TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-8hfj-xrj2-pm22
Summary: Certificate check bypass in openssl-src
Aliases: CVE-2021-3450
Severity: HIGH
CVSS score: 7.4
CWE: CWE-295
Published: 2021-08-25T20:54:00Z

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).
Vulnerability: GHSA-9p49-cwh3-4qhf
Summary: Malicious Package in grunt-radic
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:21:19Z

Version 0.1.1 of `grunt-radic` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-vxvp-4xwc-jpp6
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2015-3226
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
Vulnerability: GHSA-jq65-29v4-4x35
Summary: Null pointer deference in openssl-src 
Aliases: CVE-2020-1967
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-08-25T20:45:15Z

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Vulnerability: GHSA-cx3w-xqmc-84g5
Summary: Git LFS can execute a Git binary from the current directory on Windows
Aliases: CVE-2021-21237
Severity: HIGH
CVSS score: 7.2
CWE: CWE-94, CWE-426
Published: 2022-02-15T00:30:37Z

### Impact
On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.

This is the result of an incomplete fix for CVE-2020-27955.

This issue occurs because on Windows, [Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator](https://github.com/golang/go/issues/38736).

### Patches
This version should be patched in v2.13.2, which will be released in coordination with this security advisory.

### Workarounds
Other than avoiding untrusted repositories or using a different operating system, there is no workaround.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:

- Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).
- If you cannot open a discussion, please email the core team using their usernames at `github.com`.
Vulnerability: GHSA-h92m-42h4-82f6
Summary: High severity vulnerability that affects postfix-mta-sts-resolver
Aliases: CVE-2019-16791
Severity: HIGH
CVSS score: 6.9
CWE: CWE-757
Published: 2019-07-05T21:06:58Z

## Incorrect query parsing

### Impact
All users of versions prior to 0.5.1 can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.

### Patches
Problem has been patched in version 0.5.1

### Workarounds
Users may remediate this vulnerability without upgrading by applying [these patches](https://gist.github.com/Snawoot/b9da85d6b26dea5460673b29df1adc6b) to older suppoorted versions.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [postfix-mta-sts-resolver repo](https://github.com/Snawoot/postfix-mta-sts-resolver)
* Email me at [vladislav at vm-0 dot com](mailto:vladislav-ex-gh-advisory@vm-0.com)
Vulnerability: GHSA-jp6r-xcjj-5h7r
Summary: Cross-Site Scripting in cyberchef
Aliases: CVE-2019-15532
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-27T17:36:32Z

Versions of `cyberchef` prior to 8.31.3 are vulnerable to Cross-Site Scripting. In `Text Encoding Brute Force` the table rows are created by concatenating the `value` variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 8.31.3 or later.
Vulnerability: GHSA-gprm-xqrc-c2j3
Summary: Command Injection in Kylin
Aliases: CVE-2020-1956
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2020-07-27T22:51:44Z

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Vulnerability: GHSA-mp6r-fgw2-rxfx
Summary: Multiple soundness issues
Aliases: CVE-2021-26956
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-657
Published: 2021-08-25T20:53:27Z

An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.
Vulnerability: GHSA-wmcq-3wfx-qjx5
Summary: Directory Traversal in nodeload-nmickuli
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:33:30Z

Affected versions of `nodeload-nmickuli` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4g52-pqcj-phvh
Summary: BLS Signature "Malleability"
Aliases: CVE-2021-21405
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-347
Published: 2021-05-21T16:23:43Z

### Impact

1. BLS signature validation in lotus uses blst library method VerifyCompressed. This method accepts signatures in 2 forms - "serialized", and "compressed", meaning that BLS signatures can be provided as either of 2 unique byte arrays.
2. Lotus block validation functions perform a uniqueness check on provided blocks. Two blocks are considered distinct if the CIDs of their blockheader do not match. The CID method for blockheader includes the BlockSig of the block.

The result of these issues is that it would be possible to punish miners for valid blocks, as there are two different valid block CIDs available for each block, even though this must be unique.

