TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7733-hjv6-4h47
Summary: Cross-Site Scripting in ternary conditional operator
Aliases: CVE-2020-15241
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-601, CWE-79
Published: 2020-10-08T19:55:53Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0)
> * CWE-79

---

:information_source: &nbsp;This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020

---

### Problem
It has been discovered that the Fluid Engine (package `typo3fluid/fluid`) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.

```
{showFullName ? fullName : defaultValue}
```

### Solution
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this `typo3fluid/fluid` package that fix the problem described.

Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) releases:
* TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.5)
* TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1)

### Credits
Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.

### References
* [TYPO3-CORE-SA-2019-013](https://typo3.org/security/advisory/typo3-core-sa-2019-013)
Vulnerability: GHSA-jx8f-cpx7-fv47
Summary: Allocation of Resources Without Limits or Throttling in nvflare
Aliases: CVE-2022-21822
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2022-03-18T23:18:43Z

### Impact
NVIDIA FLARE contains a vulnerability in Admin Interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable

All versions before 2.0.16 are affected.

### Patches
The patch will be included in nvflare==2.0.16.

### Workarounds
The changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e and https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e  can be applied to any version of the NVIDIA FLARE without any adverse effect.

### Additional information
Issue Found on: 2022.3.3
Issue Found by: Oliver Sellwood (@Nintorac)
Vulnerability: GHSA-vpgc-7h78-gx8f
Summary: Validation bypass vulnerability
Severity: LOW
CVSS score: 0
Published: 2020-09-04T18:05:14Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-6vqp-h455-42mr
Summary: Uncontrolled Memory Allocation in Apache PDFBox
Aliases: CVE-2021-27906
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-789
Published: 2021-05-13T22:30:13Z

A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Vulnerability: GHSA-72m5-fvvv-55m6
Summary: Observable Differences in Behavior to Error Inputs in Bouncy Castle
Aliases: CVE-2020-26939
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-203
Published: 2021-04-22T16:16:49Z

In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
Vulnerability: GHSA-722q-3g9x-vp8q
Summary: Downloads Resources over HTTP in tomita-parser
Aliases: CVE-2016-10666
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:54:41Z

Affected versions of `tomita-parser` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `tomita-parser`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-327x-39hh-65wf
Summary: Out of bounds write in arenavec
Aliases: CVE-2021-29930
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-08-25T20:55:09Z

An issue was discovered in the arenavec crate through 0.1.1. A drop of uninitialized memory can sometimes occur upon a panic in T::default().
Vulnerability: GHSA-h6xw-mghq-7523
Summary: Unsafe parsing in SWHKD
Aliases: CVE-2022-27819
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-04-08T00:00:24Z

SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device).
Vulnerability: GHSA-q2cv-94xm-qvg4
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3921
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-352
Published: 2021-11-15T23:18:00Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-r6jx-9g48-2r5r
Summary: Arbitrary code execution due to YAML deserialization
Aliases: CVE-2021-37678
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-502
Published: 2021-08-25T14:41:12Z

