TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fr77-rrx3-cp7g
Summary: Heap OOB read in `tf.ragged.cross`
Aliases: CVE-2021-41212
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-11-10T19:00:31Z

### Impact
The [shape inference code for `tf.ragged.cross`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/ragged_array_ops.cc#L64) can trigger a read outside of bounds of heap allocated array:

```python
import tensorflow as tf

@tf.function
def test():
  y = tf.raw_ops.RaggedCross(ragged_values=[],
                             ragged_row_splits=[],
                             sparse_indices=[[5]],
                             sparse_values=[],
                             sparse_shape=[5],
                             dense_inputs=[['a']],
                             input_order='RD',
                             hashed_output=False,
                             num_buckets=5,
                             hash_key=2,
                             out_values_type=tf.string,
                             out_row_splits_type=tf.int64)
  return y

test()
```

### Patches
We have patched the issue in GitHub commit [fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8](https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
    
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-w9fg-xffh-p362
Summary: Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
Aliases: CVE-2021-21394
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-04-13T15:12:51Z

### Impact
Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.

### Patches
The issue is fixed by #9321.

### Workarounds
Depending on the needs and configuration of the homeserver a few options are available:

1. Using email as third-party identifiers be disabled by not configuring the `email` setting.
2. Using phone numbers as third-party identifiers can be disabled by ensuring that `account_threepid_delegates.msisdn` is not configured.
3. Additionally, the affected endpoint patterns can be blocked at a reverse proxy:

    * `^/_matrix/client/(r0|unstable)/register/email`
    * `^/_matrix/client/(r0|unstable)/register/msisdn`
    * `^/_matrix/client/(r0|unstable)/account/password`
    * `^/_matrix/client/(r0|unstable)/account/3pid`
Vulnerability: GHSA-9f3j-pm6f-9fm5
Summary: Race condition in Apache Tomcat
Aliases: CVE-2022-23181
Severity: HIGH
CVSS score: 7
CWE: CWE-367
Published: 2022-02-01T00:45:44Z

The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Vulnerability: GHSA-353r-3v84-9pjj
Summary: Malicious Package in nothing-js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T20:40:36Z

`nothing-js` contained a malicious script that attempted to delete all files when `npm test` was run.


## Recommendation

This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
Vulnerability: GHSA-g5wh-fw4m-2v28
Summary: CSRF vulnerability in Jenkins autonomiq plugin
Aliases: CVE-2022-25194
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-02-16T00:01:23Z

A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server using attacker-specified credentials.
Vulnerability: GHSA-wfw3-rgfr-6g67
Summary: XSS via Angular Expression in ag-grid
Aliases: CVE-2017-16009
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T16:40:42Z

Affected versions of `ag-grid` are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS.


## Recommendation

Avoid using `ag-grid` in combination with AngularJS until a fix is available.
Vulnerability: GHSA-8h77-3xwr-hqhh
Summary: Cross-site scripting in Jenkins Kiuwan Plugin
Aliases: CVE-2021-21666
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-16T17:10:50Z

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
Vulnerability: GHSA-427q-jp8v-ww95
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3976
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-11-23T18:16:50Z

CSRF related to duplicate action. (the duplication occurs first before redirecting to edit form). This vulnerability is capable of tricking admin users to duplicate teams.
Vulnerability: GHSA-8mgg-5x65-m4m4
Summary: Command Injection in soletta-dev-app
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-11T21:08:19Z

All versions of `soletta-dev-app` are vulnerable to Command Injection. The package does not validate user input on the `/api/service/status` API endpoint, passing contents of the `service` query parameter to an exec call. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-799f-r78p-gq9c
Summary: Use of Uninitialized Resource in acc_reader.
Aliases: CVE-2020-36513
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:17:38Z

An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
Vulnerability: GHSA-gr23-g276-xc73
Summary: Cross Site Request Forgery in concrete5/concrete5 
Aliases: CVE-2021-22954
Severity: HIGH
CVSS score: 0
CWE: CWE-352
Published: 2022-02-11T00:00:58Z

A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
Vulnerability: GHSA-954c-jjx6-cxv7
Summary: Reflected XSS from the callback handler's error query parameter
Aliases: CVE-2021-32702
Severity: HIGH
CVSS score: 8
CWE: CWE-79
Published: 2021-06-28T16:46:41Z

### Overview

Versions before and including `1.4.1` are vulnerable to reflected XSS.  An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message.