### Patches

By switching from the go based `blst` bindings over to the bindings in `filecoin-ffi`, the code paths now ensure that all signatures are compressed by size and the way they are deserialized.
This happened in https://github.com/filecoin-project/lotus/pull/5393


### References

- Original POC: https://gist.github.com/wadeAlexC/2490d522e81a796af9efcad1686e6754
Vulnerability: GHSA-g8r4-p96j-xfxc
Summary: Twig allowing dangerous PHP functions by default in getgrav/grav
Aliases: CVE-2021-29440
Severity: HIGH
CVSS score: 8.4
CWE: CWE-94
Published: 2021-04-16T19:53:12Z

### Impact

Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. 
As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.

### Patches

The issue was addressed by preventing dangerous functions from being called in Twig templates. A configuration option has been added to manually allow arbitrary PHP functions (`system.twig.safe_functions`) and filters (`system.twig.safe_filters`). 

Futures major versions of Grav may disable this functionality by default. 

### Workarounds

Blocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation. 

### References

- https://portswigger.net/research/server-side-template-injection
- https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities

### For more information

If you have any questions or comments about this advisory, you can contact:
  - The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
  - The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-hx5g-8hq2-8x4w
Summary: SQL Injection in Kylin
Aliases: CVE-2020-13926
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2020-07-27T22:51:40Z

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
Vulnerability: GHSA-369h-pjr2-6wrh
Summary: Uncontrolled recursion in trust-dns-proto
Aliases: CVE-2018-20994
Severity: HIGH
CVSS score: 7.5
CWE: CWE-674
Published: 2021-08-25T20:43:16Z

An issue was discovered in the trust-dns-proto crate before 0.5.0-alpha.3 for Rust. There is infinite recursion because DNS message compression is mishandled.
Vulnerability: GHSA-gf2v-9hp6-44qg
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2016-3083
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2019-03-14T15:40:32Z

Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.
Vulnerability: GHSA-cx8m-8xmx-q8v3
Summary: Denial of Service in memjs
Aliases: CVE-2018-3767
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2018-10-10T17:25:12Z

Versions of `memjs` prior to 1.2.2 are vulnerable to Denial of Service (DoS).  The package fails to sanitize the `value` option passed to the Buffer constructor, which may allow attackers to pass large values exhausting system resources.


## Recommendation

Upgrade to version 1.2.2 or later.
Vulnerability: GHSA-5h6m-9mvx-m6c5
Summary: Moderate severity vulnerability that affects mayan-edms
Aliases: CVE-2018-16407
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-06T03:25:03Z

An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.
Vulnerability: GHSA-cq94-qf6q-mf2h
Summary: Moderate severity vulnerability that affects pysaml2
Aliases: CVE-2017-1000246
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-330
Published: 2018-07-16T16:50:30Z

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data.
Vulnerability: GHSA-xr3g-4gg5-w3wq
Summary: Malicious Package in degbu
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:06:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-5f7m-mmpc-qhh4
Summary: Remote Memory Exposure in mysql
Severity: MODERATE
CVSS score: 0
CWE: CWE-201
Published: 2019-05-23T09:27:00Z

Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.

Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.

Only `mysql` running on Node.js versions below 6.0.0 is affected due to a throw added in newer node.js versions.

Proof of Concept:

```
require('mysql').createConnection({
  host: 'localhost',
  user: 'user',
  password : USERPROVIDEDINPUT,  // number
  database : 'my_db'
}).connect();
```



## Recommendation

Update to version 2.14.0 or later.
Vulnerability: GHSA-rrfc-g2gh-xvjm
Summary: Directory Traversal in 22lixian
Aliases: CVE-2017-16162
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:46:07Z

Affected versions of `22lixian` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jv35-xqg7-f92r
Summary: Prototype Pollution
Aliases: CVE-2021-25949
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-06-21T17:16:09Z

Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-32gv-6cf3-wcmq
Summary: HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
Severity: CRITICAL
CVSS score: 0
Published: 2022-03-14T22:45:11Z

### Impact
Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:

Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515

A Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).

### Workarounds
There are no workarounds.

### References
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Twisted's Trac](https://twistedmatrix.com/trac/)
Vulnerability: GHSA-ghhp-997w-qr28
Summary: .NET Core Remote Code Execution Vulnerability
Aliases: CVE-2021-26701
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-04-21T19:38:01Z

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

### Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0, .NET Core 3.1, and .NET Core 2.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A remote code execution vulnerability exists in .NET 5 and .NET Core due to how text encoding is performed.