### Impact
TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format.

```python
from tensorflow.keras import models

payload = '''
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
'''
  
models.model_from_yaml(payload)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/python/keras/saving/model_config.py#L66-L104) uses `yaml.unsafe_load` which can perform arbitrary code execution on the input.

### Patches
Given that YAML format support requires a significant amount of work, we have removed it for now.

We have patched the issue in GitHub commit [23d6383eb6c14084a8fc3bdf164043b974818012](https://github.com/tensorflow/tensorflow/commit/23d6383eb6c14084a8fc3bdf164043b974818012).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Arjun Shibu.
Vulnerability: GHSA-6p3c-v8vc-c244
Summary: The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
Aliases: CVE-2021-45697
Severity: CRITICAL
CVSS score: 9.8
Published: 2022-01-06T22:10:34Z

An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.
Vulnerability: GHSA-m2fp-c79h-rr79
Summary: Malicious Package in tensorplow
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:42:56Z

All versions of `tensorplow` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m9fq-c9hp-59g7
Summary: Cross-site Scripting in yourls
Aliases: CVE-2021-3785
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-09-20T20:42:52Z

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in edit dialog.
Vulnerability: GHSA-3hj2-hh36-hv9v
Summary: Data race in va-ts
Aliases: CVE-2020-36220
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-667, CWE-662, CWE-787
Published: 2021-08-25T20:51:56Z

An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
Vulnerability: GHSA-66vw-v2x9-hw75
Summary: Podman publishes a malicious image to public registries
Aliases: CVE-2022-1227
Severity: HIGH
CVSS score: 0
Published: 2022-04-30T00:00:35Z

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Vulnerability: GHSA-3rj3-qp2j-4fj2
Summary: Cross-Site Request Forgery in Jenkins P4 Plugin
Aliases: CVE-2021-21655
Severity: HIGH
CVSS score: 7.1
CWE: CWE-352
Published: 2022-03-18T17:53:10Z

A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.
Vulnerability: GHSA-4m9r-5gqp-7j82
Summary: High severity vulnerability that affects org.dspace:dspace-xmlui
Aliases: CVE-2016-10726
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-10-19T16:52:06Z

The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
Vulnerability: GHSA-3qrq-r688-vvh4
Summary: Multiple valid tokens for password reset in Shopware
Aliases: CVE-2022-24892
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-640
Published: 2022-04-28T21:02:17Z

### Impact
Multiple tokens for password reset could be requested. All tokens could be used to change the password.
This makes it possible for an attacker to take over the victims account if s/he gains access to the victims email account and finds unused password reset token in the emails within the time frame of two hours.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Vulnerability: GHSA-h5jv-4p7w-64jg
Summary: Uncontrolled Resource Consumption in Django
Aliases: CVE-2019-14233
Severity: HIGH
CVSS score: 2.8
CWE: CWE-400
Published: 2019-08-06T01:43:33Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
Vulnerability: GHSA-wqwf-x5cj-rg56
Summary: Arbitrary Command Injection
Aliases: CVE-2018-1002101
Severity: MODERATE
CVSS score: 7.1
CWE: CWE-78
Published: 2022-02-15T01:57:18Z

In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection.
Vulnerability: GHSA-73m2-3pwg-5fgc
Summary: Catastrophic backtracking in regex allows Denial of Service in Waitress
Aliases: CVE-2020-5236
Severity: CRITICAL
CVSS score: 5.7
CWE: CWE-400
Published: 2020-02-04T03:07:31Z

### Impact

When waitress receives a header that contains invalid characters it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and blocking any other interactions.

This would allow an attacker to send a single request with an invalid header and take the service offline.

Invalid header example:

```
Bad-header: xxxxxxxxxxxxxxx\x10
```

Increasing the number of `x`'s in the header will increase the amount of time Waitress spends in the regular expression engine.

This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230.

### Patches

The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible.

### Workarounds

If you have deployed a reverse proxy in front of Waitress it may already be rejecting requests that include invalid headers.

### Thanks

The Pylons Project would like to thank [Fil Zembowicz](https://github.com/fzembow) for reaching out and disclosing this vulnerability!

### References

Catastrophic backtracking explained: https://www.regular-expressions.info/catastrophic.html

### For more information
If you have any questions or comments about this advisory:

- open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
- email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: GHSA-wx5j-54mm-rqqq
Summary: HTTP request smuggling in io.netty:netty-codec-http
Aliases: CVE-2021-43797
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-444
Published: 2021-12-09T19:09:17Z

### Impact

Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.

Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.
Vulnerability: GHSA-xw7v-qrhc-jjg2
Summary: Access Control vulnerability in Dolibarr
Aliases: CVE-2021-37517
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863
Published: 2022-04-01T00:00:41Z

An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.1, in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
Vulnerability: GHSA-22mf-97vh-x8rw
Summary: TODO
Aliases: CVE-2019-12760
Severity: HIGH
CVSS score: 0
Published: 2019-06-13T16:12:57Z

** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution.  NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration."
Vulnerability: GHSA-qwqc-28w3-fww6
Summary: Message Signature Bypass in openpgp
Aliases: CVE-2019-9153
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2019-08-23T21:42:20Z

Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.


## Recommendation

Upgrade to version 4.2.0 or later.
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Vulnerability: GHSA-r8h9-hq9c-2p5c
Summary: High severity vulnerability that affects com.github.shyiko.ktlint:ktlint-core
Aliases: CVE-2019-1010260
Severity: HIGH
CVSS score: 8.1
CWE: CWE-319
Published: 2019-04-08T15:18:54Z

Using ktlint to download and execute custom rulesets can result in arbitrary code execution as the served jars can be compromised by a MITM. This attack is exploitable via Man in the Middle of the HTTP connection to the artifact servers. This vulnerability appears to have been fixed in 0.30.0 and later; after commit 5e547b287d6c260d328a2cb658dbe6b7a7ff2261.
Vulnerability: GHSA-5pv7-hx9m-8jh3
Summary: Missing permission checks in Jenkins Publish Over FTP Plugin
Aliases: CVE-2022-29051
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2022-04-13T00:00:16Z

Missing permission checks in Jenkins Publish Over FTP Plugin prior to 1.17 allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials.
Vulnerability: GHSA-g8jc-mm3c-cwhj
Summary: Malicious Package in reques
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:31:06Z

All versions of `reques` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-76mp-659p-rw65
Summary: Users registered with email verification can self re-activate their disabled accounts
Aliases: CVE-2021-32620
Severity: HIGH
CVSS score: 8.8
CWE: CWE-285
Published: 2021-05-18T18:36:21Z

### Impact
A user disabled on a wiki using email verification for registration can re-activate himself by using the activation link provided for his registration. 

### Patches
The problem has been patched in the following versions of XWiki: 11.10.13,  12.6.7, 12.10.2, 13.0.

### Workarounds
It's possible to workaround the issue by resetting the `validkey` property of the disabled XWiki users. This can be done by editing the user profile with object editor.

### References
https://jira.xwiki.org/browse/XWIKI-17942

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [Security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-r32x-jhw5-g48p
Summary: Cross-Site Scripting in eco
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T17:08:20Z

All versions of  `eco` are vulnerable to Cross-Site Scripting (XSS). The package's default `__escape` implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-m6ch-gg5f-wxx3
Summary: HTTP Proxy header vulnerability
Aliases: CVE-2016-5385
Severity: HIGH
CVSS score: 8.1
Published: 2022-04-07T13:59:22Z

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Vulnerability: GHSA-qwwg-gc55-qqrv
Summary: Out-of-bounds Write in Chakra
Aliases: CVE-2020-17131
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-04-13T15:54:40Z

Chakra Scripting Engine Memory Corruption Vulnerability
Vulnerability: GHSA-mm7r-265w-jv6f
Summary: Server-Side Request Forgery in @uppy/companion
Aliases: CVE-2020-8135
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2020-09-03T15:51:19Z

Versions of `@uppy/companion` prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The `get` route passes the user-controlled variable `req.body.url` to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of the server. 


## Recommendation

Upgrade to version 1.9.3 or later.
Vulnerability: GHSA-6qmf-fj6m-686c
Summary: Open Redirect in Flask-Security-Too
Aliases: CVE-2021-32618
Severity: LOW
CVSS score: 3.1
CWE: CWE-601
Published: 2021-05-17T20:51:27Z

### Impact
Flask-Security allows redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting  URL.

This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com
will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want.

This is considered a low severity due to the fact that if Werkzeug by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False` which would then open up their application to this attack.

### Patches
No patches as this time

### Workarounds
If using Werkzeug, make sure to use the default Location header setting. If you can't - then use@app.after_request and write your own validation of the Location header if it is set.

### References
No.

### For more information
If you have any questions or comments about this advisory follow: https://github.com/Flask-Middleware/flask-security/issues/486

Thanks to Claroty (2021-0141) and @snoopysecurity for providing details and proof of concept.
Vulnerability: GHSA-3h8m-483j-7xxm
Summary: Heap out of bounds read in `RequantizationRange`
Aliases: CVE-2021-29569
Severity: LOW
CVSS score: 2.5
CWE: CWE-125
Published: 2021-05-21T14:25:22Z

### Impact
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs:

