TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-h6jh-7gv5-28vg
Summary: Bad alloc in `StringNGrams` caused by integer conversion
Aliases: CVE-2021-37646
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-681
Published: 2021-08-25T14:43:34Z

### Impact
The implementation of `tf.raw_ops.StringNGrams` is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value.

```python
import tensorflow as tf

tf.raw_ops.StringNGrams(
  data=['',''],
  data_splits=[0,2],
  separator=' '*100,
  ngram_widths=[-80,0,0,-60],
  left_pad=' ',
  right_pad=' ',
  pad_width=100,
  preserve_short_sequences=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/string_ngrams_op.cc#L184) calls `reserve` on a `tstring` with a value that sometimes can be negative if user supplies negative `ngram_widths`. The `reserve` method calls `TF_TString_Reserve` which has an `unsigned long` argument for the size of the buffer. Hence, the implicit conversion transforms the negative value to a large integer.

### Patches
We have patched the issue in GitHub commit [c283e542a3f422420cfdb332414543b62fc4e4a5](https://github.com/tensorflow/tensorflow/commit/c283e542a3f422420cfdb332414543b62fc4e4a5).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-49r3-2549-3633
Summary: omniauth-apple allows attacker to fake their email address during authentication
Aliases: CVE-2020-26254
Severity: LOW
CVSS score: 7.7
CWE: CWE-290
Published: 2020-12-08T14:18:19Z

### Impact

This vulnerability impacts applications using the [omniauth-apple](https://github.com/nhosoya/omniauth-apple) strategy of OmniAuth and using the `info.email` field of OmniAuth's [Auth Hash Schema](https://github.com/omniauth/omniauth/wiki/Auth-Hash-Schema) for any kind of identification.  The value of this field may be set to any value of the attacker's choice including email addresses of other users.

For example, an application using omniauth-apple with the following code will be impacted:
```ruby
def omniauth_callback
    auth_hash = request.env['omniauth.auth']
    @authenticated_user = User.find_by(email: auth_hash.info.email)
end
```

Applications not using `info.email` for identification but are instead using the `uid` field are not impacted in the same manner.  Note, these applications may still be negatively affected if the value of `info.email` is being used for other purposes.

### Patches

Applications using affected versions of omniauth-apple are advised to upgrade to omniauth-apple version 1.0.1 or later.

### Workarounds

If unable to upgrade to a patched version, monkey patching `OmniAuth::Strategies::Apple#email` as follows is advised as a workaround:

```ruby
module OmniAuth
  module Strategies
    class Apple
      def email
        id_info['email']
      end
    end
  end
end
```
Vulnerability: GHSA-22gq-x6pg-752j
Summary: Hijacked Environment Variables in openssl.js
Aliases: CVE-2017-16065
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506, CWE-433
Published: 2018-08-29T23:45:41Z

The `openssl.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-j346-h5wc-rw2m
Summary: Incorrect Authorization in Apache Solr
Aliases: CVE-2018-11802
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-863
Published: 2022-02-09T23:19:26Z

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
Vulnerability: GHSA-c2gp-86p4-5935
Summary: Use-After-Free in puppeteer
Aliases: CVE-2019-5786
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-416
Published: 2020-09-02T18:25:43Z

Versions of `puppeteer` prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.


## Recommendation

Upgrade to version 1.13.0 or later.
Vulnerability: GHSA-p7c9-jqhq-vr3v
Summary: Remote Code Execution in markdown-pdf
Aliases: CVE-2018-3770
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-27T17:03:46Z

Versions of `markdown-pdf` prior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize HTML code in markdown files. If markdown files with malicious HTML are converted to PDF, the resulting PDF file will execute any JavaScript code in the original markdown file. This may allow attackers to execute Remote Code.


## Recommendation

Upgrade to version 9.0.0 or later.
Vulnerability: GHSA-rw4r-h883-8pf9
Summary: Malicious Package in reequest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:30:02Z

All versions of `reequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-4cxw-hq44-r344
Summary: Off-by-one Error in v2fly/v2ray-core
Aliases: CVE-2021-4070
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-193
Published: 2022-02-24T00:00:52Z

v2fly/v2ray-core prior to 4.44.0 is vulnerable to an off-by-one error. Indexing operations on arrays, slices, or strings should use an index at most one less than the length. If the index is checked for being less than or equal to the length (`<=`), instead of less than the length (`<`), the index could be out of bounds.
Vulnerability: GHSA-gfjr-3jmm-4g9v
Summary: Symlink Arbitrary File Overwrite in tar
Aliases: CVE-2015-8860
Severity: HIGH
CVSS score: 7.5
CWE: CWE-59
Published: 2017-10-24T18:33:36Z

Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.



## Recommendation

Update to version 2.0.0 or later
Vulnerability: GHSA-x7jh-595q-wq82
Summary: Incorrect Permission Assignment for Critical Resource in Ansible
Aliases: CVE-2020-1736
Severity: LOW
CVSS score: 3.3
CWE: CWE-732
Published: 2022-02-09T21:59:46Z

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Vulnerability: GHSA-899g-6q6w-7v94
Summary: Low severity vulnerability that affects m-server
Aliases: CVE-2018-16485
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2019-02-18T23:58:00Z

Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.
Vulnerability: GHSA-prcg-wp5q-rv7p
Summary: Crashes due to overflow and `CHECK`-fail in ops with large tensor shapes
Aliases: CVE-2021-41197
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-190
Published: 2021-11-10T19:35:35Z

### Impact
TensorFlow allows tensor to have a large number of dimensions and each dimension can be as large as desired. However, the total number of elements in a tensor must fit within an `int64_t`. If an overflow occurs, `MultiplyWithoutOverflow` would return a negative result. In the majority of TensorFlow codebase this then results in a `CHECK`-failure. Newer constructs exist which return a `Status` instead of crashing the binary.

For example [`AddDim`](https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/framework/tensor_shape.cc#L395-L408) calls should be replaced by [`AddDimWithStatus`](https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/framework/tensor_shape.cc#L410-L440).

This is similar to [CVE-2021-29584](https://github.com/tensorflow/tensorflow/blob/3a74f0307236fe206b046689c4d76f57c9b74eee/tensorflow/security/advisory/tfsa-2021-071.md) (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs).