### Discussion

Discussion for this issue can be found at dotnet/runtime#49377

### Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

### Affected software

The vulnerable package is `System.Text.Encodings.Web` . Upgrading your package and redeploying your app should be sufficient to address this vulnerability.

Vulnerable package versions:

Any .NET 5, .NET Core, or .NET Framework based application that uses the System.Text.Encodings.Web package with a vulnerable version listed below.

Package Name | Vulnerable Versions | Secure Versions
-|-|-
System.Text.Encodings.Web | 4.0.0 - 4.5.0 | 4.5.1
System.Text.Encodings.Web |  4.6.0-4.7.1 | 4.7.2
System.Text.Encodings.Web | 5.0.0 |  5.0.1


Please validate that each of the .NET versions you are using is in support. Security updates are only provided for supported .NET versions.
Vulnerability: GHSA-ccq6-3qx5-vmqx
Summary: Moderate severity vulnerability that affects is-my-json-valid
Severity: MODERATE
CVSS score: 0
Published: 2018-07-31T22:54:14Z

Withdrawn, accidental duplicate publish.

The is-my-json-valid package before 2.12.4 for Node.js has an incorrect exports['utc-millisec'] regular expression, which allows remote attackers to cause a denial of service (blocked event loop) via a crafted string.
Vulnerability: GHSA-fh39-v733-mxfr
Summary: Moderate severity vulnerability that affects activerecord
Aliases: CVE-2012-2661
Severity: MODERATE
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
Vulnerability: GHSA-92x2-jw7w-xvvx
Summary: Cookie and header exposure in twisted
Aliases: CVE-2022-21712
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-346
Published: 2022-02-07T22:36:00Z

### Impact

Cookie and Authorization headers are leaked when following cross-origin redirects in `twited.web.client.RedirectAgent` and `twisted.web.client.BrowserLikeRedirectAgent`.
Vulnerability: GHSA-8j4w-5fw4-rm27
Summary: Prototype Pollution in deeply
Aliases: CVE-2019-10750
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-400
Published: 2019-08-27T17:45:33Z

Versions of `deeply` prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

Upgrade to version 3.1.0 or later.
Vulnerability: GHSA-px4w-rcv2-6x8x
Summary: Arbitrary code execution in Apache ServiceComb java-chassis
Aliases: CVE-2020-17532
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2022-02-09T22:19:00Z

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution.
The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
Vulnerability: GHSA-mq6c-fh97-4gwv
Summary: Denial of Service vulnerability with large JSON payloads in fastify
Aliases: CVE-2018-3711
Severity: HIGH
CVSS score: 0
CWE: CWE-770
Published: 2018-07-18T21:20:34Z

Affected versions of `fastify` are vulnerable to a denial of service when processing a request with `Content-Type` set to `application/json` and a very large payload.


## Recommendation

Update to version 0.38.0 or later.
Vulnerability: GHSA-vpj4-89q8-rh38
Summary: Cross-Site Scripting in bpmn-js-properties-panel
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T18:16:59Z

Versions of `bpmn-js-properties-panel` prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.31.0 or later.
Vulnerability: GHSA-c582-c96p-r5cq
Summary: Memory exhaustion in Tensorflow
Aliases: CVE-2022-21732
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-400, CWE-770
Published: 2022-02-10T00:20:29Z

### Impact 
The [implementation of `ThreadPoolHandle`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/data/experimental/threadpool_dataset_op.cc#L79-L135) can be used to trigger a denial of service attack by allocating too much memory:

```python
import tensorflow as tf
y = tf.raw_ops.ThreadPoolHandle(num_threads=0x60000000,display_name='tf')
```

This is because the `num_threads` argument is only checked to not be negative, but there is no upper bound on its value.
    
### Patches
We have patched the issue in GitHub commit [e3749a6d5d1e8d11806d4a2e9cc3123d1a90b75e](https://github.com/tensorflow/tensorflow/commit/e3749a6d5d1e8d11806d4a2e9cc3123d1a90b75e).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-74fj-2j2h-c42q
Summary: Exposure of sensitive information in follow-redirects
Aliases: CVE-2022-0155
Severity: HIGH
CVSS score: 8
CWE: CWE-359
Published: 2022-01-12T22:46:26Z

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Vulnerability: GHSA-9p77-mmrw-69c7
Summary: Null-dereference in Tensorflow
Aliases: CVE-2022-23570
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-476
Published: 2022-02-09T23:33:35Z

### Impact
When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is [guarded by a `DCHECK`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L104-L106):

```cc
  const auto* attr = attrs.Find(arg->s()); 
  DCHECK(attr != nullptr);
  if (attr->value_case() == AttrValue::kList) {
    // ...
  }
```
However, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure.

