TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-cfc2-wjcm-c8fm
Summary: Incorrect Authorization with specially crafted requests
Aliases: CVE-2021-39206
Severity: HIGH
CVSS score: 8.6
CWE: CWE-863
Published: 2021-09-10T17:54:25Z

Envoy, which Pomerium is based on, contains two authorization related vulnerabilities:

- [CVE-2021-32777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32779): incorrectly transform a URL containing a `#fragment` element, causing a mismatch in path-prefix based authorization decisions.
- [CVE-2021-32779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32777): incorrectly handle duplicate headers, dropping all but the last.  This may lead to incorrect routing or authorization policy decisions.

### Impact
With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium.

### Patches

Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched.

### Workarounds

- This issue can only be triggered when using path prefix based policy.  Removing any such policies should provide mitigation.


### References
[envoy GSA CVE-2021-32777](https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9)
[envoy GSA CVE-2021-32779](https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-9x2h-hvg6-4r5p
Summary: Improper Authentication in Apache Zeppelin
Aliases: CVE-2018-1317
Severity: HIGH
CVSS score: 8.8
CWE: CWE-287
Published: 2019-04-24T16:06:52Z

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
Vulnerability: GHSA-cj8p-53v9-2c26
Summary: Cross-site Scripting in Bolt
Aliases: CVE-2019-15485
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-08T15:28:11Z

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.
Vulnerability: GHSA-5rqg-jm4f-cqx7
Summary: Infinite loop causing Denial of Service in colors
Severity: HIGH
CVSS score: 0
CWE: CWE-835
Published: 2022-01-10T17:29:53Z

colors is a library for including colored text in node.js consoles. Between 07 and 09 January 2022, colors versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 were published including malicious code that caused a Denial of Service due to an infinite loop. Software dependent on these versions experienced the printing of randomized characters to console and an infinite loop resulting in unbound system resource consumption.

Users of colors relying on these specific versions should downgrade to version 1.4.0.
Vulnerability: GHSA-frpw-jrwx-hcfv
Summary: Path Traversal in node-red-contrib-huemagic
Aliases: CVE-2021-25864
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-04-13T15:30:00Z

node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.
Vulnerability: GHSA-p7h9-vf92-5fj5
Summary: Moderate severity vulnerability that affects Products.CMFPlone and Products.PasswordResetTool
Aliases: CVE-2011-1948
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-23T19:50:57Z

Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Vulnerability: GHSA-89rj-5ggj-3p9p
Summary: Reachable Assertion in OpenCV.
Aliases: CVE-2018-5269
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-617
Published: 2021-10-12T22:03:41Z

In OpenCV 3.3.1 (corresponds with OpenCV-Python 3.3.1.11), an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
Vulnerability: GHSA-jwjq-vp53-ph6m
Summary: Directory Traversal in pytservce
Aliases: CVE-2017-16195
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:21:44Z

Affected versions of `pytservce` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-mmqv-m45h-q2hp
Summary: Sandbox Breakout / Arbitrary Code Execution in localeval
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-04T15:22:40Z

All versions of `localeval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `constructor.constructor`. This may allow attackers to execute arbitrary code in the system.  Evaluating the payload 
```
constructor.constructor("return process.env")()
``` 

returns the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-hj56-84jw-67h6
Summary: Potential Denial-of-Service in bindata
Aliases: CVE-2021-32823
Severity: LOW
CVSS score: 3.7
CWE: CWE-400
Published: 2021-06-23T23:42:04Z

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.
Vulnerability: GHSA-37q6-576q-vgr7
Summary: Missing Origin Validation in parcel-bundler
Aliases: CVE-2018-14731
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2018-10-30T20:36:53Z

Versions of `parcel-bundler` before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation

Update to version 1.10.0 or later.
Vulnerability: GHSA-p435-w4xm-jj8x
Summary: Hadoop token in temp file visible to all users in Apache Gobblin
Aliases: CVE-2021-36151
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-200
Published: 2022-02-06T00:01:07Z

