TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-9c84-4hx6-xmm4
Summary: Integer overflow in TFLite concatentation
Aliases: CVE-2021-29601
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-190
Published: 2021-05-21T14:28:08Z

### Impact
The TFLite implementation of concatenation is [vulnerable to an integer overflow issue](https://github.com/tensorflow/tensorflow/blob/7b7352a724b690b11bfaae2cd54bc3907daf6285/tensorflow/lite/kernels/concatenation.cc#L70-L76):

```cc
for (int d = 0; d < t0->dims->size; ++d) {
  if (d == axis) { 
    sum_axis += t->dims->data[axis]; 
  } else {
    TF_LITE_ENSURE_EQ(context, t->dims->data[d], t0->dims->data[d]);
  }
}
```

An attacker can craft a model such that the dimensions of one of the concatenation input overflow the values of `int`. TFLite uses `int` to represent tensor dimensions, whereas TF uses `int64`. Hence, valid TF models can trigger an integer overflow when converted to TFLite format.

### Patches
We have patched the issue in GitHub commit [4253f96a58486ffe84b61c0415bb234a4632ee73](https://github.com/tensorflow/tensorflow/commit/4253f96a58486ffe84b61c0415bb234a4632ee73).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-hpcx-3pw8-g3j2
Summary: Free of uninitialized memory in telemetry
Aliases: CVE-2021-29937
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2021-08-25T20:54:22Z

An issue was discovered in the telemetry crate through 0.1.2 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size().
Vulnerability: GHSA-qx2v-j445-g354
Summary: Improper Input Validation in Google TensorFlow
Aliases: CVE-2018-7577
Severity: HIGH
CVSS score: 8.1
CWE: CWE-20
Published: 2019-04-30T15:37:34Z

Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.
Vulnerability: GHSA-37m5-42qp-4qpr
Summary: Cross-site scripting in LocalStack
Aliases: CVE-2021-32091
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-18T18:38:09Z

A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack.
Vulnerability: GHSA-f38p-c2gq-4pmr
Summary: Regular Expression Denial-of-Service in npm schema-inspector
Aliases: CVE-2021-21267
Severity: LOW
CVSS score: 0
CWE: CWE-20, CWE-400
Published: 2021-03-19T20:14:21Z

### Impact
_What kind of vulnerability is it? Who is impacted?_
Email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS. The new regex expression is more limited in what it can check, so it is more flexible than the one used before. Therefore, this was a new major version instead of a new patch version to warn people upgrading that they should make sure the email validation still works for their use case. 

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
If a user chooses to not upgrade, the only known workaround would be to stop using the email validation feature in the library. The user could, for example, accept the email address into their system but save it in a "not yet validated" state in their system until a verification email is sent to it (to determine whether the email is valid and belongs to the form submitter). Note that this is the preferred way of validating email addresses anyways.

### References
_Are there any links users can visit to find out more?_
https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f

### For more information
If you have any questions or comments about this advisory, you can create an issue in this repository.
Vulnerability: GHSA-8mfc-v7wv-p62g
Summary: Path Traversal in Yarn
Aliases: CVE-2020-8131
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-02-09T22:43:37Z

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Vulnerability: GHSA-5r5w-h76p-m726
Summary: Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy
Aliases: CVE-2021-42583
Severity: HIGH
CVSS score: 0
CWE: CWE-327
Published: 2022-01-06T22:20:53Z

A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information.
Vulnerability: GHSA-53xj-v576-3ch2
Summary: OS Command Injection in giting
Aliases: CVE-2019-10802
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:22:09Z

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument &quot;repo&quot; of function &quot;pull()&quot; is executed by the package without any validation.
Vulnerability: GHSA-f34x-8pf6-qc9c
Summary: HTTP header injection in Sonatype Nexus Repository
Aliases: CVE-2021-40143
Severity: HIGH
CVSS score: 8.2
CWE: CWE-74
Published: 2021-09-08T17:42:18Z

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Vulnerability: GHSA-fcf9-3qw3-gxmj
Summary: High severity vulnerability that affects cryptography
Aliases: CVE-2018-10903
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-07-31T18:28:09Z

A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.
Vulnerability: GHSA-vf5m-q45w-8mh9
Summary: Malicious Package in js-qha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:00:25Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-xc6x-cq47-9chw
Summary: Vulnerability in Azure Active Directory Authentication Library
Aliases: CVE-2019-1258
Severity: HIGH
CVSS score: 8.8
Published: 2019-08-16T14:03:35Z