### Patches
We have patched the issue in GitHub commit [8a513cec4bec15961fbfdedcaa5376522980455c](https://github.com/tensorflow/tensorflow/commit/8a513cec4bec15961fbfdedcaa5376522980455c).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-px9h-x66r-8mpc
Summary: path traversal in Jooby
Aliases: CVE-2020-7647
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2020-05-13T16:29:26Z

### Impact
Access to sensitive information available from classpath. 

### Patches
Patched version: 1.6.7 and 2.8.2

Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009

Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References

Latest 1.x version: 1.6.6

#### Arbitrary class path resource access 1
When sharing a *File System* directory as in:

``` java
assets("/static/**", Paths.get("static"));
```

The class path is also searched for the file (`org.jooby.handlers.AssetHandler.loader`):
[jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub](https://github.com/jooby-project/jooby/blob/1.x/jooby/src/main/java/org/jooby/handlers/AssetHandler.java)

``` java
  private static Loader loader(final Path basedir, final ClassLoader classloader) {
    if (Files.exists(basedir)) {
      return name -> {
        Path path = basedir.resolve(name).normalize();
        if (Files.exists(path) && path.startsWith(basedir)) {
          try {
            return path.toUri().toURL();
          } catch (MalformedURLException x) {
            // shh
          }
        }
        return classloader.getResource(name);
      };
    }
    return classloader::getResource;
  }
```

If we send `/static/WEB-INF/web.xml` it will fail to load it from the file system but will go into `classloader.getResource(name)` where name equals `/WEB-INF/web.xml` so will succeed and return the requested file. This way we can get any configuration file or even the application class files

If assets are configured for a certain extension we can still bypass it. eg:

```java
assets("/static/**/*.js", Paths.get("static"));
```

We can send:

```
http://localhost:8080/static/io/yiss/App.class.js
```

#### Arbitrary class path resource access 2
This vulnerability also affects assets configured to access resources from the root of the class path. eg:

```java
assets("/static/**");
```