### Am I affected?
You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response.

### How to fix that?
Upgrade to version `1.4.2`.

### Will this update impact my users?
The fix adds basic HTML escaping to the error message and it should not impact your users.

### Credit

https://github.com/inian
https://github.com/git-ishanpatel
Vulnerability: GHSA-j6w9-fv6q-3q52
Summary: Percent-encoded cookies can be used to overwrite existing prefixed cookie names
Aliases: CVE-2020-8184
Severity: HIGH
CVSS score: 0
CWE: CWE-784
Published: 2020-06-24T17:15:00Z

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
Vulnerability: GHSA-cp67-8w3w-6h9c
Summary: Path Traversal
Aliases: CVE-2020-14366
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-02-09T00:58:03Z

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw
Vulnerability: GHSA-wq3r-jwrq-xg6w
Summary: Canceling of orders not related to the logged-in user
Severity: MODERATE
CVSS score: 0
Published: 2021-06-28T16:57:23Z

### Impact
Canceling of orders not related to the logged-in user

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-rhg5-fqr3-hrf5
Summary: Injection in DeltaSpike
Aliases: CVE-2019-12416
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-74
Published: 2022-02-10T20:54:31Z

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default.
Vulnerability: GHSA-2mp8-qvqm-3xwq
Summary: Restlet Framework, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request
Aliases: CVE-2017-14868
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-17T00:04:31Z

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.
Vulnerability: GHSA-5p5w-j3g7-w4wv
Summary: Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js
Aliases: CVE-2017-11429
Severity: MODERATE
CVSS score: 7.7
CWE: CWE-287
Published: 2019-07-05T21:11:18Z

Versions of `saml2-js` prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass.

The `saml2-js` library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Security Assertion Markup Language (SAML) is an XML-based markup language for security assertions regarding authentication and permissions, most commonly used for single sign-on (SSO) services.

Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.

A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider


## Recommendation

If you use 1.x upgrade to version 1.12.4 or greater 
If you use 2.x upgrade to version 2.02 or greater
Vulnerability: GHSA-vx85-mj8c-4qm6
Summary: Moderate severity vulnerability that affects org.apache.thrift:libthrift
Aliases: CVE-2018-11798
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-538
Published: 2019-01-17T13:56:33Z

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.
Vulnerability: GHSA-97gv-3p2c-xw7j
Summary: Denial of Service and Content Injection in i18n-node-angular
Aliases: CVE-2016-10524
Severity: HIGH
CVSS score: 8.2
CWE: CWE-74, CWE-400
Published: 2019-02-18T23:39:06Z

Versions of `i18n-node-angular` prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions.


## Recommendation

Update to version 1.4.0 or later.
Vulnerability: GHSA-v384-jqmq-fc74
Summary: XSS in Dolibarr ERP & CRM
Aliases: CVE-2020-7996
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-01-28T22:26:16Z

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
Vulnerability: GHSA-77hv-8796-8ccp
Summary: Moderate severity vulnerability that affects Plone and Zope2
Aliases: CVE-2012-5486
Severity: MODERATE
CVSS score: 0
Published: 2018-07-23T19:51:50Z

ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.
Vulnerability: GHSA-jwph-qp5h-f9wj
Summary: Data races in bunch
Aliases: CVE-2020-36450
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:59:18Z

An issue was discovered in the bunch crate through 2020-11-12 for Rust. 
Affected versions of this crate unconditionally implements `Send`/`Sync` for `Bunch<T>`.
This allows users to insert `T: !Sync` to `Bunch<T>`. It is possible to create a data race to a `T: !Sync` by invoking the `Bunch::get()` API (which returns `&T`) from multiple threads. It is also possible to send `T: !Send` to other threads by inserting `T` inside `Bunch<T>` and sending `Bunch<T>` to another thread, allowing to create a data race by inserting types like `T = Rc<_>`.