### Patches
We have patched the issue in GitHub commits [7c1692bd417eb4f9b33ead749a41166d6080af85](https://github.com/tensorflow/tensorflow/commit/7c1692bd417eb4f9b33ead749a41166d6080af85) (merging [#51732](https://github.com/tensorflow/tensorflow/pull/51732)), [d81b1351da3e8c884ff836b64458d94e4a157c15](https://github.com/tensorflow/tensorflow/commit/d81b1351da3e8c884ff836b64458d94e4a157c15) (merging [#51717](https://github.com/tensorflow/tensorflow/pull/51717)), [a871989d7b6c18cdebf2fb4f0e5c5b62fbc19edf](https://github.com/tensorflow/tensorflow/commit/a871989d7b6c18cdebf2fb4f0e5c5b62fbc19edf) (merging [#51658](https://github.com/tensorflow/tensorflow/pull/51658)), and [d81b1351da3e8c884ff836b64458d94e4a157c15](https://github.com/tensorflow/tensorflow/commit/d81b1351da3e8c884ff836b64458d94e4a157c15) (merging [#51973](https://github.com/tensorflow/tensorflow/pull/51973)). It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered.

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46890), [GitHub issue](https://github.com/tensorflow/tensorflow/issues/51618) and [GitHub issue](https://github.com/tensorflow/tensorflow/issues/51908).
Vulnerability: GHSA-hr32-mgpm-qf2f
Summary: Generation of Error Message Containing Sensitive Information in RESTEasy client
Aliases: CVE-2020-25633
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-209
Published: 2021-06-03T23:41:34Z

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.
Vulnerability: GHSA-688c-3x49-6rqj
Summary: Moderate severity vulnerability that affects rack-protection
Aliases: CVE-2018-1000119
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-203
Published: 2018-03-07T22:22:22Z

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.
Vulnerability: GHSA-rw6j-rhw7-q94c
Summary: Directory Traversal in sly07
Aliases: CVE-2017-16189
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:40:34Z

Affected versions of `sly07` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-q69p-5h74-w36f
Summary: Content Injection via TileJSON Name in mapbox.js
Aliases: CVE-2017-1000043
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-09T17:48:34Z

Versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 of `mapbox.js` are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios.

If `L.mapbox.map` or `L.mapbox.shareControl` are used in a manner that gives users control of the TileJSON content, it is possible to inject script content into the name value of the TileJSON. After clicking on the share control, the malicious code will execute in the context of the page using Mapbox.js.



## Recommendation

Version 1.x: Update to version 1.6.6 or later.
Version 2.x: Update to version 2.2.4 or later.
Vulnerability: GHSA-wg5w-vv93-3f7w
Summary: Moderate severity vulnerability that affects org.apache.oozie:oozie-core
Aliases: CVE-2018-11799
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2018-12-20T22:01:18Z

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 5.0.0 to impersonate other users. The malicious user can construct an XML that results workflows running in other user's name.
Vulnerability: GHSA-pjc4-3w99-j7v4
Summary: Open redirect in Flask-Unchained
Aliases: CVE-2021-23393
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-601
Published: 2021-06-15T15:56:59Z

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Vulnerability: GHSA-h592-38cm-4ggp
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2017-15095
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-184, CWE-502
Published: 2018-10-18T17:42:34Z

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
Vulnerability: GHSA-465w-gg5p-85c9
Summary: Insufficient Session Expiration in Kiali
Aliases: CVE-2020-1762
Severity: HIGH
CVSS score: 8.6
CWE: CWE-384, CWE-613, CWE-295
Published: 2021-05-18T21:09:01Z

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
Vulnerability: GHSA-f9p3-h6cg-2cjr
Summary: Improper neutralization of formula elements in yii-helpers
Aliases: CVE-2022-1544
Severity: HIGH
CVSS score: 0
CWE: CWE-1236
Published: 2022-05-03T00:00:46Z

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Vulnerability: GHSA-3v44-382q-55f4
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2017-15713
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2018-12-21T17:50:13Z

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to expose private files owned by the user running the MapReduce job history server process. The malicious user can construct a configuration file containing XML directives that reference sensitive files on the MapReduce job history server host.
Vulnerability: GHSA-jf5r-8hm2-f872
Summary: Incorrect hostname / protocol due to unstripped leading control characters.
Aliases: CVE-2022-0691
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-639
Published: 2022-02-22T00:00:30Z

Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL.

If url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect.

This can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example:
`````
const parse = require('url-parse')
const express = require('express')
const app = express()
const port = 3000

