CVE-2021-37626
Severity: MODERATE
CVSS score: 6.7
CWE: CWE-94
Published: 2021-08-23T19:41:04Z

### Impact

It is possible for untrusted users to load arbitrary PHP files via insert tags.

Installations are only affected if there are untrusted back end users.

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7.

### Workarounds

Disable the login for untrusted back end users.

### References

https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-6x4w-8w53-xrvv
Summary: XXE in Apache Standard Taglibs
Aliases: CVE-2015-0254
Severity: HIGH
CVSS score: 0
CWE: CWE-611
Published: 2020-09-14T18:44:01Z

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Vulnerability: GHSA-w83x-fp72-p9qc
Summary: Command Injection in geojson2kml
Aliases: CVE-2020-28429
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-05-10T15:59:33Z

All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
Vulnerability: GHSA-4m3p-x2hp-2pgx
Summary: Malicious Package in bitcroe-lib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:45:23Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-84p7-fh9c-6g8h
Summary: Prototype Pollution in mixme
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2021-09-20T19:52:24Z

### Impact
When copying properties from a source object to a target object, the target object can gain access to certain properties of the source object and modify their content.

### Patches
The problem was patch with a more agressive discovery of secured properties to filter out.
Vulnerability: GHSA-r2mj-8wgq-73m6
Summary: XML External Entity Reference in Glances
Aliases: CVE-2021-23418
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-611
Published: 2021-08-09T20:43:14Z

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Vulnerability: GHSA-c2jg-hw38-jrqq
Summary: Inconsistent Interpretation of HTTP Requests in twisted.web
Aliases: CVE-2022-24801
Severity: HIGH
CVSS score: 8.1
CWE: CWE-444
Published: 2022-04-04T21:29:41Z

The Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230:

1. The Content-Length header value could have a `+` or `-` prefix.
2. Illegal characters were permitted in chunked extensions, such as the LF (`\n`) character.
3. Chunk lengths, which are expressed in hexadecimal format, could have a prefix of `0x`.
4. HTTP headers were stripped of all leading and trailing ASCII whitespace, rather than only space and HTAB (`\t`).

This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling.

### Impact

You may be affected if:

1. You use Twisted Web's HTTP 1.1 server and/or proxy
2. You also pass requests through a different HTTP server and/or proxy

The specifics of the other HTTP parser matter. The original report notes that some versions of Apache Traffic Server and HAProxy have been vulnerable in the past. HTTP request smuggling may be a serious concern if you use a proxy to perform request validation or access control.

The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected.

### Patches

The issue has been addressed in Twisted 22.4.0rc1 and later.

### Workarounds

Other than upgrading Twisted, you could:

* Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them
* Filter malformed requests by other means, such as configuration of an upstream proxy

### Credits

This issue was initially reported by [Zhang Zeyu](https://github.com/zeyu2001).
Vulnerability: GHSA-8rxg-9g6f-vq9p
Summary: Malicious Package in another-date-range-picker
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:46:01Z

Version 4.1.48 of `another-date-range-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 4.1.48 of this module is found installed you will want to replace it with a version before or after 4.1.48. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-xm6j-x342-gwq9
Summary: Unpublished files are exposed publicly
Aliases: CVE-2019-16409
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2019-11-12T23:01:05Z

In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
Vulnerability: GHSA-7553-jr98-vx47
Summary: libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation
Aliases: CVE-2020-7595
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2020-02-24T19:12:36Z

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
The Nokogiri RubyGem has patched its vendored copy of libxml2 in order to prevent this issue from affecting nokogiri.
Vulnerability: GHSA-2m9w-9xh2-wxc3
Summary: Link Following in Jenkins Pipeline Multibranch Plugin
Aliases: CVE-2022-25179
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-59
Published: 2022-02-16T00:01:33Z

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Vulnerability: GHSA-r9w6-rhh9-7v53
Summary: Incorrect Authorization in HashiCorp Consul
Aliases: CVE-2020-7955
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-863
Published: 2021-07-28T17:57:57Z

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3.
Vulnerability: GHSA-65f3-3278-7m65
Summary: Improper Authorization in Gogs
Aliases: CVE-2022-0871
Severity: HIGH
CVSS score: 8.2
CWE: CWE-863, CWE-285
Published: 2022-03-12T00:00:34Z

### Impact

Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.