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens, aka 'Azure Active Directory Authentication Library Elevation of Privilege Vulnerability'.
Vulnerability: GHSA-mhhc-q96p-mfm9
Summary: Infinite loop in TFLite
Aliases: CVE-2021-37686
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2021-08-25T14:39:58Z

### Impact
The strided slice implementation in TFLite has a logic bug which can allow an attacker to trigger an infinite loop. This arises from newly introduced support for [ellipsis in axis definition](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/strided_slice.cc#L103-L122):

```cc
  for (int i = 0; i < effective_dims;) {
    if ((1 << i) & op_context->params->ellipsis_mask) {
      // ...
      int ellipsis_end_idx =
          std::min(i + 1 + num_add_axis + op_context->input_dims - begin_count,
                   effective_dims);
      // ...
      for (; i < ellipsis_end_idx; ++i) {
        // ...
      }
      continue;
    }
    // ...
    ++i;
  }
```

An attacker can craft a model such that `ellipsis_end_idx` is smaller than `i` (e.g., always negative). In this case, the inner loop does not increase `i` and the `continue` statement causes execution to skip over the preincrement at the end of the outer loop.

### Patches
We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695).

The fix will be included in TensorFlow 2.6.0. This is the only affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-78h7-fgq9-625x
Summary: Directory Traversal in quickserver
Aliases: CVE-2017-16196
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:40:14Z

Affected versions of `quickserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-g4w7-3qr8-5623
Summary: Improper type usage in rusqlite
Aliases: CVE-2020-35872
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-351
Published: 2021-08-25T20:47:01Z

An issue was discovered in the rusqlite crate before 0.23.0 for Rust. Memory safety can be violated via the repr(Rust) type.
Vulnerability: GHSA-p673-hjf2-pwfr
Summary: High severity vulnerability that affects command_wrap
Aliases: CVE-2013-1875
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
Vulnerability: GHSA-q5hq-fp76-qmrc
Summary: Uncontrolled Resource Consumption in Pillow
Aliases: CVE-2021-28677
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-08T18:49:36Z

An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.
Vulnerability: GHSA-5cqm-crxm-6qpv
Summary: Buffer overrun vulnerability in CGI
Aliases: CVE-2021-41816
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-190
Published: 2021-12-14T21:36:20Z

A security vulnerability that causes buffer overflow when you pass a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows. Please update the cgi gem to version 0.3.1, 0.2,1, and 0.1,1 or later. You can use gem update cgi to update it. If you are using bundler, please add gem "cgi", ">= 0.3.1" to your Gemfile.  Alternatively, please update Ruby to 2.7.5 or 3.0.3. This issue has been introduced since Ruby 2.7, so the cgi version bundled with Ruby 2.6 is not vulnerable.
Vulnerability: GHSA-gf93-h79q-6jjv
Summary: Incorrect implementation of the Streebog hash functions in streebog
Aliases: CVE-2019-25006
Severity: HIGH
CVSS score: 7.5
CWE: CWE-327
Published: 2021-08-25T20:45:41Z

An issue was discovered in the streebog crate before 0.8.0 for Rust. The Streebog hash function can produce the wrong answer.
Vulnerability: GHSA-5m69-3chg-6f8m
Summary: Cross Site Scripting (XSS) in Quokka
Aliases: CVE-2020-18702
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-30T16:23:26Z

Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.
Vulnerability: GHSA-cf6r-3wgc-h863
Summary: Polymorphic deserialization of malicious object in jackson-databind
Aliases: CVE-2019-14892
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2020-05-15T18:58:58Z

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Vulnerability: GHSA-7h26-63m7-qhf2
Summary: HTML comments vulnerability allowing to execute JavaScript code
Aliases: CVE-2021-41165
Severity: HIGH
CVSS score: 8.2
CWE: CWE-79
Published: 2021-11-17T21:58:25Z

### Affected packages
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.17.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank William Bowling ([wbowling](https://github.com/wbowling)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-rmxg-73gg-4p98
Summary: Cross-Site Scripting (XSS) in jquery
Aliases: CVE-2015-9251
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-01-22T13:32:06Z

Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option.


## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-wxhq-pm8v-cw75
Summary: Regular Expression Denial of Service in clean-css
Severity: LOW
CVSS score: 0
Published: 2019-06-05T20:50:16Z

Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 4.1.11 or higher.
Vulnerability: GHSA-5vp3-v4hc-gx76
Summary: UUPSUpgradeable vulnerability in @openzeppelin/contracts
Aliases: CVE-2021-41264
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-665
Published: 2021-09-15T20:23:17Z

### Impact

Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.