In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Vulnerability: GHSA-6445-fm66-fvq2
Summary: Integer overflows in Tensorflow
Aliases: CVE-2022-23568
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-190
Published: 2022-02-09T23:39:11Z

### Impact 
The [implementation of `AddManySparseToTensorsMap`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_tensors_map_ops.cc) is vulnerable to an integer overflow which results in a `CHECK`-fail when building new `TensorShape` objects (so, an assert failure based denial of service):

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.AddManySparseToTensorsMap(
    sparse_indices=[(0,0),(0,1),(0,2),(4,3),(5,0),(5,1)],
    sparse_values=[1,1,1,1,1,1],
    sparse_shape=[2**32,2**32],
    container='',
    shared_name='',
    name=None)
```

We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The latter is an instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197) and is easily fixed by replacing a call to `TensorShape` constructor with a call to `BuildTensorShape` static helper factory.
### Patches
We have patched the issue in GitHub commits [b51b82fe65ebace4475e3c54eb089c18a4403f1c](https://github.com/tensorflow/tensorflow/commit/b51b82fe65ebace4475e3c54eb089c18a4403f1c) and [a68f68061e263a88321c104a6c911fe5598050a8](https://github.com/tensorflow/tensorflow/commit/a68f68061e263a88321c104a6c911fe5598050a8).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-g636-q5fc-4pr7
Summary: accounts: Hash account number using Salt
Severity: LOW
CVSS score: 0
Published: 2021-05-24T17:00:27Z

@alovak found that currently when we build hash of account number we do not "salt" it. Which makes it vulnerable to rainbow table attack.

**What did you expect to see?**
I expected salt (some random number from configuration) to be used in [hash.AccountNumber](https://github.com/moov-io/customers/blob/master/pkg/secrets/hash/account_number.go#L13)

I would generate salt per tenant at least (maybe per organization).
Vulnerability: GHSA-vxhx-gmhm-623c
Summary: Improper Access Control in moodle
Aliases: CVE-2020-25698
Severity: HIGH
CVSS score: 7.5
CWE: CWE-284
Published: 2021-03-29T20:42:46Z

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Vulnerability: GHSA-w9m4-7w72-r766
Summary: Improper Access Control in Onionshare
Aliases: CVE-2022-21691
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-306
Published: 2022-01-21T23:20:22Z

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-004
- Vulnerability type: Improper Access Control
- Threat level: Moderate

## Description:

Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

## Technical description:

![otf-004-a](https://user-images.githubusercontent.com/156128/140665619-e51cfac0-a60a-4c2f-9c8e-be26066e6f3f.png)
![otf-004-b](https://user-images.githubusercontent.com/156128/140665620-5d7c2770-c83f-4925-8912-f2849071a3b0.png)
![otf-004-c](https://user-images.githubusercontent.com/156128/140665622-78a71ace-c483-4b16-b205-481aafe7ff87.png)

This series of screenshots show Alice, Bob and Eve joined a chatroom and are the only participants in the chatroom. Eve seemingly leaves the chatroom, which leads Bob and Alice to believe they are having a private chat. The last screenshot shows that Eve only emitted the leave message and is still able to read the chat and possibly write messages.

This can be reproduced by joining the chat with two different instances, where one instance has slightly modified the client-side JavaScript code similar to OTF-003 (page 22). The joined emit needs to be removed from the connect event handler. Therefore the modified client is not listed in the userlist and has no active session. The modified non-listed user also needs to change their username to Eve, which is not shown in the chatroom. The modified client then emits the disconnect event and their connection is no longer usable.

This results in the leave message for Eve and the removal from the user-list but not in removal of the original session of the Eve who announced to join the chat.

## Impact:

An adversary with access to the chat environment can spoof his leave event but still persist in the chat with access to all sent messages and the possibility to write in the chat using OTF-003 (page 22).

## Recommendation:

- Implement proper session handling
Vulnerability: GHSA-75vw-3m5v-fprh
Summary: corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Aliases: CVE-2022-0239