Such data races can lead to memory corruption.
Vulnerability: GHSA-8p5c-f328-9fvv
Summary: Diffoscope may write to arbitrary locations due to an untrusted archive
Aliases: CVE-2017-0359
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2018-07-13T16:01:21Z

diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Vulnerability: GHSA-f3j5-rmmp-3fc5
Summary: Improper Input Validation in jackson-databind
Aliases: CVE-2019-17267
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-06-15T18:44:48Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Vulnerability: GHSA-6x46-7rrv-m4h8
Summary: Low severity vulnerability that affects sqlite3-ruby
Aliases: CVE-2011-0995
Severity: LOW
CVSS score: 0
Published: 2017-10-24T18:33:38Z

The sqlite3-ruby gem in the rubygem-sqlite3 package before 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
Vulnerability: GHSA-w7jg-972m-rphv
Summary: Directory Traversal in susu-sum
Aliases: CVE-2017-16199
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:17:28Z

Affected versions of `susu-sum` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-h2jv-5v3f-7m7j
Summary: Downloads Resources over HTTP in adamvr-geoip-lite
Aliases: CVE-2016-10680
Severity: MODERATE
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:10:03Z

Affected versions of `adamvr-geoip-lite` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5hjh-c26m-xw8w
Summary: ProxyScotch is vulnerable to a server-side Request Forgery (SSRF)
Aliases: CVE-2022-25850
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2022-05-03T00:00:44Z

ProxyScotch is a simple proxy server created for hoppscotch.io. The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.
Vulnerability: GHSA-59g9-7gfx-c72p
Summary: Infinite loop in Tomcat due to parsing error
Aliases: CVE-2021-41079
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-09-20T20:45:44Z

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Vulnerability: GHSA-j739-gw6q-f4c7
Summary: HTML Injection in Froxlor
Aliases: CVE-2020-29653
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-14T00:00:19Z

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.
Vulnerability: GHSA-m7w4-8wp8-m2xq
Summary: Data races in beef
Aliases: CVE-2020-36442
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:08Z

An issue was discovered in the beef crate before 0.5.0 for Rust. 
Affected versions of this crate did not have a `T: Sync` bound in the `Send` impl for `Cow<'_, T, U>`. This allows users to create data races by making `Cow` contain types that are (Send && !Sync) like `Cell<_>` or `RefCell<_>`.

Such data races can lead to memory corruption.

The flaw was corrected in commit d1c7658 by adding trait bounds `T: Sync` and `T::Owned: Send` to the `Send` impl for `Cow<'_, T, U>`.
Vulnerability: GHSA-q799-q27x-vp7w
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2019-5064
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787, CWE-120
Published: 2021-10-12T22:23:21Z

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0 (corresponds with OpenCV-Python version 4.1.2.30). A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
Vulnerability: GHSA-42j4-733x-5vcf
Summary: Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7
Aliases: CVE-2020-36320
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-19T14:49:32Z

Unsafe validation RegEx in `EmailValidator` class in `com.vaadin:vaadin-server` versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2020-36320
Vulnerability: GHSA-4g7x-7vgq-3j28
Summary: Vulnerability in list function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36376
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2021-11-02T15:42:16Z

aaptjs is a node wraper for aapt. An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-gr4j-r575-g665
Summary: Cross-Site Scripting in highcharts
Severity: HIGH
CVSS score: 8.7
CWE: CWE-79
Published: 2020-08-25T14:04:47Z

Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS).  The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.
Vulnerability: GHSA-p5pg-wm9q-8v6r
Summary: Improper Handling of Exceptional Conditions inn metadata-extractor
Aliases: CVE-2022-24613
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-755
Published: 2022-02-25T00:01:05Z

metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Vulnerability: GHSA-fvqr-27wr-82fm
Summary: Prototype Pollution in lodash
Aliases: CVE-2018-3721
Severity: LOW
CVSS score: 0
CWE: CWE-471
Published: 2018-07-26T15:14:52Z

Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. 

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.5 or later.
Vulnerability: GHSA-8mm3-2mcj-cx6r
Summary: Malicious Package in angluar-cli
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:09:24Z

Version 0.0.3 of `angluar-cli` contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus on macOS.