url = parse(\"\\bjavascript:alert(1)\")

console.log(url)

app.get('/', (req, res) => {
 if (url.protocol !== \"javascript:\") {res.send(\"<a href=\\'\" + url.href + \"\\'>CLICK ME!</a>\")}
 })

app.listen(port, () => {
 console.log(`Example app listening on port ${port}`)
 })
`````
Vulnerability: GHSA-4r65-35qq-ch8j
Summary: Ansible discloses sensitive information in traceback error message
Aliases: CVE-2021-3620
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-209
Published: 2022-03-04T00:00:17Z

Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine's ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from `set_options`. The highest threat from this vulnerability is confidentiality.
Vulnerability: GHSA-x45v-pvpg-hcrh
Summary: Malicious Package in mysql-koa
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:54:36Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-63qx-x74g-jcr7
Summary: Path traversal and dereference of symlinks in Argo CD
Aliases: CVE-2022-24348
Severity: HIGH
CVSS score: 7.7
CWE: CWE-200, CWE-22
Published: 2022-02-07T19:06:18Z

### Impact

All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. 

Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files outside the repository's root directory.

If an attacker with permissions to create or update Applications knows or can guess the full path to a file containing valid YAML, they can create a malicious Helm chart to consume that YAML as values files, thereby gaining access to data they would otherwise have no access to. 

The impact can especially become critical in environments that make use of encrypted value files (e.g. using plugins with git-crypt or SOPS) containing sensitive or confidential data, and decrypt these secrets to disk before rendering the Helm chart.

Also, because any error message from `helm template` is passed back to the user, and these error messages are quite verbose, enumeration of files on the repository server's file system is possible.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.4
* v2.1.9

We urge users of Argo CD to update their installation to one of the fixed versions as listed above.

### Workarounds

No workaround for this issue.

### References

* https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24348

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`

### Credits

The path traversal vulnerability was discovered and reported by Moshe Zioni, VP Security Research, [Apiiro](https://www.apiiro.com). 

During the development of a fix for the path traversal vulnerability, the Argo CD team discovered the related issue with symbolic links.

The Argo CD team would like to thank Moshe Zioni for the responsible disclosure, and the constructive discussions during handling this issue!
Vulnerability: GHSA-mh83-jcw5-rjh8
Summary: XML External Entity Reference in edu.stanford.nlp:stanford-corenlp
Aliases: CVE-2022-0198
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-611
Published: 2022-01-14T21:07:23Z

The TransformXML() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
Vulnerability: GHSA-7x2h-3v2v-24p9
Summary: Cross-Site Request Forgery in microweber
Aliases: CVE-2022-0505
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2022-02-09T00:00:31Z

microweber version 1.2.10 and prior is vulnerable to cross-site request forgery.
Vulnerability: GHSA-g3fq-3v3g-mh32
Summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
Aliases: CVE-2021-29438
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-79, CWE-80
Published: 2021-04-16T19:52:58Z

### Impact

The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability.

_Note_: Nextcloud Server employs a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities.

### Patches

The vulnerability has been patched in version 3.1.2. If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.

### Workarounds

Make sure no user-supplied input flows into toasts.
Vulnerability: GHSA-9x9j-836w-8f55
Summary: Incorrect Calculation in the MSR JavaScript Cryptography Library
Aliases: CVE-2020-1026
Severity: HIGH
CVSS score: 9.8
CWE: CWE-682
Published: 2022-01-06T19:44:01Z

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library's Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a server's private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka `MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability`.
Vulnerability: GHSA-56r9-v65c-34jm
Summary: Malicious Package in radicjs
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T02:33:37Z

Version 0.2.1 of `radicjs` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8mmf-qp7j-2w24
Summary: Malicious Package in colour-string
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:35:33Z

Version 1.5.3 of `colour-string` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-9953-fmrw-v4vm
Summary: Cross-site Scripting in Apache JSPWiki
Aliases: CVE-2022-24948
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-26T00:00:44Z

A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.
Vulnerability: GHSA-hxf9-7h4c-f5jv
Summary: Django-Anymail prone to a timing attack
Aliases: CVE-2018-6596
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-200
Published: 2018-07-12T20:30:40Z

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
Vulnerability: GHSA-66gw-ch5v-74v8
Summary: Cross-site scripting (XSS) in Apache ActiveMQ
Aliases: CVE-2020-13947
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-09T22:01:32Z

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
Vulnerability: GHSA-897m-rjf5-jp39
Summary: Prototype Pollution in copy-props
Aliases: CVE-2020-28503
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2022-01-06T20:35:05Z

The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
Vulnerability: GHSA-9qmh-276g-x5pj
Summary: Prototype Pollution in immer
Aliases: CVE-2020-28477
Severity: HIGH
CVSS score: 0
CWE: CWE-471
Published: 2021-01-20T21:27:56Z

## Overview

Affected versions of immer are vulnerable to Prototype Pollution.

## Proof of exploit

```
const {applyPatches, enablePatches} = require("immer");
enablePatches();
let obj = {};
console.log("Before : " + obj.polluted);
applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]);
console.log("After : " + obj.polluted);
```

## Remediation

Version 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.
Vulnerability: GHSA-p4jg-pccf-h82c
Summary: Insecure Temporary File in SWHKD
Aliases: CVE-2022-27815
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-377
Published: 2022-03-31T00:00:24Z

SWHKD is a display protocol-independent hotkey daemon made in Rust. In SWHKD versions 1.1.5 and prior, SWHKD uses the /tmp/swhkd.pid pathname. As /tmp is accessible to all users, there can be an information leak or denial of service. No known workarounds exist. A patch is available on the `1.1.0` branch of the repository.
Vulnerability: GHSA-35jh-r3h4-6jhm
Summary: Command Injection in lodash
Aliases: CVE-2021-23337
Severity: HIGH
CVSS score: 7.2
CWE: CWE-77
Published: 2021-05-06T16:05:51Z

`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Vulnerability: GHSA-jq4p-mq33-w375
Summary: Cross-site Scripting when rendering error messages in laminas-form
Aliases: CVE-2022-23598
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-28T23:08:29Z

### Impact

When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in vulnerable versions of laminas-form, the value was not being escaped for HTML contexts, which can potentially lead to a Reflected Cross-Site Scripting (XSS) attack.

### Patches

The following versions were issued to mitigate the vulnerability:

- 2.17.1
- 3.0.2
- 3.1.1

### Workarounds

At the top of a view script where you call the `formElementErrors()` view helper, place the following code:

```php
use Laminas\Form\ElementInterface;
use Laminas\View\PhpRenderer;

$escapeMessages = function (ElementInterface $formOrElement, PhpRenderer $renderer): void {
    $messages = $element->getMessages();
    if (! $messages) {
        return;
    }

    $escaped  = [];
    array_walk_recursive(
        $messages,
        static function (string $item) use (&$escaped, $renderer): void {
            $escaped[] = $renderer->escapeHtml($item);
        }
    };

    $element->setMessages($escaped);
};
```

Before calling `formElementErrors()` with a form, fieldset, or element, call the above closure as follows

```php
// Usage with a form
// $this is the view renderer
$escapeMessages($form, $this);

// Usage with a fieldset
// $this is the view renderer
$escapeMessages($fieldset, $this);

// Usage with a form element
// $this is the view renderer
$escapeMessages($element, $this);
```

### For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/laminas/laminas-form/issues/new)
* Email us at [security@getlaminas.org](mailto:security@getlaminas.org)
Vulnerability: GHSA-g4xg-fxmg-vcg5
Summary: OS command injection in ripgrep
Aliases: CVE-2021-3013
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-08-05T19:31:55Z

ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
Vulnerability: GHSA-hc94-2wfr-4pwf
Summary: Downloads Resources over HTTP in appium-chromedriver
Aliases: CVE-2016-10557
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:40:19Z

Affected versions of `appium-chromedriver` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution if overwritten with a malicious binary.


## Recommendation

Update to version 2.9.4 or later.
Vulnerability: GHSA-2457-2263-mm9f
Summary: Memory leak in micronaut-core
Aliases: CVE-2022-21700
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-01-21T23:19:36Z

### Impact

Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state.

### Patches

The problem is patched in Micronaut 3.2.7 and above.

### Workarounds

The default content type binder can be replaced in an existing Micronaut application to mitigate the issue:

```java
package example;

import java.util.List;
import io.micronaut.context.annotation.Replaces;
import io.micronaut.core.convert.ConversionService;
import io.micronaut.http.MediaType;
import io.micronaut.http.bind.DefaultRequestBinderRegistry;
import io.micronaut.http.bind.binders.RequestArgumentBinder;
import jakarta.inject.Singleton;

@Singleton
@Replaces(DefaultRequestBinderRegistry.class)
class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry {

    public FixedRequestBinderRegistry(ConversionService conversionService,
                                      List<RequestArgumentBinder> binders) {
        super(conversionService, binders);
    }

