TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-6mv9-qcx2-3hh3
Summary: Memory exhaustion in routinator
Aliases: CVE-2021-43174
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-11-11T00:55:08Z

NLnet Labs Routinator versions 0.9.0 up to and including 0.10.1, support the gzip transfer encoding when querying RRDP repositories. This encoding can be used by an RRDP repository to cause an out-of-memory crash in these versions of Routinator. RRDP uses XML which allows arbitrary amounts of white space in the encoded data. The gzip scheme compresses such white space extremely well, leading to very small compressed files that become huge when being decompressed for further processing, big enough that Routinator runs out of memory when parsing input data waiting for the next XML element.
Vulnerability: GHSA-r7rv-2rph-hvhj
Summary: Improper synchronization in buttplug
Aliases: CVE-2020-36218
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-662
Published: 2021-08-25T20:51:45Z

An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider (!Send|!Sync) objects, leading to a data race.
Vulnerability: GHSA-544x-2jx9-4pfg
Summary: Path traversal in Apache Karaf
Aliases: CVE-2022-22932
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2022-01-28T22:25:03Z

Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326
Vulnerability: GHSA-q47x-6mqq-4w92
Summary: Improper Input Validation
Aliases: CVE-2019-11228
Severity: HIGH
CVSS score: 5.3
CWE: CWE-20
Published: 2022-02-15T01:57:18Z

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.
Vulnerability: GHSA-m54r-vrmv-hw33
Summary: Improper Sanitizing of plugin names in helm
Aliases: CVE-2020-15186
Severity: LOW
CVSS score: 3.4
CWE: CWE-74, CWE-20
Published: 2021-05-24T16:57:12Z

### Impact

Security researchers at Trail of Bits discovered that plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`.

### Patches

This issue has been patched in Helm 3.3.2.

### Workarounds

Do not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.
Vulnerability: GHSA-g585-j55v-38h7
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0966
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T00:00:45Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability: GHSA-4ww3-3rxj-8v6q
Summary: High severity vulnerability that affects actionpack
Aliases: CVE-2011-0449
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:38Z

actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Vulnerability: GHSA-2r8p-fg3c-wcj4
Summary: Heap OOB and CHECK fail in `ResourceGather`
Aliases: CVE-2021-37654
Severity: HIGH
CVSS score: 7.3
CWE: CWE-125
Published: 2021-08-25T14:43:01Z

### Impact
An attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API in a release build:

```python
import tensorflow as tf

tensor = tf.constant(value=[[1,2],[3,4],[5,6]],shape=(3,2),dtype=tf.uint32)
v = tf.Variable(tensor)
tf.raw_ops.ResourceGather(
  resource=v.handle,
  indices=[0],
  dtype=tf.uint32,
  batch_dims=10,
  validate_indices=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L660-L668) does not check that the `batch_dims` value that the user supplies is less than the rank of the input tensor.

Since the implementation uses several for loops over the dimensions of `tensor`, this results in reading data from outside the bounds of heap allocated buffer backing the tensor:

```cc
    // batch_dims_ = > params.dims() (10 > 2)
    for (int i = 0; i < batch_dims_; ++i) {
      result_shape.AddDim(params.dim_size(i));
    }
    for (int i = batch_dims_; i < indices.dims(); ++i) {
      result_shape.AddDim(indices.dim_size(i));
    }
    for (int i = batch_dims_ + 1; i < params.dims(); ++i) {
      result_shape.AddDim(params.dim_size(i));
    }
```

In debug mode, `.dim_size(i)` validates that the argument is less than `.dims()` using a `DCHECK`. But the `DCHECK` is a no-op in release builds.

### Patches
We have patched the issue in GitHub commit [bc9c546ce7015c57c2f15c168b3d9201de679a1d](https://github.com/tensorflow/tensorflow/commit/bc9c546ce7015c57c2f15c168b3d9201de679a1d).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-3fr8-mwpp-8h9p
Summary: Cross-site scripting in TileServer GL
Aliases: CVE-2020-15500
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-17T21:01:15Z

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.
Vulnerability: GHSA-38m9-3vg4-rwvp
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0678
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2022-02-20T00:00:32Z

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-2mhh-w6q8-5hxw
Summary: Remote Memory Disclosure in ws
Aliases: CVE-2016-10518
Severity: LOW
CVSS score: 0
CWE: CWE-201
Published: 2019-02-18T23:56:42Z

Versions of `ws` prior to 1.0.1 are affected by a remote memory disclosure vulnerability.

In certain rare circumstances, applications which allow users to control the arguments of a `client.ping()` call will cause `ws` to send the contents of an allocated but non-zero-filled buffer to the server. This may disclose sensitive information that still exists in memory after previous use of the memory for other tasks.



## Proof of Concept
```
var ws = require('ws')