## Recommendation

Remove the package from your environment and verify whether files were deleted and if processes were stopped.
Vulnerability: GHSA-cq9c-55r7-455x
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Aliases: CVE-2018-11787
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287
Published: 2019-01-07T19:14:51Z

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.
Vulnerability: GHSA-fvpg-qx3g-7mp7
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0771
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2019-04-09T19:43:29Z

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0773, CVE-2019-0783.
Vulnerability: GHSA-hjhp-hwfj-hwf3
Summary: Cross Site Request Forgery in firefly-iii 
Aliases: CVE-2021-4005
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-12-10T20:20:08Z

firefly-iii is vulnerable to a Cross-Site Request Forgery (CSRF) attack which can disable two factor authentication for the target user.
Vulnerability: GHSA-hq3v-rg6f-6hx4
Summary: Use of Insufficiently Random Values in yiisoft/yii2-dev
Aliases: CVE-2021-3689
Severity: HIGH
CVSS score: 7.5
CWE: CWE-330
Published: 2021-09-01T18:35:34Z

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Vulnerability: GHSA-j5jc-jf8f-86q7
Summary: Malicious Package in dictum.js
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:38:30Z

Version 1.0.5 of `dictum.js` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.5 of this module is found installed you will want to replace it with a version before or after 1.0.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-3x4c-pq33-4w3q
Summary: Improper authorisation of members discloses room membership to non-members
Aliases: CVE-2021-39164
Severity: LOW
CVSS score: 3.1
CWE: CWE-200
Published: 2021-09-01T18:25:27Z

### Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.

### Patches
Server administrators should upgrade to 1.41.1 or later.

### Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
* `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter
* `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter

### References
n/a

### For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Vulnerability: GHSA-mh37-8c3g-3fgc
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8322
Severity: HIGH
CVSS score: 0
Published: 2019-06-20T16:06:00Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Vulnerability: GHSA-6xhg-q9c8-rj32
Summary: Credential leak in react-native-fast-image
Aliases: CVE-2020-7696
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-05-18T01:52:54Z

This affects all versions before version 8.3.0 of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
Vulnerability: GHSA-mqh2-9wrp-vx84
Summary: Heap buffer overflow in `SparseSplit`
Aliases: CVE-2021-29558
Severity: LOW
CVSS score: 2.5
CWE: CWE-787
Published: 2021-05-21T14:24:51Z

### Impact
An attacker can cause a heap buffer overflow in `tf.raw_ops.SparseSplit`:

```python
import tensorflow as tf

shape_dims = tf.constant(0, dtype=tf.int64)
indices = tf.ones([1, 1], dtype=tf.int64)
values = tf.ones([1], dtype=tf.int64)
shape = tf.ones([1], dtype=tf.int64)

tf.raw_ops.SparseSplit(
    split_dim=shape_dims, indices=indices, values=values,
    shape=shape, num_split=1)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/699bff5d961f0abfde8fa3f876e6d241681fbef8/tensorflow/core/util/sparse/sparse_tensor.h#L528-L530) accesses an array element based on a user controlled offset:

```cc
const int dim = input_tensor.indices().matrix<int64>()(i, split_dim);
int slice_index = GetSliceIndex(dim, split_size, residual);
num_values[slice_index]++;
```

This results in overriding values on the heap.

### Patches
We have patched the issue in GitHub commit [8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31](https://github.com/tensorflow/tensorflow/commit/8ba6fa29cd8bf9cef9b718dc31c78c73081f5b31).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-98p5-x8x4-c9m5
Summary: Integer overflow in TFLite
Aliases: CVE-2022-23559
Severity: HIGH
CVSS score: 8.8
CWE: CWE-190
Published: 2022-02-09T23:52:51Z

### Impact 
An attacker can craft a TFLite model that would cause an integer overflow [in embedding lookup operations](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/embedding_lookup_sparse.cc#L179-L189):