### Patches

A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

### References

[Post-mortem](https://forum.openzeppelin.com/t/uupsupgradeable-vulnerability-post-mortem/15680).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-v39h-qm32-8gwq
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware
Aliases: CVE-2020-7616
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-915
Published: 2021-12-09T19:57:29Z

express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.
Vulnerability: GHSA-v596-fwhq-8x48
Summary: High severity vulnerability that affects org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core
Aliases: CVE-2018-1199
Severity: HIGH
CVSS score: 0
Published: 2018-10-17T20:01:54Z

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
Vulnerability: GHSA-cf66-xwfp-gvc4
Summary: Missing Origin Validation in webpack-dev-server
Aliases: CVE-2018-14732
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-01-04T17:40:59Z

Versions of `webpack-dev-server` before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation
For `webpack-dev-server` update to version 3.1.11 or later.
Vulnerability: GHSA-7359-3c6r-hfc2
Summary: Improper Certificate Validation in oauth ruby gem
Aliases: CVE-2016-11086
Severity: HIGH
CVSS score: 7.4
CWE: CWE-295
Published: 2021-04-22T16:22:15Z

lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
Vulnerability: GHSA-37hp-765x-j95x
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2017-7233
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2019-01-04T17:50:26Z

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
Vulnerability: GHSA-mh8g-hprg-8363
Summary: Hard-Coded Key Used For Remember-me Token in Opencast
Aliases: CVE-2020-5222
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-798
Published: 2020-01-30T21:21:44Z

### Impact

The security configuration in `etc/security/mh_default_org.xml` enables a remember-me cookie based on a hash created from the [username, password, and an additional system key](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html). Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring that all systems use the same key:

```xml
<sec:remember-me key="opencast" user-service-ref="userDetailsService" />
```

This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. For example, a remember-me token obtained from develop.opencast.org can be used on stable.opencast.org without actually knowing the log-in credentials.

Such an attack will usually not work on different installations – assuming that safe, unique passwords are used – but it is basically guaranteed to work to get access to all machines of one cluster if a token from one machine is compromised.

### Patches

This problem is fixed in Opencast 7.6 and Opencast 8.1

### Workarounds

We strongly recommend updating to the patched version. Still, as a workaround for older versions, in `etc/security/mh_default_org.xml`, set a custom key for each server:

```xml
<sec:remember-me key="CUSTOM_RANDOM_KEY" user-service-ref="userDetailsService" />
```

### References

- [Relevant lines in the security configuration](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)
- [Spring Security Remember-Me Authentication Documentation](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html#remember-me-hash-token)

### For more information
If you have any questions or comments about this advisory:
- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at [security@opencast.org](mailto:security@opencast.org)

### Thanks
Thanks to @LukasKalbertodt for reporting the issue.
Vulnerability: GHSA-9fgx-q25h-jxrg
Summary: DOM XSS in Theme Preview
Aliases: CVE-2021-29484
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2021-04-29T21:53:18Z

### Impact
An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. 

Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. 

Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site - see patches & workarounds below.

### Patches
Fixed in 4.3.3, all 4.x sites should upgrade as soon as possible.
As the endpoint is unused, the patch simply removes it. 

### Workarounds
- Log out of Ghost Admin
- Suspend any users who cannot log out
- Block access to `/ghost/preview`

Example of how to block access in nginx:

```
location ~ /ghost/preview {
    rewrite ^(\/(.*\/)?ghost\/)(.*)$ $1 redirect;
}
```

This redirects the endpoint to `/ghost/`, which mimics the behaviour after the patch is applied.
Vulnerability: GHSA-4f7p-27jc-3c36
Summary: HTTP Request Smuggling in waitress
Aliases: CVE-2022-24761
Severity: HIGH
CVSS score: 7.5
CWE: CWE-444
Published: 2022-03-18T19:00:59Z

### Impact

When using Waitress behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends.

This would allow requests to be smuggled via the front-end proxy to waitress and later behavior.

There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory:

- The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits.
- Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters

### Patches

This has been fixed in Waitress 2.1.1

### Workarounds

When deploying a proxy in front of waitress, turning on any and all functionality to make sure that the request matches the RFC7230 standard. Certain proxy servers may not have this functionality though and users are encouraged to upgrade to the latest version of waitress instead.