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2022-01-21T23:43:11Z

corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Vulnerability: GHSA-f854-hpxv-cw9r
Summary: Drainage of FeeCollector's Block Transaction Fees in cronos
Aliases: CVE-2021-43839
Severity: HIGH
CVSS score: 7.5
CWE: CWE-670
Published: 2022-01-06T18:30:54Z

### Impact
In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx.

User funds and balances are safe.


### Patches
This problem has been patched in Cronos v0.6.5 on the mempool level.
The next network upgrade with consensus-breaking changes will patch it on the consensus level.

### Workarounds
There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

### Credits
Thank you to @zb3 for reporting this issue on [Cronos Immunefi Bug Bounty Program](https://immunefi.com/bounty/cronos/), to @cyril-crypto for reproducing the issue and to @yihuang and @thomas-nguy for patching the issue on the CheckTx (mempool) and the DeliverTx (consensus) levels.

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [crypto-org-chain/cronos](https://github.com/crypto-org-chain/cronos/discussions/new)
* Email us at [chain@crypto.org](mailto:chain@crypto.org)
Vulnerability: GHSA-2cwj-8chv-9pp9
Summary: XML External Entity attack in log4net
Aliases: CVE-2018-1285
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2021-01-29T19:47:23Z

Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.
Vulnerability: GHSA-rp34-85x3-3764
Summary: Cross-site Scripting in librenms
Aliases: CVE-2022-0576
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-15T00:02:47Z

Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
Vulnerability: GHSA-9gxr-rhx6-4jgv
Summary: Sandbox Breakout / Prototype Pollution in notevil
Severity: MODERATE
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:18:57Z

Versions of `notevil` prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype.

Evaluating the payload ```try{a[b];}catch(e){e.constructor.constructor('return __proto__.arguments.callee.__proto__.polluted=true')()}``` add the `polluted` property to Function.


## Recommendation

Upgrade to version 1.3.3 or later.
Vulnerability: GHSA-9r24-gp44-h3pm
Summary: High severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-1335
Severity: HIGH
CVSS score: 8.1
Published: 2018-10-17T15:43:43Z

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Vulnerability: GHSA-5hfj-r725-wpc4
Summary: Arbitrary code execution in october/system
Aliases: CVE-2021-32650
Severity: HIGH
CVSS score: 8.8
CWE: CWE-74
Published: 2022-01-14T21:08:26Z

### Impact

Assuming an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.

### Patches

Issue has been patched in Build 473 and v1.1.6

### Workarounds

Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade.

### References

Credits to:
• Sushi Yushi

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-gg96-f8wr-p89f
Summary: Script injection
Aliases: CVE-2021-32661
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-434, CWE-77
Published: 2021-06-04T19:09:26Z

### Impact

A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page.

The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store.

### Patches

The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-r742-7j4h-hjr8
Summary: Malicious Package in arsenic-tabasco-cyborg-peanut-butter
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:27:36Z

All versions of `arsenic-tabasco-cyborg-peanut-butter` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-f8h3-rqrm-47v9
Summary: Prototype Pollution in smart-extend
Severity: MODERATE
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-02T16:02:40Z

All versions of `smart-extend` are vulnerable to Prototype Pollution. The `deep()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-2m39-62fm-q8r3
Summary: Regular Expression Denial of Service in sshpk
Aliases: CVE-2018-3737
Severity: HIGH
CVSS score: 0
CWE: CWE-770
Published: 2018-08-15T13:22:23Z

Versions of `sshpk` before 1.13.2 or 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.


## Recommendation

Update to version 1.13.2, 1.14.1 or later.
Vulnerability: GHSA-2xgj-xhgf-ggjv
Summary: Heap buffer overflow in `BandedTriangularSolve`
Aliases: CVE-2021-29612
Severity: LOW
CVSS score: 3.6
CWE: CWE-120
Published: 2021-05-21T14:28:37Z

### Impact
An attacker can trigger a heap buffer overflow in Eigen implementation of `tf.raw_ops.BandedTriangularSolve`:

```python
import tensorflow as tf
import numpy as np
  
matrix_array = np.array([])
matrix_tensor = tf.convert_to_tensor(np.reshape(matrix_array,(0,1)),dtype=tf.float32)
rhs_array = np.array([1,1])
rhs_tensor = tf.convert_to_tensor(np.reshape(rhs_array,(1,2)),dtype=tf.float32)
tf.raw_ops.BandedTriangularSolve(matrix=matrix_tensor,rhs=rhs_tensor)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/linalg/banded_triangular_solve_op.cc#L269-L278) calls `ValidateInputTensors` for input validation but fails to validate that the two tensors are not empty:
  
```cc
void ValidateInputTensors(OpKernelContext* ctx, const Tensor& in0, const Tensor& in1) {
  OP_REQUIRES(
      ctx, in0.dims() >= 2, 
      errors::InvalidArgument("In[0] ndims must be >= 2: ", in0.dims()));

  OP_REQUIRES(
      ctx, in1.dims() >= 2,
      errors::InvalidArgument("In[1] ndims must be >= 2: ", in1.dims()));
}
``` 

Furthermore, since `OP_REQUIRES` macro only stops execution of current function after setting `ctx->status()` to a non-OK value, callers of helper functions that use `OP_REQUIRES` must check value of `ctx->status()` before continuing. This doesn't happen [in this op's implementation](https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/linalg/banded_triangular_solve_op.cc#L219), hence the validation that is present is also not effective.

### Patches
We have patched the issue in GitHub commit [ba6822bd7b7324ba201a28b2f278c29a98edbef2](https://github.com/tensorflow/tensorflow/commit/ba6822bd7b7324ba201a28b2f278c29a98edbef2) followed by GitHub commit [0ab290774f91a23bebe30a358fde4e53ab4876a0](https://github.com/tensorflow/tensorflow/commit/0ab290774f91a23bebe30a358fde4e53ab4876a0).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ye Zhang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-cgpp-wm2h-6hqx
Summary: SQL Injection in waterline-sequel
Aliases: CVE-2016-10551
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2019-02-18T23:54:28Z

Affected versions of `waterline-sequel` are vulnerable to SQL injection in cases where user input is passed into the `like`, `contains`, `startsWith`, or `endsWith` methods.



## Recommendation

Upgrade to at least version 0.5.1
Vulnerability: GHSA-pgr8-jg6h-8gw6
Summary: Cross-Site Scripting in webpack-bundle-analyzer
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2019-05-23T09:26:20Z

Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting.


## Recommendation

Upgrade to version 3.3.2 or later.
Vulnerability: GHSA-c77f-4rgj-jfr4
Summary: Cross-site Scripting in Beego
Aliases: CVE-2021-39391
Severity: HIGH
CVSS score: 6.1
CWE: CWE-64, CWE-79
Published: 2021-09-15T20:23:28Z

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.
Vulnerability: GHSA-qpv2-jxc7-3638
Summary: Exposure of Sensitive Information in snipe/snipe-it
Aliases: CVE-2022-0569
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200
Published: 2022-02-15T00:02:47Z

Snipe-IT prior to v5.3.10 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.
Vulnerability: GHSA-6rvj-pw9w-jcvc
Summary: Information disclosure vulnerability in OnionShare
Aliases: CVE-2021-41867
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2021-11-19T20:39:35Z

An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature.
Vulnerability: GHSA-frcx-xc72-c4v4
Summary: Use of Sha-1 in tusdotnet
Aliases: CVE-2021-44150
Severity: LOW
CVSS score: 3.1
CWE: CWE-327
Published: 2021-11-29T18:09:08Z

# Withdrawn

After reviewing this CVE, we have withdrawn this advisory due to it not having actual security impact.