```cc
  int embedding_size = 1;
  int lookup_size = 1;
  for (int i = 0; i < lookup_rank - 1; i++, k++) {
    const int dim = dense_shape->data.i32[i];
    lookup_size *= dim;
    output_shape->data[k] = dim;
  }
  for (int i = 1; i < embedding_rank; i++, k++) {
    const int dim = SizeOfDimension(value, i);
    embedding_size *= dim;
    output_shape->data[k] = dim;
  } 
```

Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication.

In certain scenarios, this can then result in heap OOB read/write.
  
### Patches
We have patched the issue in GitHub commits [f19be71717c497723ba0cea0379e84f061a75e01](https://github.com/tensorflow/tensorflow/commit/f19be71717c497723ba0cea0379e84f061a75e01), [1de49725a5fc4e48f1a3b902ec3599ee99283043](https://github.com/tensorflow/tensorflow/commit/1de49725a5fc4e48f1a3b902ec3599ee99283043) and [a4e401da71458d253b05e41f28637b65baf64be4](https://github.com/tensorflow/tensorflow/commit/a4e401da71458d253b05e41f28637b65baf64be4).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability: GHSA-jwhv-rgqc-fqj5
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2007-5380
Severity: MODERATE
CVSS score: 0
CWE: CWE-384
Published: 2017-10-24T18:33:38Z

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
Vulnerability: GHSA-8w3x-r6x7-c5r5
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2021-4084
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-12-16T14:28:27Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-g4h2-gqm3-c9wq
Summary: Segfault in tf.raw_ops.ImmutableConst
Aliases: CVE-2021-29539
Severity: LOW
CVSS score: 2.5
CWE: CWE-681
Published: 2021-05-21T14:23:05Z

### Impact
Calling [`tf.raw_ops.ImmutableConst`](https://www.tensorflow.org/api_docs/python/tf/raw_ops/ImmutableConst) with a `dtype` of `tf.resource` or `tf.variant` results in a segfault in the implementation as code assumes that the tensor contents are pure scalars.

```python
>>> import tensorflow as tf
>>> tf.raw_ops.ImmutableConst(dtype=tf.resource, shape=[], memory_region_name="/tmp/test.txt")
...
Segmentation fault
```

### Patches
We have patched the issue in 4f663d4b8f0bec1b48da6fa091a7d29609980fa4 and will release TensorFlow 2.5.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

### Workarounds
If using `tf.raw_ops.ImmutableConst` in code, you can prevent the segfault by inserting a filter for the `dtype` argument.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-9h4g-27m8-qjrg
Summary: Path Traversal in socket.io-file
Aliases: CVE-2020-15779
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2020-07-07T19:24:47Z

All versions of `socket.io-file` are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The `socket.io-file::createFile` message contains a `name` option that is passed directly to `path.join()`.   It is possible to upload files to arbitrary folders on the server by sending relative paths on the `name` value, such as `../../test.js`.  The `uploadDir` and `rename` options can be used to define the file upload path.
Vulnerability: GHSA-729f-wvj3-c4pj
Summary: Remote code execution in UReport
Aliases: CVE-2020-21125
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2021-09-20T20:45:03Z

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
Vulnerability: GHSA-33gc-f8v9-v8hm
Summary: Malicious Package in ladder-text-js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T20:41:40Z

`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run.



## Recommendation

This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
Vulnerability: GHSA-pgcp-m69h-p2gr
Summary: Cross-site Scripting (XSS) in moodle
Aliases: CVE-2020-25702
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-03-29T20:43:08Z

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.
Vulnerability: GHSA-mv78-g7wq-mhp4
Summary: Division by zero in padding computation in TFLite
Aliases: CVE-2021-29585
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:26:41Z

### Impact
The TFLite computation for size of output after padding, [`ComputeOutSize`](https://github.com/tensorflow/tensorflow/blob/0c9692ae7b1671c983569e5d3de5565843d500cf/tensorflow/lite/kernels/padding.h#L43-L55), does not check that the `stride` argument is not 0 before doing the division.