```python
import tensorflow as tf

input = tf.constant([1], shape=[1], dtype=tf.qint32) 
input_max = tf.constant([], dtype=tf.float32)
input_min = tf.constant([], dtype=tf.float32)

tf.raw_ops.RequantizationRange(input=input, input_min=input_min, input_max=input_max)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/ac328eaa3870491ababc147822cd04e91a790643/tensorflow/core/kernels/requantization_range_op.cc#L49-L50) assumes that the `input_min` and `input_max` tensors have at least one element, as it accesses the first element in two arrays:

```cc
const float input_min_float = ctx->input(1).flat<float>()(0);
const float input_max_float = ctx->input(2).flat<float>()(0);
```

If the tensors are empty, `.flat<T>()` is an empty object, backed by an empty array. Hence, accesing even the 0th element is a read outside the bounds.

### Patches
We have patched the issue in GitHub commit [ef0c008ee84bad91ec6725ddc42091e19a30cf0e](https://github.com/tensorflow/tensorflow/commit/ef0c008ee84bad91ec6725ddc42091e19a30cf0e).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-crvj-3gj9-gm2p
Summary: High severity vulnerability that affects qs
Severity: HIGH
CVSS score: 0
Published: 2018-10-09T00:44:29Z

Withdrawn, accidental duplicate publish.

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Vulnerability: GHSA-4vr9-8cjf-vf9c
Summary: Async-h1 request smuggling possible with long unread bodies
Aliases: CVE-2020-26281
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-444
Published: 2021-10-12T16:00:37Z

### Impact
This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications.

If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body.

One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request.

Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary.


### Patches
This has been addressed in async-h1 2.3.0 and previous versions have been yanked.

### Workarounds
none

### References
https://github.com/http-rs/async-h1/releases/tag/v2.3.0

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [async-h1](https://github.com/http-rs/async-h1)
* Contact a core team member on [zulip](https://http-rs.zulip-chat.com) or [discord](https://discord.gg/x2gKzst)
Vulnerability: GHSA-4hrm-m67v-5cxr
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21346
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-434, CWE-502
Published: 2021-03-22T23:28:49Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21346](https://x-stream.github.io/CVE-2021-21346.html).

### Credits
wh1t3p1g G5-RD6@IIE found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-4q4x-67hx-5mpg
Summary: Failure to properly verify ed25519 signatures in libp2p-core
Aliases: CVE-2019-15545
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2021-08-25T20:44:08Z

An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.
Vulnerability: GHSA-vgvf-9jh3-fg75
Summary: Moderate severity vulnerability that affects io.swagger:swagger-codegen and io.swagger:swagger-parser
Aliases: CVE-2017-1000207
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2018-10-19T16:46:30Z

A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Vulnerability: GHSA-rc5r-697f-28x6
Summary: XSS injection in the Grid component of Sylius
Aliases: CVE-2019-12186
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2020-04-15T21:07:59Z

Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.
Vulnerability: GHSA-3vcg-8p79-jpcv
Summary: Improper Restriction of XML External Entity Reference in svglib
Aliases: CVE-2020-10799
Severity: HIGH
CVSS score: 9.8
CWE: CWE-611
Published: 2021-05-06T18:52:01Z

The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.
Vulnerability: GHSA-8cw6-5qvp-q3wj
Summary: Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-8024
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-200
Published: 2019-03-14T15:40:57Z

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible  for a malicious user to construct a URL pointing to a Spark cluster's UI's  job and stage info pages, and if a user can be tricked into accessing  the URL, can be used to cause script to execute and expose information  from the user's view of the Spark UI. While some browsers like recent  versions of Chrome and Safari are able to block this type of attack,  current versions of Firefox (and possibly others) do not.
Vulnerability: GHSA-xjqg-9jvg-fgx2
Summary: High severity vulnerability that affects nokogiri
Aliases: CVE-2015-5312
Severity: HIGH
CVSS score: 0
Published: 2018-08-21T19:03:04Z

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 (as used in nokogiri before 1.6.7.1) does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.
Vulnerability: GHSA-mcg6-h362-cmq5
Summary: Improper Authorization in cobbler
Aliases: CVE-2022-0860
Severity: HIGH
CVSS score: 8.2
CWE: CWE-863, CWE-285
Published: 2022-03-11T20:52:04Z

### Impact

If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places (Web UI, CLI & XMLRPC-API).