# Original Advisory

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.
Vulnerability: GHSA-c87f-fq5g-63r2
Summary: Cross-site scripting in Unicorn framework
Aliases: CVE-2021-42053
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-10-12T17:51:11Z

The Unicorn framework through 0.35.3 for Django allows XSS via component.name.
Vulnerability: GHSA-r992-xph6-h7x2
Summary: Open redirect in microweber
Aliases: CVE-2022-0560
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-02-12T00:00:48Z

microweber prior to 1.2.11 is vulnerable to open redirect.
Vulnerability: GHSA-qmfx-75ff-8mw6
Summary: Listing of upload directory contents possible
Severity: HIGH
CVSS score: 0
Published: 2021-05-27T18:41:00Z

There's an security issue in prosody-filer versions **< 1.0.1** which leads to unwanted directory listings of download directories. 

An attacker is able to list previous uploads of a certain user by shortening the URL and accessing a URL subdirectors other than `/upload/` (or the corresponding user defined root dir)

Version 1.0.1 and later fix this problem and allow only direct file access if the full path is known. Directory listings are blocked entirely.
Vulnerability: GHSA-3wqh-h42r-x8fq
Summary: Denial of Service in @hapi/subtext
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:46:22Z

Versions of `@hapi/subtext` prior to 6.1.3 or 7.0.3 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 6.1.3 or 7.0.3
Vulnerability: GHSA-grg4-wf29-r9vv
Summary: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
Aliases: CVE-2021-37136
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-09-09T17:11:21Z

### Impact
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).


All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

### Workarounds
No workarounds other than not using the `Bzip2Decoder`

### References

Relevant code areas:

https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305
Vulnerability: GHSA-x52f-h74p-9jh8
Summary: Hijacked Environment Variables in node-sqlite
Aliases: CVE-2017-16048
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-506
Published: 2018-07-23T21:00:07Z

The `node-sqlite` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation




As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-9475-xg6m-j7pw
Summary: Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
Aliases: CVE-2020-5268
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-303
Published: 2020-04-22T20:59:37Z

### Impact
Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved.
The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a tocken to create a log in session.

### Patches
Version 1.0.2 and 2.7.0 are patched.

### Workarounds
Ensure that any IdentityProvider trusted by the Sustainsys.Saml2 SP only issues bearer tokens if the audience matches the Sustainsys.Saml2 SP.

### For more information
If you have any questions or comments about this advisory:
* Comment on #103
* Email us at security@sustainsys.com if you think that there are further security issues.
Vulnerability: GHSA-8849-5h85-98qw
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2019-9423
Severity: HIGH
CVSS score: 7.8
CWE: CWE-787
Published: 2021-10-12T22:22:17Z

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616
Vulnerability: GHSA-x4qm-mcjq-v2gf
Summary: Overflow in prost-types
Aliases: CVE-2021-38192
Severity: HIGH
CVSS score: 7.5
CWE: CWE-120, CWE-190
Published: 2021-08-25T20:55:53Z

An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
Vulnerability: GHSA-j866-8vxx-27hx
Summary: Hijacked Environment Variables in nodemailer.js
Aliases: CVE-2017-16072
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:43:53Z

The `nodemailer.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-7cvf-p83w-48q6
Summary: Malicious Package in beffer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:37:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-r96c-57pf-9jjm
Summary: Prototype Pollution in node.extend
Aliases: CVE-2018-16491
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-02-07T18:17:34Z

Versions of `node.extend` before 1.1.7 or 2.0.1 are vulnerable to prototype pollution. 


## Recommendation

Update to version 1.1.7, 2.0.1 or later.
Vulnerability: GHSA-v92m-hhhw-vv9v
Summary: Code injection in codiad
Aliases: CVE-2019-19208
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-09-01T18:27:12Z

Codiad Web IDE through 2.8.4 allows PHP Code injection.
Vulnerability: GHSA-hrmr-f5m6-m9pq
Summary: Moderate severity vulnerability that affects org.apache.commons:commons-compress
Aliases: CVE-2018-11771
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2018-10-19T16:41:27Z

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
Vulnerability: GHSA-864j-6qpp-cmrr
Summary: SQL Injection in Geocoder
Aliases: CVE-2020-7981
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2020-06-10T20:03:02Z

sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
Vulnerability: GHSA-wwh7-4jw9-33x6
Summary: High severity vulnerability that affects yajl-ruby
Aliases: CVE-2017-16516
Severity: HIGH
CVSS score: 7.5
CWE: CWE-134
Published: 2017-11-28T22:44:42Z

In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.
Vulnerability: GHSA-2g8g-63j4-9w3r
Summary: RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
Severity: HIGH
CVSS score: 0
Published: 2021-12-01T18:29:12Z

The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution.