```cc
inline int ComputeOutSize(TfLitePadding padding, int image_size,
                          int filter_size, int stride, int dilation_rate = 1) {
  int effective_filter_size = (filter_size - 1) * dilation_rate + 1;
  switch (padding) {
    case kTfLitePaddingSame:
      return (image_size + stride - 1) / stride;
    case kTfLitePaddingValid:
      return (image_size + stride - effective_filter_size) / stride;
    default:
      return 0;
  }
}
```
  
Users can craft special models such that `ComputeOutSize` is called with `stride` set to 0.

### Patches
We have patched the issue in GitHub commit [49847ae69a4e1a97ae7f2db5e217c77721e37948](https://github.com/tensorflow/tensorflow/commit/49847ae69a4e1a97ae7f2db5e217c77721e37948).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-vr98-27qj-3c8q
Summary: Directory traversal in rollup-plugin-server
Aliases: CVE-2020-7686
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2020-07-29T18:07:35Z

This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation inside the readFileFromContentBase function.
Vulnerability: GHSA-h58v-c6rf-g9f7
Summary: Cross site scripting in the system log
Aliases: CVE-2021-35210
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-07-01T17:00:04Z

### Impact

It is possible to inject code into the `tl_log` table that will be executed in the browser when the system log is called in the back end.

### Patches

Update to Contao 4.9.16 or 4.11.5.

### Workarounds

Disable the system log module in the back end for all users (especially admin users).

### References

https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-grvw-q343-58wh
Summary: Out-of-bounds write
Aliases: CVE-2019-1300
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:55:57Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1298.
Vulnerability: GHSA-4vp3-vfww-8648
Summary: Incorrect permission enforcement in UmbracoCms
Aliases: CVE-2020-29454
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-732
Published: 2021-04-13T15:48:05Z

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
Vulnerability: GHSA-g86w-v5vg-9gxf
Summary: Directory traversal attack in Spring Cloud Config
Aliases: CVE-2020-5405
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-23, CWE-22
Published: 2020-06-05T16:11:36Z

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Vulnerability: GHSA-37hx-4mcq-wc3h
Summary: Weak Password Recovery Mechanism for Forgotten Password in Strapi
Aliases: CVE-2021-28128
Severity: HIGH
CVSS score: 8.1
CWE: CWE-640
Published: 2021-10-06T17:48:16Z

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
Vulnerability: GHSA-gmrf-99gw-vvwj
Summary: /user/sessions endpoint allows detecting valid accounts
Severity: HIGH
CVSS score: 0
CWE: CWE-203
Published: 2021-03-11T17:42:08Z

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
Vulnerability: GHSA-6m4r-m3gc-h4r5
Summary: OS Command Injection in install-package
Aliases: CVE-2020-7629
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:48:06Z

install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Vulnerability: GHSA-3p92-886g-qxpq
Summary: Remote Memory Exposure in floody
Severity: MODERATE
CVSS score: 5.1
CWE: CWE-201
Published: 2019-06-04T15:42:32Z

Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure.

.write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.

Proof of Concept: 

```
var f = require('floody')(process.stdout); 
f.write(USERSUPPLIEDINPUT); 
'f.stop();


## Recommendation

Update to version 0.1.1 or later.
Vulnerability: GHSA-f98m-q3hr-p5wq
Summary: Prototype Pollution in locutus
Aliases: CVE-2020-7719
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20, CWE-915
Published: 2021-05-06T18:12:22Z

All versions of package locutus prior to version 2.0.12 are vulnerable to Prototype Pollution via the php.strings.parse_str function.
Vulnerability: GHSA-xwjh-cp99-cj8q
Summary: Path Traversal in cordova-plugin-ionic-webview
Aliases: CVE-2018-16202
Severity: HIGH
CVSS score: 8.6
CWE: CWE-22
Published: 2019-02-12T15:36:35Z

Versions of `cordova-plugin-ionic-webview` prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications.  The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files.


## Recommendation

Upgrade to version 2.2.0
Vulnerability: GHSA-pvx3-gm3c-gmpr
Summary: Denial of Service in Go-Ethereum
Aliases: CVE-2022-23327
Severity: HIGH
CVSS score: 7.5
Published: 2022-03-05T00:00:46Z

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).
Vulnerability: GHSA-9vg3-cf92-h2h7
Summary: Insufficient Verification of Data Authenticity in python-keystoneclient
Aliases: CVE-2013-2167
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-345
Published: 2020-03-10T20:39:05Z