In this case we can traverse `static` by sending:

```
http://localhost:8080/static/..%252fio/yiss/App.class
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jooby](https://github.com/jooby-project/jooby/issues)
* Email us at [support@jooby.io](mailto:support@jooby.io)
Vulnerability: GHSA-p8fm-w787-x6x3
Summary: Malicious Package in portionfatty12
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T15:50:28Z

All versions of `portionfatty12` are considered malicious. The package is malware designed to steal user's data. When installed it uploads the user's public SSH keys to a remote server.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.
Vulnerability: GHSA-fgxq-p49f-qw99
Summary: Directory Traversal in isomorphic-git
Aliases: CVE-2021-30483
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2021-09-02T22:00:20Z

isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
Vulnerability: GHSA-67c7-5v9j-227r
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3983
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-79
Published: 2021-12-03T20:43:06Z

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-43m5-c88r-cjvv
Summary: XSS due to lack of CSRF validation for replying/publishing
Aliases: CVE-2020-15156
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-352
Published: 2020-08-26T18:55:38Z

### Impact
Due to lack of CSRF validation, a logged in user is potentially vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum.

### Patches
Upgrade to the latest version v0.7.0

### Workarounds
You can cherry-pick the following commit: [https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618](https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618)

### References
Visit https://community.nodebb.org if you have any questions about this issue or on how to patch / upgrade your instance.
Vulnerability: GHSA-86hp-cj9j-33vv
Summary: Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and 	Exposure of Sensitive Information to an Unauthorized Actor in Ansible
Aliases: CVE-2020-1753
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-200, CWE-532
Published: 2021-04-07T20:33:26Z

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
Vulnerability: GHSA-96r7-mrqf-jhcc
Summary: Prototype Pollution in ini-parser
Aliases: CVE-2020-7617
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2020-06-10T20:27:53Z

All versions of `ini-parser` are vulnerable to prototype pollution. The `parse` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-j29g-g982-pwpv
Summary: Cross-site scripting (XSS)
Aliases: CVE-2020-17551
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-03-12T21:34:11Z

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
Vulnerability: GHSA-qcg2-h349-vwm3
Summary: Cross-site Scripting in React Draft Wysiwyg
Aliases: CVE-2021-31712
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2021-05-06T15:52:35Z

react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.
Vulnerability: GHSA-vx6j-pjrh-vgjh
Summary: PHP file inclusion in the Sulu admin panel
Aliases: CVE-2021-43836
Severity: HIGH
CVSS score: 8.5
CWE: CWE-22
Published: 2021-12-15T22:54:20Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution.

* Compromised components: Arbitrary file read on the server, (Potential) Remote code execution
* Exploitation pre-requisite: User account on the backend

### Patches

_Has the problem been patched? What versions should users upgrade to?_

The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language. 

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Vulnerability: GHSA-rqgp-ccph-5w65
Summary: Cross-Site Request Forgery in firefly-iii
Aliases: CVE-2021-3901
Severity: LOW
CVSS score: 3.5
CWE: CWE-352
Published: 2021-10-28T23:14:14Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-22wc-c9wj-6q2v
Summary: VVE-2021-0001: Memory corruption using function calls within arrays
Severity: MODERATE
CVSS score: 0
CWE: CWE-129
Published: 2021-04-19T15:12:05Z

### Impact
When performing a function call inside an array, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack.

### Patches
This issue was partially fixed in [VVE-2020-0004](https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf), however the fix did not update similar code for arrays, which had a similar issue. The issue is fully fixed in https://github.com/vyperlang/vyper/pull/2345
Vulnerability: GHSA-rf3m-mhv7-x39f
Summary: Denial of Service in OpenShift Origin
Aliases: CVE-2015-5250
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20
Published: 2021-12-20T16:58:22Z

The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.
Vulnerability: GHSA-269m-695x-j34p
Summary: Moderate severity vulnerability that affects org.apache.qpid:qpid-broker
Aliases: CVE-2017-15702
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-10-19T16:41:04Z

In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider that was configured on a different port. The attacker still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the spoofed port has weaker authentication protection (e.g., anonymous access, default accounts) and is normally protected by firewall rules or similar which can be circumvented by this vulnerability. AMQP ports are not affected. Versions 6.0.0 and newer are not affected.
Vulnerability: GHSA-w9vv-q986-vj7x
Summary: Out of bounds read in uu_od
Aliases: CVE-2021-29934
Severity: HIGH
CVSS score: 7.3
CWE: CWE-125
Published: 2021-08-25T20:54:24Z

An issue was discovered in PartialReader in the uu_od crate before 0.0.4 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation.
Vulnerability: GHSA-f2jv-r9rf-7988
Summary: Remote code execution in handlebars when compiling templates
Aliases: CVE-2021-23369
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-06T15:57:44Z

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Vulnerability: GHSA-462w-v97r-4m45
Summary: High severity vulnerability that affects Jinja2
Aliases: CVE-2019-10906
Severity: HIGH
CVSS score: 8.6
Published: 2019-04-10T14:30:24Z

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Vulnerability: GHSA-5m2v-hc64-56h6
Summary: A crafted ZIP file can cause a denial of service in Rubyzip
Aliases: CVE-2019-16892
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400
Published: 2019-09-30T16:05:32Z

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
Vulnerability: GHSA-93pj-4p65-qmr9
Summary: Insufficient user authorization in Moodle
Aliases: CVE-2022-0334
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-668, CWE-863
Published: 2022-01-28T22:07:40Z

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Vulnerability: GHSA-5rc6-2r3r-fv79
Summary: Downloads Resources over HTTP in slimerjs-edge
Aliases: CVE-2016-10644
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-08-15T19:25:47Z

Affected versions of `slimerjs-edge` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `slimerjs-edge`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-36j3-xxf7-4pqg
Summary: Universal XSS in Android WebView
Aliases: CVE-2020-6506
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863, CWE-79
Published: 2020-10-02T16:22:41Z

A universal cross-site scripting (UXSS) vulnerability, CVE-2020-6506 (https://crbug.com/1083819), has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps which use a `react-native-webview` that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106.

## Pending mitigation

Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

### References

https://alesandroortiz.com/articles/uxss-android-webview-cve-2020-6506/
Vulnerability: GHSA-23wc-v4mf-x7v4
Summary: Directory Traversal in intsol-package
Aliases: CVE-2017-16178
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:44:45Z

`intsol-package` is a file server.

`intsol-package` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost
```
and the server's Response
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fx83-3ph3-9j2q
Summary: Cross-site Scripting (XSS) in Django REST Framework
Aliases: CVE-2020-25626
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-20, CWE-79, CWE-77
Published: 2021-03-19T21:32:47Z