### References

- https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the Github issue tracker](https://github.com/Pylons/waitress/issues) (if not security related/sensitive)
* Email us at [pylons-project-security@googlegroups.com](mailto:pylons-project-security@googlegroups.com) (If security related or sensitive)
Vulnerability: GHSA-5qfv-rr79-chx5
Summary: Cross-site Scripting in Ignite Realtime Openfire
Aliases: CVE-2019-15488
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-27T17:37:33Z

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
Vulnerability: GHSA-qhqf-ghgh-x2m4
Summary: High severity vulnerability that affects Microsoft.AspNetCore.Mvc
Aliases: CVE-2017-0249
Severity: HIGH
CVSS score: 7.3
CWE: CWE-20
Published: 2018-10-16T19:57:38Z

See https://nvd.nist.gov/vuln/detail/CVE-2017-0249 & https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0249
Vulnerability: GHSA-mwcv-m549-5cm8
Summary: Hijacked Environment Variables in node-tkinter
Aliases: CVE-2017-16062
Severity: HIGH
CVSS score: 7.5
CWE: CWE-506
Published: 2018-11-01T14:47:43Z

The `node-tkinter` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-758c-g2ff-9444
Summary: Out-of-bounds write
Aliases: CVE-2019-1140
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:49Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
Vulnerability: GHSA-3rh3-wfr4-76mj
Summary: Regular expression Denial of Service in multiple packages
Aliases: CVE-2021-21391
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2021-04-06T17:28:41Z


### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 27.0.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 5 team would like to thank Yeting Li for recognizing and reporting these vulnerabilities.
Vulnerability: GHSA-hgmg-hhc8-g5wr
Summary: Regular expression Denial of Service in Markdown plugin
Aliases: CVE-2021-21254
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2021-01-29T21:51:22Z

### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0. 

### Patches
The problem has been recognized and patched. The fix will be available in version 25.0.0.

### Workarounds
The user can work around the issue by:
- Upgrading CKEditor 5 to version 25.0.0.
- Disabling the Markdown plugin.

### More information
If you have any questions or comments about this advisory:
* Email us at [security@cksource.com](mailto:security@cksource.com)

### Acknowledgements
The CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and 
Alvaro Muñoz from GitHub for reporting it.
Vulnerability: GHSA-7px7-7xjx-hxm8
Summary: Moderate severity vulnerability that affects marked
Aliases: CVE-2017-1000427
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-01-04T21:04:19Z

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Vulnerability: GHSA-8p36-q63g-68qh
Summary: Autobinding vulnerability in MITREid Connect
Aliases: CVE-2021-27582
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-915
Published: 2021-05-13T22:31:22Z

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.
Vulnerability: GHSA-x4w5-r546-x9qh
Summary: Arbitrary File Read in html-pdf
Aliases: CVE-2019-15138
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-668, CWE-73, CWE-79
Published: 2019-10-11T18:40:38Z

All versions of `html-pdf` are vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input with an XHR request such as `request.open("GET","file:///etc/passwd")` will result in a PDF document with the contents of `/etc/passwd`.


## Recommendation

No fix is currently available. There is a mitigation available in the provided reference.
Vulnerability: GHSA-872g-2h8h-362q
Summary: High severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2016-4800
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-284
Published: 2018-10-19T16:16:16Z

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Vulnerability: GHSA-2p5p-m353-833w
Summary: Sort order SQL injection in Administrate
Aliases: CVE-2020-5257
Severity: HIGH
CVSS score: 7.7
CWE: CWE-943
Published: 2020-03-13T21:05:44Z

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard,
the direction parameter was not validated before being interpolated into the SQL query.
This could present a SQL injection if the attacker were able to modify the `direction` parameter and bypass ActiveRecord SQL protections.

Whilst this does have a high-impact, to exploit this you need access to the Administrate dashboards, which we would expect to be behind authentication.