The same applies to user accounts with passwords set to be expired.

### Patches

There is a patch for the latest Cobbler `3.3.2` available, however a backport will be done for `3.2.x`.

### Workarounds

- Delete expired accounts which are able to access Cobbler via PAM.
- Use `chage -l <username>` to lock the account. If the account has SSH-Keys attached then remove them completely.

### References

- Originally discovered by @ysf at https://www.huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d/

### How to test if my Cobbler instance is affected?

The following `pytest` test assumes that your PAM setup is correct. In case the added user is not able to login, this test does not make sense to be executed.

```python
def test_pam_login_with_expired_user():
    # Arrange
    # create pam testuser
    test_username = "expired_user"
    test_password = "password"
    test_api = CobblerAPI()
    subprocess_1 = subprocess.run(
        ["perl", "-e", "'print crypt(\"%s\", \"%s\")'" % (test_username, test_password)],
        stdout=subprocess.PIPE
    )
    subprocess.run(["useradd", "-p", subprocess_1.stdout, test_username])
    # change user to be expired
    subprocess.run(["chage", "-E0", test_username])

    # Act
    result = pam.authenticate(test_api, test_username, test_password)

    # Assert - login should fail
    assert not result
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Cobbler repository](https://github.com/cobbler/cobbler/issues/new/choose)
* Ask in the [Gitter/Matrix Chat](https://gitter.im/cobbler/community)
* Email us at [cobbler.project@gmail.com](mailto:cobbler.project@gmail.com)
Vulnerability: GHSA-6w87-g839-9wv7
Summary: Helm OCI credentials leaked into Argo CD logs
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-532
Published: 2021-05-21T14:31:28Z

### Impact

When Argo CD was connected to a Helm OCI repository with authentication enabled, the credentials used for accessing the remote repository were logged.

Anyone with access to the pod logs - either via access with appropriate permissions to the Kubernetes control plane or a third party log management system where the logs from Argo CD were aggregated - could have potentially obtained the credentials to the Helm OCI repository.

If you are using Helm OCI repositories with Argo CD, it is strongly recommended to upgrade Argo CD to the latest patch version and to change the credentials used to access the repositories.

### Patches

A patch for this vulnerability is available with the v1.8.7 and v1.7.14 releases of Argo CD.

### Workarounds

No workaround available

### References

N/A

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`

### Credits

This vulnerability was found and reported by a third-party who wishes to stay anonymous. We want to thank this third-party for disclosing this vulnerability to us in a responsible manner.
Vulnerability: GHSA-mfwh-5m23-j46w
Summary: Environment Variable Injection in GitHub Actions
Aliases: CVE-2020-15228
Severity: LOW
CVSS score: 3.5
CWE: CWE-20, CWE-77
Published: 2020-10-01T17:16:20Z

### Impact
The `@actions/core` npm module `addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment variables being modified without the intention of the workflow or action author. 

### Patches
The runner will release an update that disables the `set-env` and `add-path` workflow commands in the near future. For now, users should upgrade to `@actions/core v1.2.6` or later, and replace any instance of the `set-env` or `add-path` commands in their workflows with the new [Environment File Syntax](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files). Workflows and actions using the old commands or older versions of the toolkit will start to warn, then error out during workflow execution.

### Workarounds
None, it is strongly suggested that you upgrade as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Actions Toolkit](https://github.com/actions/toolkit/issues)
Vulnerability: GHSA-8489-44mv-ggj8
Summary: Improper Input Validation and Injection in Apache Log4j2
Aliases: CVE-2021-44832
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-74, CWE-20
Published: 2022-01-04T16:14:20Z

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.


# Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.
Vulnerability: GHSA-vvfh-mvjv-w38q
Summary: Malicious Package in babel-loadre
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:28:19Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-vjw7-6gfq-6wf5