    @Override
    protected void registerDefaultConverters(ConversionService<?> conversionService) {
        super.registerDefaultConverters(conversionService);
        conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> {
            try {
                return MediaType.of(charSequence);
            } catch (IllegalArgumentException e) {
                return null;
            }
        });
    }
}
```

### References

Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Micronaut Core](https://github.com/micronaut-projects/micronaut-core/issues)
* Email us at [info@micronaut.io](mailto:info@micronaut.io)
Vulnerability: GHSA-96w3-p368-4h8c
Summary: Use after free in internment
Aliases: CVE-2020-35874
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362
Published: 2021-08-25T20:46:51Z

An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-free.
Vulnerability: GHSA-2mq8-99q7-55wx
Summary: Code injection in keycloak
Aliases: CVE-2021-20222
Severity: HIGH
CVSS score: 8.3
CWE: CWE-20
Published: 2021-05-13T22:29:51Z

A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-x48m-gp6r-gp4v
Summary: Malicious Package in rate-map
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:21:26Z

Version 1.0.3 of `rate-map`  contains malicious code. The malware breaks functionality of the `purescript-installer` package by rewriting code of the `dl-tar` dependency.


## Recommendation

Upgrade to version 1.0.5 or later. There is no indication of further compromise.
Vulnerability: GHSA-75p7-527p-w8wp
Summary: Server-Side Request Forgery and Open Redirect in AllTube Download
Aliases: CVE-2022-24739
Severity: HIGH
CVSS score: 7.3
CWE: CWE-601, CWE-918
Published: 2022-03-09T15:17:31Z

### Impact

On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).

The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.)

### Patches

3.0.3 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

The fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/3d092891044f2685ed66c73c870a021bee319c37/patches/youtube-dl-disable-generic.diff) to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.
However, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.

### References

* https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a
* https://github.com/ytdl-org/youtube-dl/issues/30691
Vulnerability: GHSA-wqgq-mfvj-6qxp
Summary: Malicious Package in koa-body-parse
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:49:03Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-w7x8-cq7r-g5g9
Summary: Cross Site Scripting in Microweber
Aliases: CVE-2021-33988
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-10-25T19:43:39Z

Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form.
Vulnerability: GHSA-c52f-pq47-2r9j
Summary: plugin.yaml file allows for duplicate entries in helm
Aliases: CVE-2020-15187
Severity: LOW
CVSS score: 3
CWE: CWE-74, CWE-694
Published: 2021-05-24T16:57:21Z

### Impact

During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack.

To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection).

### Patches

This issue has been patched in Helm 2.16.11 and Helm 3.3.2.

### Workarounds

Make sure to install plugins using a secure connection protocol like SSL.
Vulnerability: GHSA-gfh2-7jg5-653p
Summary: Denial of Service in docker2aci
Aliases: CVE-2016-8579
Severity: MODERATE
CVSS score: 4
CWE: CWE-835
Published: 2022-02-15T01:57:18Z

docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
Vulnerability: GHSA-vrv8-v4w8-f95h
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-08-11T14:55:01Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.

### Workarounds
The workarounds available are:
- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1
or
- enable the media plugin, which overrides the default parsing behaviour for iframes
or
- add the following workaround to update the parsing schema rules for iframes:

#### Example: Change the default schema for iframes
```js
setup: function(editor) {
  editor.on('PreInit', function() {
    editor.schema.getSpecialElements()['iframe'] = /</iframe[^>]*>/gi;
  });
}
```

### Acknowledgements
Tiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-6239-28c2-9mrm
Summary: Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault
Aliases: CVE-2021-38554
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-212
Published: 2021-08-30T17:22:38Z

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Vulnerability: GHSA-5p26-hw7f-3cpr
Summary: Cross-Site Scripting in html-pages
Aliases: CVE-2018-16481
Severity: HIGH
CVSS score: 0
CWE: CWE-64, CWE-79
Published: 2019-02-07T18:14:44Z

All versions of `html-pages` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize folder names, allowing attackers to execute arbitrary JavaScript in the victim's browser through folders with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-q9vw-wr57-xjv3
Summary: Information Exposure in Heketi
Aliases: CVE-2017-15104
Severity: HIGH
CVSS score: 7.8
CWE: CWE-200, CWE-552
Published: 2022-02-15T01:57:18Z

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.
Vulnerability: GHSA-5x92-p4p5-33c4
Summary: Path Traversal in HashiCorp Nomad
Aliases: CVE-2020-28348
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2022-02-15T01:57:18Z

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
Vulnerability: GHSA-gmr7-m73x-6c9q
Summary: Missing Authorization in TeamPass
Aliases: CVE-2020-11671
Severity: HIGH
CVSS score: 8.1
CWE: CWE-862
Published: 2021-07-26T21:22:13Z

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.
Vulnerability: GHSA-36xw-hgfv-jwm7
Summary: Uninitialized memory drop in arr
Aliases: CVE-2020-35888
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2021-08-25T20:48:36Z

An issue was discovered in the arr crate through 2020-08-25 for Rust. Uninitialized memory is dropped by Array::new_from_template.
Vulnerability: GHSA-wxr6-29pv-ch68
Summary: calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4164
Severity: HIGH
CVSS score: 7.6
CWE: CWE-352
Published: 2022-01-21T23:44:17Z

calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-v666-6w97-pcwm
Summary: Miner fails to get block template when a cell used as a cell dep has been destroyed.
Severity: HIGH
CVSS score: 0
CWE: CWE-367
Published: 2021-08-25T21:01:21Z

### Impact

The RPC `get_block_template` fails when a cell has been used as a cell dep and an input in the different transactions.

Say cell C is used as a dep group in the transaction A, and is destroyed in the transaction B.

The node adds transaction A first, then B into the transaction pool. They are both valid. But when generating the block template, if the fee rate of B is higher, it comes before A, which will invalidate A. Currently the RPC `get_block_template` will fail instead of dropping A.

### Patch

First, the `get_block_template` should not fail but dropping the conflict transactions.

Then we can propose solution to this issue. Here is an example. When a transaction is added to the pool, the pool must consider it depending on all the transactions which dep cell (direct or indirect via dep group) has been destroyed in this transaction. Because future transactions using the destroyed cells as dep will be rejected, the spending transaction only need to wait for all the existing dep transactions on chain.

### Workaround

1. Submit transaction B when A is already on chain.
2. Let B depend on A explicitly, there are several solutions:
    * a. Add any output cell on A as a dep cell or input in B.
    * b. Merge A and B. CKB allows using the same cell as both dep and input in the same transaction.
3. Ensure the fee rate of B is less than A so A always has higher priority.
Vulnerability: GHSA-h4mc-r4f4-hcf4
Summary: Downloads Resources over HTTP in selenium-binaries
Aliases: CVE-2016-10589
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:34:37Z

Affected versions of `selenium-binaries` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-binaries`.


## Recommendation

No fix is currently available for this vulnerability.

The best mitigation currently available is to use an alternate package, such as [selenium-webdriver](https://www.npmjs.com/package/selenium-webdriver), the official selenium bindings for node.js.
Vulnerability: GHSA-9vxc-g2jx-qj3p
Summary: API Admin Auth Weakness in tomato
Aliases: CVE-2013-7379
Severity: CRITICAL
CVSS score: 0
CWE: CWE-287
Published: 2020-08-31T22:59:07Z

Versions of `tomato` prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that password is, in less than 200 requests.


## Details
The tomato API has an admin service that is enabled by setting up an `access_key` in the config options. This `access_key` is intended to protect the API admin from unauthorized access.


Tomato verifies the `access_key` by checking to see if the server `access_key` incorporates the user provided value at any location. This allows an attacker to provide a single character as an `access_key`, and so long as the server key contains at least one instance of that character it will be considered a valid key.

## Proof of Concept
This is the snippet of code that does the comparison to authorize requests.