This is patched in wersion 0.13.0.
Vulnerability: GHSA-65xx-c85x-wg76
Summary: Command Injection in plotter
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T17:20:52Z

All versions of `plotter` are vulnerable to Command Injection. The package fails to sanitize plot titles, which may allow attackers to execute arbitrary code in the system if the title value is supplied by a user. The following proof-of-concept creates a `testing` file in the current directory:

```
var plot = require('plotter').plot;

const title = 'Example "\nset title system("touch testing")#';

plot({
data: [ 3, 1, 2, 3, 4 ],
filename: 'output.pdf',
style: 'linespoints',
title: title,
logscale: true,
xlabel: 'time',
ylabel: 'length of string',
format: 'pdf'
});

```


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-5cgx-vhfp-6cf9
Summary: Directory traversal in Kubernetes Secrets Store CSI Driver
Aliases: CVE-2020-8568
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-24, CWE-20, CWE-22
Published: 2022-02-15T01:57:18Z

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that contain other Kubernetes Secrets.
Vulnerability: GHSA-9q64-mpxx-87fg
Summary: Open Redirect in ecstatic
Severity: HIGH
CVSS score: 0
CWE: CWE-601
Published: 2020-04-01T16:35:08Z

Versions of `ecstatic` prior to 4.1.2, 3.3.2 or 2.2.2 are vulnerable to Open Redirect. The package fails to validate redirects, allowing attackers to craft requests that result in an `HTTP 301` redirect to any other domains.


## Recommendation

If using `ecstatic` 4.x, upgrade to 4.1.2 or later.
If using `ecstatic` 3.x, upgrade to 3.3.2 or later.
If using `ecstatic` 2.x, upgrade to 2.2.2 or later.
Vulnerability: GHSA-333x-qr3v-g4xx
Summary: Command injection in spritesheet-js
Aliases: CVE-2020-7782
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2021-04-13T15:30:16Z

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.
Vulnerability: GHSA-f6p5-76fp-m248
Summary: URL Rewrite vulnerability in multiple zendframework components
Severity: HIGH
CVSS score: 0
Published: 2022-04-28T21:09:54Z

zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.

When these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.
Vulnerability: GHSA-w64c-pxjj-h866
Summary: Moderate severity vulnerability that affects ansible
Aliases: CVE-2015-3908
Severity: MODERATE
CVSS score: 0
CWE: CWE-345
Published: 2018-10-10T17:23:51Z

Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerability: GHSA-8xw8-mmqv-frqq
Summary: fake-static allows converting any reference into a `'static` reference
Severity: HIGH
CVSS score: 0
CWE: CWE-657
Published: 2021-08-25T20:55:33Z

fake-static allows converting a reference with any lifetime into
a reference with `'static` lifetime without the `unsafe` keyword.

Internally, this crate does not use unsafe code, it instead
exploits a soundness bug in rustc
Vulnerability: GHSA-r6hh-5g3q-wwgc
Summary: Stored Cross-site Scripting in grav
Aliases: CVE-2022-0970
Severity: HIGH
CVSS score: 7.1
CWE: CWE-79
Published: 2022-03-16T00:00:45Z

Grav prior to 1.7.31 is vulnerable to stored cross-site scripting.
Vulnerability: GHSA-vwxj-6m5m-rrvh
Summary: The REST Plugin in Apache Struts is using an outdated XStream library
Aliases: CVE-2017-9793
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-10-16T19:37:22Z

The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Vulnerability: GHSA-2f6g-w5gj-c93h
Summary: Prototype Pollution in iniparserjs
Aliases: CVE-2021-23328
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-1321
Published: 2021-04-13T15:20:09Z

This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Vulnerability: GHSA-mf7q-gw5f-q8jj
Summary: Cross-site Scripting in Apache Zeppelin
Aliases: CVE-2021-27578
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-09-07T22:55:56Z

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0.
Vulnerability: GHSA-c2cp-3xj9-97w9
Summary: Denial of service in Spring Security OAuth
Aliases: CVE-2022-22969
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2022-04-22T00:00:33Z

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.
Vulnerability: GHSA-2ghc-6v89-pw9j
Summary: Prototype Pollution in body-parser-xml 
Aliases: CVE-2021-3666
Severity: HIGH
CVSS score: 7.6
CWE: CWE-1321, CWE-915
Published: 2021-09-14T20:25:35Z

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-crmx-v835-hcp4
Summary: Moderate severity vulnerability that affects marked
Aliases: CVE-2017-17461
Severity: MODERATE
CVSS score: 0
Published: 2018-01-04T21:04:09Z

# Withdrawn

This advisory has been withdrawn, per NVD: ["This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue."](https://nvd.nist.gov/vuln/detail/CVE-2017-17461)

# Original Description

A Regular expression Denial of Service (ReDoS) vulnerability in the file marked.js of the marked npm package (tested on version 0.3.7) allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
Vulnerability: GHSA-qg7c-q3vq-rgxr
Summary: Leak of information via Store-API aggregations in shopware/platform and shopware/core
Severity: CRITICAL
CVSS score: 0
CWE: CWE-668
Published: 2021-04-13T15:13:26Z

### Impact

Leak of information via Store-API

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Vulnerability: GHSA-4rvg-955w-h68q
Summary: Path Traversal in angular-http-server
Aliases: CVE-2018-3713
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-26T14:47:40Z

Affected versions of `angular-http-server` are vulnerable to path traversal allowing a remote attacker to read files from the server that uses `angular-http-server`.