### Patches

Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. 

### References

https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
Vulnerability: GHSA-2p25-55c9-h58q
Summary: Overflow/crash in `tf.tile` when tiling tensor is large
Aliases: CVE-2021-41198
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-190
Published: 2021-11-10T19:33:58Z

### Impact
If `tf.tile` is called with a large input argument then the TensorFlow process will crash due to a `CHECK`-failure caused by an overflow.

```python
import tensorflow as tf
import numpy as np
tf.keras.backend.tile(x=np.ones((1,1,1)), n=[100000000,100000000, 100000000])
```

The number of elements in the output tensor is too much for the `int64_t` type and the overflow is detected via a `CHECK` statement. This aborts the process.

### Patches
We have patched the issue in GitHub commit [9294094df6fea79271778eb7e7ae1bad8b5ef98f](https://github.com/tensorflow/tensorflow/commit/9294094df6fea79271778eb7e7ae1bad8b5ef98f) (merging [#51138](https://github.com/tensorflow/tensorflow/pull/51138)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46911).
Vulnerability: GHSA-3ccq-5vw3-2p6x
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39149
Severity: HIGH
CVSS score: 8.5
CWE: CWE-434, CWE-502
Published: 2021-08-25T14:47:28Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39149](https://x-stream.github.io/CVE-2021-39149.html).

### Credits
Lai Han of NSFOCUS security team found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-xvcg-2q82-r87j
Summary: Panic mishandled in libpulse-binding
Aliases: CVE-2019-25055
Severity: HIGH
CVSS score: 7.5
Published: 2022-01-06T22:18:19Z

An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
Vulnerability: GHSA-h23m-w6x5-jwr4
Summary: Out-of-bounds write
Aliases: CVE-2019-0923
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:08Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-p6xc-xr62-6r2g
Summary: Improper Input Validation and Uncontrolled Recursion in Apache Log4j2
Aliases: CVE-2021-45105
Severity: HIGH
CVSS score: 8.6
CWE: CWE-20, CWE-674
Published: 2021-12-18T18:00:07Z

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.


# Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.
Vulnerability: GHSA-vmfh-c547-v45h
Summary: Remote code execution in ruby-jss
Aliases: CVE-2021-33575
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-10-06T17:48:27Z

The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
Vulnerability: GHSA-r34r-f84j-5x4x
Summary: Moderate severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2017-7678
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-09T17:43:08Z

In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
Vulnerability: GHSA-pr38-qpxm-g88x
Summary: Uncontrolled Resource Consumption in Apache ActiveMQ Artemis
Aliases: CVE-2022-23913
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-06T00:00:55Z

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
Vulnerability: GHSA-756f-6j3f-48q9
Summary: Directory Traversal in calmquist.static-server
Aliases: CVE-2017-16165
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:45:51Z

Affected versions of `calmquist.static-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-m9m5-cg5h-r582
Summary: Improper random number generation in nanorand
Aliases: CVE-2020-35926
Severity: CRITICAL
CVSS score: 5.1
CWE: CWE-338
Published: 2021-08-25T20:50:24Z

An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishandled.
Vulnerability: GHSA-94xh-2fmc-xf5j
Summary: command injection vulnerability
Aliases: CVE-2020-7752
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2020-10-27T20:30:20Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.27.11

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
Vulnerability: GHSA-44qp-9wwf-734r
Summary: Heap overflow in Tensorflow
Aliases: CVE-2022-21740
Severity: HIGH
CVSS score: 7.6
CWE: CWE-787, CWE-120
Published: 2022-02-09T23:47:14Z