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.
Vulnerability: GHSA-pwm7-qr6j-3vjg
Summary: Prototype Pollution in realms-shim
Aliases: CVE-2021-23594
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-01-12T22:56:13Z

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
Vulnerability: GHSA-627q-g293-49q7
Summary: Abort caused by allocating a vector that is too large in Tensorflow
Aliases: CVE-2022-23580
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2022-02-07T22:01:24Z

### Impact
During shape inference, TensorFlow can [allocate a large vector](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L788-L790) based on a value from a tensor controlled by the user:

```cc
  const auto num_dims = Value(shape_dim);
  std::vector<DimensionHandle> dims;
  dims.reserve(num_dims);
``` 
  
### Patches           
We have patched the issue in GitHub commit [1361fb7e29449629e1df94d44e0427ebec8c83c7](https://github.com/tensorflow/tensorflow/commit/1361fb7e29449629e1df94d44e0427ebec8c83c7).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-55mm-5399-7r63
Summary: Reliance on Cookies without validation in OctoberCMS
Aliases: CVE-2020-15128
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-565
Published: 2020-08-05T14:52:54Z

### Impact
Previously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. 

Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. 

### Patches
Issue has been patched in Build 468 (v1.0.468).

>**NOTE**: If you are using the cookie session driver, all of your session data will be invalidated. All other session drivers should smoothly upgrade to the changes (although the backend authentication persist cookie will also be invalidated requiring users to login again once their current session expires).

### Workarounds
Apply https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c to your installation manually if unable to upgrade to Build 468.

### References
- https://blog.laravel.com/laravel-cookie-security-releases
- https://github.com/laravel/framework/compare/4c7d118181d6c7f1f883643702df807ced016c5e...a731824421f9ebc586728ea9c7cff231a249aaa9

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Low given that it is not directly exploitable within the core but requires other security vulnerabilities within the application to have an effect and the severity of its effect depends entirely on the severity of those other holes in the application's defences.

### Acknowledgements

Thanks to [Takashi Terada of Mitsui Bussan Secure Directions, Inc.](https://www.linkedin.com/in/takeshi-terada-b570a6100/) for finding the original issue in Laravel and @taylorotwell for sharing the report with the October CMS team.
Vulnerability: GHSA-wqfh-9m4g-7x6x
Summary: Remote code execution in Apache ActiveMQ
Aliases: CVE-2020-11998
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2022-02-09T22:14:58Z

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack - A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code. Mitigation - Upgrade to Apache ActiveMQ 5.15.13
Vulnerability: GHSA-6x98-fx9j-7c78
Summary: Disabled users able to log in with third party SSO plugin
Aliases: CVE-2017-1000489
Severity: MODERATE
CVSS score: 8.1
CWE: CWE-287
Published: 2021-01-19T21:16:19Z

### Impact
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

### Patches
Upgrade to 2.12.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-cqhg-xjhh-p8hf
Summary: Out-of-bounds reads in Pillow
Aliases: CVE-2020-10177
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2020-07-27T21:52:43Z

Pillow before 6.2.3 and 7.x before 7.0.1 has multiple out-of-bounds reads in libImaging/FliDecode.c.
Vulnerability: GHSA-9w49-m7xh-5r39
Summary: Cross-site scripting in papermerge
Aliases: CVE-2020-29456
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-20T16:37:56Z

Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
Vulnerability: GHSA-wg8p-w946-c482
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0956
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability: GHSA-jrf8-cmgg-gv2m
Summary: Error on unsupported architectures in raw-cpuid
Aliases: CVE-2021-26307
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-657
Published: 2021-08-25T20:53:07Z

An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not support the CPUID instruction, which is unsound and causes a deterministic crash.