## Recommendation

Update to version 1.6.0 or later.

:exclamation: Note: This was originally thought to be fixed in version 1.4.3, though according to [this issue](https://github.com/ossf-cve-benchmark/ossf-cve-benchmark/issues/117#issuecomment-803872454) the vulnerability was not completely fixed until version 1.6.0.
Vulnerability: GHSA-35hc-x2cw-2j4v
Summary: Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Aliases: CVE-2018-0765
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-16T19:54:06Z

A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.
Vulnerability: GHSA-qfc5-mcwq-26q8
Summary: Double Free in psutil
Aliases: CVE-2019-18874
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2020-03-12T17:02:50Z

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.
Vulnerability: GHSA-gqvf-892r-vjm5
Summary: Improper Certificate Validation in Puppet
Aliases: CVE-2020-7942
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-295
Published: 2021-04-13T15:42:19Z

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.
Vulnerability: GHSA-g8ww-46x2-2p65
Summary: Denial of Service in Action Dispatch
Aliases: CVE-2021-22902
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-05T19:48:21Z

Impact
------
There is a possible Denial of Service vulnerability in Action Dispatch.
Carefully crafted Accept headers can cause the mime type parser in Action
Dispatch to do catastrophic backtracking in the regular expression engine.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
The following monkey patch placed in an initializer can be used to work around
the issue.

```ruby
module Mime
  class Type
    MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
  end
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 6-0-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.0 series
* 6-1-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.

Credits
-------

Thanks to Security Curious <security...@pm.me> for reporting this!
Vulnerability: GHSA-28f4-mjfq-qrvf
Summary: Malicious Package in buffes-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:18:40Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-926q-wxr6-3crq
Summary: Moderate severity vulnerability that affects roundup
Aliases: CVE-2019-10904
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-04-09T19:47:14Z

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
Vulnerability: GHSA-fm39-cw8h-3p63
Summary: Out-of-bounds Read in OpenCV
Aliases: CVE-2019-14491
Severity: HIGH
CVSS score: 8.2
CWE: CWE-125
Published: 2021-10-12T22:07:14Z

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Vulnerability: GHSA-qgpv-86r3-87fh
Summary: Cross-site Scripting in Parsedown
Aliases: CVE-2018-1000162
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-30T18:26:22Z

Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.
Vulnerability: GHSA-6rjc-4pwr-3vp7
Summary: Cross-Site Scripting in iobroker.web
Aliases: CVE-2019-10771
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-12-02T18:14:30Z

Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 2.4.10 or later.
Vulnerability: GHSA-hggm-jpg3-v476
Summary: RSA decryption vulnerable to Bleichenbacher timing vulnerability
Aliases: CVE-2020-25659
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-385
Published: 2020-10-27T20:33:13Z

### Impact

RSA decryption was vulnerable to Bleichenbacher timing vulnerabilities, which would impact people using RSA decryption in online scenarios.

### Patches

This is fixed in cryptography 3.2. https://github.com/pyca/cryptography/commit/58494b41d6ecb0f56b7c5f05d5f5e3ca0320d494 is the resolving commit.
Vulnerability: GHSA-vh7m-p724-62c2
Summary: Signature Malleabillity in elliptic
Aliases: CVE-2020-13822
Severity: HIGH
CVSS score: 7.7
CWE: CWE-190
Published: 2020-07-29T20:40:35Z

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Vulnerability: GHSA-m5pf-5894-jmx7
Summary: Malicious Package in sailclothjs
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:08:00Z

Version 1.2.6 of `sailclothjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-hwj3-m3p6-hj38
Summary: dom4j allows External Entities by default which might enable XXE attacks
Aliases: CVE-2020-10683
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2020-06-05T16:13:36Z

dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Note: This advisory applies to `dom4j:dom4j` version 1.x legacy artifacts.  To resolve this a change to the latest version of `org.dom4j:dom4j` is recommended.