### Impact
A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data.

### Patches
This is vulnerability is patched in version `0.15.14` of `@backstage/plugin-scaffolder-backend`.


### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-p5p2-rhc3-wmf3
Summary: Malicious Package in siganle
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:03:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-2647-c639-qv2j
Summary: Server-Side Request Forgery in calibreweb
Aliases: CVE-2022-0766
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-918
Published: 2022-03-08T00:00:31Z

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is due to an incomplete fix for [CVE-2022-0339](https://github.com/advisories/GHSA-4w8p-x6g8-fv64). The blacklist does not check for `0.0.0.0`, which would result in a payload of `0.0.0.0` resolving to `localhost`.
Vulnerability: GHSA-fg6m-q92x-vv38
Summary: Directory Traversal in dcserver
Aliases: CVE-2017-16158
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:26:00Z

Affected versions of `dcserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8p2p-p8mg-x3cw
Summary: Insight API transaction broadcast endpoint can result in Full Path Disclosure
Aliases: CVE-2018-1000023
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2018-03-05T19:33:54Z

Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
Vulnerability: GHSA-f6f2-pwrj-64h3
Summary: Moderate severity vulnerability that affects tryton
Aliases: CVE-2019-10868
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-862
Published: 2019-04-10T14:31:37Z

In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.
Vulnerability: GHSA-fmj2-7wx8-qj4v
Summary: Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Aliases: CVE-2020-11988
Severity: HIGH
CVSS score: 8.2
CWE: CWE-20, CWE-918
Published: 2022-02-09T00:45:56Z

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Vulnerability: GHSA-58c7-px5v-82hh
Summary: Potential sensitive information disclosed in error reports
Aliases: CVE-2021-21416
Severity: LOW
CVSS score: 3.7
CWE: CWE-209, CWE-201
Published: 2021-04-06T17:28:59Z

django-registration is a user-registration application for Django. 

### Impact

The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters to sensitive data, with the result that sensitive data could be included in error reports rather than removed automatically by Django.

Triggering this requires the following conditions:

* A site is using django-registration < 3.1.2
* The site has detailed error reports (such as Django's [emailed error reports to site staff/developers](https://docs.djangoproject.com/en/3.1/howto/error-reporting/#email-reports)) enabled
* A server-side error (HTTP 5xx) occurs during an attempt by a user to register an account

Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password).

### Patches

As of version 3.1.2, django-registration properly applies Django's `sensitive_post_parameters()` decorator to the base user-registration view, which will cause all data from the HTTP request body to be filtered from detailed error reports in the event of a server-side crash during user account registration.

Note that as applied, this filters *all* HTTP request data from error reports. To selectively allow some fields but not others, see Django's own documentation (in references) and the notes below for how to apply `sensitive_post_parameters()` manually to a particular codebase's `RegistrationView` subclass(es).