### Impact 
The [implementation of `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/count_ops.cc#L168-L273) is vulnerable to a heap overflow:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.SparseCountSparseOutput(
  indices=[[-1,-1]],
  values=[2],
  dense_shape=[1, 1],
  weights=[1],
  binary_output=True,
  minlength=-1,
  maxlength=-1,
  name=None)
```

### Patches
We have patched the issue in GitHub commits [2b7100d6cdff36aa21010a82269bc05a6d1cc74a](https://github.com/tensorflow/tensorflow/commit/2b7100d6cdff36aa21010a82269bc05a6d1cc74a) and [adbbabdb0d3abb3cdeac69e38a96de1d678b24b3](https://github.com/tensorflow/tensorflow/commit/adbbabdb0d3abb3cdeac69e38a96de1d678b24b3).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-6g5f-f5pm-mjrg
Summary: Vulnerability in Istio
Aliases: CVE-2019-12243
Severity: HIGH
CVSS score: 8.9
CWE: CWE-284
Published: 2022-02-15T01:57:18Z

Istio 1.1.x through 1.1.6 has Incorrect Access Control.
Vulnerability: GHSA-prxj-c66c-4gcf
Summary: Out-of-bounds write
Aliases: CVE-2019-0924
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:12Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-m43c-649m-pm48
Summary: Integer Overflow or Wraparound in OpenCV.
Aliases: CVE-2017-1000450
Severity: HIGH
CVSS score: 8.8
CWE: CWE-190
Published: 2021-10-12T22:03:32Z

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 (corresponding with OpenCV-Python 3.3.0.9) and earlier.
Vulnerability: GHSA-rpw6-9xfx-jvcx
Summary: Directory Traversal in Archive_Tar
Aliases: CVE-2020-36193
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-04-22T16:20:36Z

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

:exclamation: Note: There was an [initial fix](https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916) for this vulnerability made in version `1.4.12`. That fix introduced a bug which was [fixed in 1.4.13](https://github.com/pear/Archive_Tar/pull/36). Therefore we have set the first-patched-version to `1.4.13` which the earliest working version that avoids this vulnerability.
Vulnerability: GHSA-5vwc-r48g-wj6c
Summary: Exposure of Resource to Wrong Sphere in abomonation
Aliases: CVE-2021-45708
Severity: HIGH
CVSS score: 7.5
CWE: CWE-668
Published: 2022-01-06T22:08:22Z

An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
Vulnerability: GHSA-5jjv-x4fq-qjwp
Summary: Possible timing attack in derivation_endpoint
Aliases: CVE-2020-15237
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-208, CWE-203
Published: 2020-10-05T15:48:34Z

### Impact

When using the `derivation_endpoint` plugin, it's possible for the attacker to use a timing attack to guess the signature of the derivation URL.

### Patches

The problem has been fixed by comparing sent and calculated signature in constant time, using `Rack::Utils.secure_compare`. Users using the `derivation_endpoint` plugin are urged to upgrade to Shrine 3.3.0 or greater.

### Workarounds

Users of older Shrine versions can apply the following monkey-patch after loading the `derivation_endpoint` plugin:

```rb
class Shrine
  class UrlSigner
    def verify_signature(string, signature)
      if signature.nil?
        fail InvalidSignature, "missing \"signature\" param"
      elsif !Rack::Utils.secure_compare(signature, generate_signature(string))
        fail InvalidSignature, "provided signature does not match the calculated signature"
      end
    end
  end
end
```

### References

You can read more about timing attacks [here](https://en.wikipedia.org/wiki/Timing_attack).
Vulnerability: GHSA-xf64-2f9p-6pqq
Summary: Information Exposure in type-graphql
Severity: LOW
CVSS score: 0
CWE: CWE-209
Published: 2020-09-04T17:24:08Z

Versions of `type-graphql` prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.


## Recommendation

Upgrade to version 0.17.6 or later.
Vulnerability: GHSA-fh56-85cw-5pq6
Summary: Out-of-bounds Write in ujson
Aliases: CVE-2021-45958
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-787
Published: 2022-01-21T23:27:45Z

UltraJSON (aka ujson) 4.0.2 through 5.0.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).
Vulnerability: GHSA-mh6h-f25p-98f8
Summary: Uncontrolled memory consumption in protobuf
Aliases: CVE-2019-15544
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2021-08-25T20:44:05Z

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
Vulnerability: GHSA-5xqr-grq4-qwgx
Summary: Moderate severity vulnerability that affects com.github.junrar:junrar
Aliases: CVE-2018-12418
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2018-10-17T00:04:05Z

Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.
Vulnerability: GHSA-f4w8-cv6p-x6r5
Summary: Denial of Service by Uncontrolled Resource Consumption
Aliases: CVE-2021-27921
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-18T19:55:13Z

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
Vulnerability: GHSA-xx65-cc7g-9pfp
Summary: Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Aliases: CVE-2018-1196
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-59
Published: 2018-10-18T18:05:57Z

Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
Vulnerability: GHSA-fffj-9qwg-qmh5
Summary: Improper Input Validation in OpenCV
Aliases: CVE-2016-1517
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2021-10-12T22:00:31Z

OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV 3.3.1.11).
Vulnerability: GHSA-7q9f-x6rm-qmxr
Summary: Command Injection in compass-compile
Aliases: CVE-2020-7635
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2021-12-09T19:27:46Z

compass-compile through 0.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Vulnerability: GHSA-f2rc-6xjq-95gq
Summary: Directory Traversal in shenliru
Aliases: CVE-2017-16161
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:24:57Z

Affected versions of `shenliru` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jh67-3wqw-cvhr
Summary: Malicious Package in js-sxa3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:13:52Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-38rv-5jqc-m2cv
Summary: High severity vulnerability that affects recurly
Aliases: CVE-2017-0906
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2019-01-04T17:48:09Z

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
Vulnerability: GHSA-72rj-36qc-47g7
Summary: Information Disclosure
Aliases: CVE-2021-31671
Severity: HIGH
CVSS score: 7.5
CWE: CWE-319
Published: 2021-04-27T15:54:52Z

pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the --schema-first and --schema-only options is mishandled. For example, the sslmode connection parameter may be lost, which means that SSL would not be used.
Vulnerability: GHSA-qhm4-jxv7-j9pq
Summary: Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes
Aliases: CVE-2020-8551
Severity: LOW
CVSS score: 4.3
CWE: CWE-789
Published: 2022-02-15T01:57:18Z

The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
Vulnerability: GHSA-q25j-gcmv-5qpp
Summary: Moderate severity vulnerability that affects org.grails.plugins:fields and org.grails:grails-core
Aliases: CVE-2018-1000529
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-19T16:46:01Z

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.
Vulnerability: GHSA-qj73-v688-wqxf
Summary: Hijacked Environment Variables in proxy.js
Aliases: CVE-2017-16076
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:19:13Z

The `proxy.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-vfqx-hv88-f9cv
Summary: Double-free in id-map
Aliases: CVE-2021-30456
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:55:22Z

An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in get_or_insert upon a panic of a user-provided f function.
Vulnerability: GHSA-ghcq-472w-vf4h
Summary: Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
Aliases: CVE-2022-24821
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-648
Published: 2022-04-08T21:59:04Z

### Impact

Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. 

### Patches
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. 

### Workarounds
There's no easy workaround for this issue, administrators should upgrade their wiki.

### References
https://jira.xwiki.org/browse/XWIKI-19155

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-j545-frh3-r9gq
Summary: SQL Injection in dolibarr
Aliases: CVE-2022-0224
Severity: HIGH
CVSS score: 8.3
CWE: CWE-89
Published: 2022-01-21T23:56:39Z

dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command