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
Vulnerability: GHSA-86vp-x3pr-79rx
Summary: Cross-site scripting in Apache airflow
Aliases: CVE-2020-17515
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-20T16:40:14Z

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.14. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Vulnerability: GHSA-4w97-57v2-3w44
Summary: False-negative validation results in MINT transactions with invalid baton
Aliases: CVE-2020-11072
Severity: CRITICAL
CVSS score: 8.6
CWE: CWE-697
Published: 2020-05-12T00:45:24Z

### Impact
Users could experience false-negative validation outcomes for [MINT](https://github.com/simpleledger/slp-specifications/blob/master/slp-token-type-1.md#mint---extended-minting-transaction) transaction operations.  A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

### Patches
npm package [slp-validate](https://www.npmjs.com/package/slp-validate) has been patched and published as version 1.2.1.

### Workarounds
Upgrade to slp-validate 1.2.1.

### References
* slp-validate [commit](https://github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [slp-validate](https://github.com/simpleledger/slp-validate/issues)
Vulnerability: GHSA-6268-v434-45m5
Summary: Cross-site Scripting in Grav
Aliases: CVE-2019-16126
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-08T20:06:08Z

Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
Vulnerability: GHSA-9c29-9h4m-wg5p
Summary: Users can view database names in Apache Superset
Aliases: CVE-2019-12414
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2020-02-26T19:55:14Z

In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab
Vulnerability: GHSA-22cm-3qf2-2wc7
Summary: LDAP Injection in is-user-valid
Aliases: CVE-2021-23335
Severity: HIGH
CVSS score: 7.5
CWE: CWE-74, CWE-90
Published: 2021-04-13T15:30:27Z

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.
Vulnerability: GHSA-xwgq-pcqx-hpmv
Summary: URL Redirection to Untrusted Site (Open Redirect) in Ktor
Aliases: CVE-2019-19703
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2020-02-12T18:45:50Z

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
Vulnerability: GHSA-gwrj-88fp-5m36
Summary: Code injection in Narou
Aliases: CVE-2021-35514
Severity: HIGH
CVSS score: 8.5
CWE: CWE-94
Published: 2021-07-02T18:36:01Z

Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
Vulnerability: GHSA-6m9g-jr8c-cqw3
Summary: Depth counting error in guard() leading to multiple potential security issues in aioxmpp
Aliases: CVE-2019-1000007
Severity: HIGH
CVSS score: 7.4
CWE: CWE-237
Published: 2020-04-29T17:12:39Z

### Impact
Possible remote Denial of Service or Data Injection.

### Patches
Patches are available in https://github.com/horazont/aioxmpp/pull/268. They have been backported to the 0.10 release series and 0.10.3 is the first release to contain the fix.

### Workarounds
To make the bug exploitable, an error suppressing ``xso_error_handler`` is required. By not using ``xso_error_handlers`` or not using the suppression function, the vulnerability can be mitigated completely (to our knowledge).

### References
The pull request contains a detailed description: https://github.com/horazont/aioxmpp/pull/268

### For more information
If you have any questions or comments about this advisory:
* [Join our chat](xmpp:aioxmpp@conference.zombofant.net?join)
* Email the maintainer [Jonas Schäfer](mailto:jonas@wielicki.name)
Vulnerability: GHSA-jc83-cpf9-q7c6
Summary: False-negative validation results in MINT transactions with invalid baton
Aliases: CVE-2020-11071
Severity: CRITICAL
CVSS score: 8.6
CWE: CWE-697
Published: 2020-05-12T00:39:03Z

### Impact
Users could experience false-negative validation outcomes for [MINT](https://github.com/simpleledger/slp-specifications/blob/master/slp-token-type-1.md#mint---extended-minting-transaction) transaction operations.  A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton.

### Patches
npm package [slpjs](https://www.npmjs.com/package/slpjs) has been patched and published as version 0.27.2.


### Workarounds
Upgrade to slpjs 0.27.2.

### References
* slpjs [commit](https://github.com/simpleledger/slpjs/commit/3671be2ffb6d4cfa94c00c6dc8649d1ba1d75754)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [slp-validate](https://github.com/simpleledger/slp-validate/issues) or [slpjs](https://github.com/simpleledger/slpjs/issues)