### Workarounds

Users who cannot upgrade quickly can apply the `django.views.decorators.debug.sensitive_post_parameters()` decorator to their own registration views. The decorator should be applied on the `dispatch()` method of the appropriate `RegistrationView` class, using Django's `method_decorator()` helper. For example:

```python
from django.utils.decorators import method_decorator
from django.views.decorators.debug import sensitive_post_parameters

from django_registration.views import RegistrationView

class MyRegistrationView(RegistrationView):
    """
    A RegistrationView subclass manually protected against sensitive information disclosure
    in error reports.

    """
    @method_decorator(sensitive_post_parameters())
    def dispatch(self, *args, **kwargs):
        return super().dispatch(*args, **kwargs)
```

### References

* Django's documentation on [error reporting in production](https://docs.djangoproject.com/en/3.1/howto/error-reporting/)
* [How Django's sensitive-data filters work](https://docs.djangoproject.com/en/3.1/howto/error-reporting/#filtering-error-reports)
Vulnerability: GHSA-r4c4-5fpq-56wg
Summary: Heap OOB in boosted trees
Aliases: CVE-2021-37664
Severity: HIGH
CVSS score: 7.3
CWE: CWE-125
Published: 2021-08-25T14:42:20Z

### Impact
An attacker can read from outside of bounds of heap allocated data by sending specially crafted illegal arguments to `BoostedTreesSparseCalculateBestFeatureSplit`:

```python
import tensorflow as tf

tf.raw_ops.BoostedTreesSparseCalculateBestFeatureSplit(
  node_id_range=[0,10],
  stats_summary_indices=[[1, 2, 3, 0x1000000]],
  stats_summary_values=[1.0],
  stats_summary_shape=[1,1,1,1],
  l1=l2=[1.0],
  tree_complexity=[0.5],
  min_node_weight=[1.0],
  logits_dimension=3,
  split_type='inequality')                                                                                                                                                                                                                                                                
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) needs to validate that each value in `stats_summary_indices` is in range.
  
### Patches
We have patched the issue in GitHub commit [e84c975313e8e8e38bb2ea118196369c45c51378](https://github.com/tensorflow/tensorflow/commit/e84c975313e8e8e38bb2ea118196369c45c51378).
  
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-4pc7-vqv5-5r3v
Summary: ECP SAML binding bypasses authentication flows
Aliases: CVE-2021-3827
Severity: MODERATE
CVSS score: 0
Published: 2022-04-27T21:25:59Z

### Description
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Vulnerability: GHSA-hc6c-75p4-hmq4
Summary: Reference binding to null pointer in `MatrixDiag*` ops
Aliases: CVE-2021-29515
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:20:54Z

### Impact
The implementation of [`MatrixDiag*` operations](https://github.com/tensorflow/tensorflow/blob/4c4f420e68f1cfaf8f4b6e8e3eb857e9e4c3ff33/tensorflow/core/kernels/linalg/matrix_diag_op.cc#L195-L197) does not validate that the tensor arguments are non-empty:

```cc
      num_rows = context->input(2).flat<int32>()(0);
      num_cols = context->input(3).flat<int32>()(0);
      padding_value = context->input(4).flat<T>()(0); 
``` 

Thus, users can trigger null pointer dereferences if any of the above tensors are null:

```python
import tensorflow as tf

d = tf.convert_to_tensor([],dtype=tf.float32)
p = tf.convert_to_tensor([],dtype=tf.float32)
tf.raw_ops.MatrixDiagV2(diagonal=d, k=0, num_rows=0, num_cols=0, padding_value=p)
```

Changing from `tf.raw_ops.MatrixDiagV2` to `tf.raw_ops.MatrixDiagV3` still reproduces the issue.

### Patches
We have patched the issue in GitHub commit [a7116dd3913c4a4afd2a3a938573aa7c785fdfc6](https://github.com/tensorflow/tensorflow/commit/a7116dd3913c4a4afd2a3a938573aa7c785fdfc6).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ye Zhang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-wrw9-m778-g6mc
Summary: Memory Exposure in bl
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2019-06-03T17:27:57Z

Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure.

`bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory


## Recommendation

Update to version 0.9.5, 1.0.1 or later.
Vulnerability: GHSA-h39x-m55c-v55h
Summary: Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
Aliases: CVE-2018-12542
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2018-10-17T16:20:45Z

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.
Vulnerability: GHSA-894f-rw44-qrw5
Summary: Hijacked Environment Variables in mongose
Aliases: CVE-2017-16077
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-10-10T17:28:21Z

The `mongose` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.