Summary: Path Traversal in Eclipse Vert
Aliases: CVE-2019-17640
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-23, CWE-22
Published: 2022-02-10T20:28:57Z

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4, 4.0.0-milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
Vulnerability: GHSA-6vfw-74wr-3chh
Summary: Cross-site Scripting in Crater Invoice
Aliases: CVE-2022-0372
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-28T00:03:42Z

Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability.
Vulnerability: GHSA-hwr7-8gxx-fj5p
Summary: Null pointer dereference in `RaggedTensorToTensor`
Aliases: CVE-2021-37638
Severity: HIGH
CVSS score: 7.7
CWE: CWE-476
Published: 2021-08-25T14:44:09Z

### Impact
Sending invalid argument for `row_partition_types` of `tf.raw_ops.RaggedTensorToTensor` API results in a null pointer dereference and undefined behavior:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToTensor(
  shape=1,
  values=10,
  default_value=21,
  row_partition_tensors=tf.constant([0,0,0,0]),
  row_partition_types=[])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/47a06f40411a69c99f381495f490536972152ac0/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L328) accesses the first element of a user supplied list of values without validating that the provided list is not empty.

### Patches
We have patched the issue in GitHub commit [301ae88b331d37a2a16159b65b255f4f9eb39314](https://github.com/tensorflow/tensorflow/commit/301ae88b331d37a2a16159b65b255f4f9eb39314).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-9378-f4v7-jgm4
Summary: Deserialization of Untrusted Data in org.apache.ddlutils:ddlutils
Aliases: CVE-2021-41616
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-10-04T20:12:30Z

Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.
Vulnerability: GHSA-8p5q-j9m2-g8wr
Summary: Withdrawn: Arbitrary code execution in lodash
Aliases: CVE-2021-41720
Severity: LOW
CVSS score: 9.8
CWE: CWE-77
Published: 2021-12-03T20:37:32Z

# Withdrawn

GitHub has chosen to publish this CVE as a withdrawn advisory due to it not being a security issue. See [this issue](https://github.com/lodash/lodash/issues/5261) for more details.

# CVE description

"** DISPUTED ** A command injection vulnerability in Lodash 4.17.21 allows attackers to achieve arbitrary code execution via the template function. This is a different parameter, method, and version than CVE-2021-23337. NOTE: the vendor's position is that it's the developer's responsibility to ensure that a template does not evaluate code that originates from untrusted input.
Vulnerability: GHSA-xrrg-wfwc-c7r3
Summary: Malicious Package in bictoin-ops
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:33:52Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-vh59-v9r5-4mh4
Summary: Cross-site scripting in jspdf
Aliases: CVE-2020-7690
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-17T21:01:32Z

It's possible to inject JavaScript code via the html method.
Vulnerability: GHSA-jf8x-wg7f-p3w8
Summary: Malicious Package in cage-js
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:22:33Z

All versions of `cage-js`  contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-h8pj-cxx2-jfg2
Summary: Improper Input Validation in httpx
Aliases: CVE-2021-41945
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2022-04-29T00:00:25Z

Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
Vulnerability: GHSA-84fq-6626-w5fg
Summary: CORS Token Disclosure in crumb
Aliases: CVE-2014-7193
Severity: MODERATE
CVSS score: 0
CWE: CWE-284
Published: 2017-10-24T18:33:36Z

When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.


## Recommendation

Update to version 3.0.0 or greater.
Vulnerability: GHSA-q8gv-q7wr-9jf8
Summary: Segfault in Tensorflow
Aliases: CVE-2020-15204
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-476
Published: 2020-09-25T18:28:41Z

### Impact
In eager mode, TensorFlow does not set the session state. Hence, calling `tf.raw_ops.GetSessionHandle` or `tf.raw_ops.GetSessionHandleV2` results in a null pointer dereference:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/session_ops.cc#L45

In the above snippet, in eager mode, `ctx->session_state()` returns `nullptr`. Since code immediately dereferences this, we get a segmentation fault.

### Patches
We have patched the issue in 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.