```
if (access_key && config.master.api.access_key.indexOf(access_key) !== -1) {
```

For an access_key that is set to anything that includes the letter 'a' the following request would be authorized.

```
$ curl -X POST "http://localhost:8081/api/exec" -H "Content-Type: application/json" -d @test -H "access-key: a"
{
 "cmd": "ls",
 "path": ".",
 "stdout": "app.js\nconfig.js\nlog\nnode_modules\nserver.js\n",
 "stderr": ""
}
```



## Recommendation

Update to version 0.0.6 or later.
Vulnerability: GHSA-9959-c6q6-6qp3
Summary: Moderate severity vulnerability that affects validator
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

**Withdrawn:** Duplicate of GHSA-79mx-88w7-8f7q
Vulnerability: GHSA-m4h3-7mc2-v295
Summary: An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
Aliases: CVE-2020-35214
Severity: HIGH
CVSS score: 8.1
Published: 2021-12-17T20:41:21Z

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.
Vulnerability: GHSA-gmjp-776j-2394
Summary: Malicious Package in ripmed160
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:04:24Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-x84v-xcm2-53pg
Summary: Moderate severity vulnerability that affects requests
Aliases: CVE-2018-18074
Severity: HIGH
CVSS score: 7.5
CWE: CWE-522
Published: 2018-10-29T19:06:46Z

The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
Vulnerability: GHSA-f77h-m9w2-vvg2
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4017
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-12-03T20:38:57Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)