var server = new ws.Server({ port: 9000 })
var client = new ws('ws://localhost:9000')

client.on('open', function () {
  console.log('open')
  client.ping(50) // this sends a non-zeroed buffer of 50 bytes

  client.on('pong', function (data) {
    console.log('got pong')
    console.log(data) // Data from the client. 
  })
})
```


## Recommendation

Update to version 1.0.1 or greater.
Vulnerability: GHSA-3jqw-crqj-w8qw
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2011-4137
Severity: MODERATE
CVSS score: 0
Published: 2018-07-23T19:51:35Z

The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
Vulnerability: GHSA-fx3v-553x-3c4q
Summary: Stored XSS by authenticated backend user with access to upload files
Aliases: CVE-2020-15249
Severity: LOW
CVSS score: 2.8
CWE: CWE-79
Published: 2020-11-23T19:47:59Z

### Impact
Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they would have to convince their target to visit that location directly in the target's browser as the backend does not display SVGs inline anywhere, SVGs are only displayed as image resources in the backend and are thus unable to be executed.

### Patches
Issue has been patched in Build 469 (v1.0.469) & v1.1.0.

### Workarounds
Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469 or v1.1.0.

### References
Reported by [Hoan Hoang](https://github.com/hoanhp)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1107" alt="Screen Shot 2020-10-10 at 1 47 49 PM" src="https://user-images.githubusercontent.com/7253840/95663787-378f2b80-0aff-11eb-8dfc-b97d162939da.png">
Vulnerability: GHSA-7qqr-3pj3-q2f5
Summary: XSS issues in the management interface
Aliases: CVE-2019-13236
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-12T22:58:21Z

In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
Vulnerability: GHSA-68jc-v27h-vhmw
Summary: Unrestricted Upload of File with Dangerous Type in Drupal core.
Aliases: CVE-2020-13671
Severity: HIGH
CVSS score: 8.8
CWE: CWE-434
Published: 2021-10-12T16:28:25Z

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
Vulnerability: GHSA-xmc8-cjfr-phx3
Summary: Regular Expression Denial of Service in highcharts
Aliases: CVE-2018-20801
Severity: HIGH
CVSS score: 7.5
CWE: CWE-185
Published: 2019-03-18T15:59:32Z

Versions of `highcharts` prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 6.1.0 or higher.
Vulnerability: GHSA-v938-qcc9-rwv8
Summary: Use of Uninitialized Resource in buffoon.
Aliases: CVE-2020-36512
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:17:09Z

An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.
Vulnerability: GHSA-q8j6-pwqx-pm96
Summary: Insecure template handling in Squirrelly
Aliases: CVE-2021-32819
Severity: HIGH
CVSS score: 8
CWE: CWE-200
Published: 2021-05-17T20:58:02Z

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023.
Vulnerability: GHSA-6q8q-rvf4-m4pg
Summary: Downloads Resources over HTTP in dalek-browser-chrome
Aliases: CVE-2016-10604
Severity: HIGH
CVSS score: 8.1
CWE: CWE-311
Published: 2019-02-18T23:50:14Z

Affected versions of `dalek-browser-chrome` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-chrome`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available - the author of `dalek` recommends [`TestCafé`](http://devexpress.github.io/testcafe/). 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-c442-3278-rhrg
Summary: Unrestricted File Upload in ShowDoc v2.9.5
Aliases: CVE-2021-36440
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2021-09-09T17:08:46Z

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.
Vulnerability: GHSA-3w76-x94r-pw44
Summary: Downloads Resources over HTTP in rs-brightcove
Aliases: CVE-2016-10676
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:16Z

Affected versions of `rs-brightcove` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `rs-brightcove`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-9jg9-6wm2-x7p5
Summary: Server-Side Request Forgery in Karaf
Aliases: CVE-2020-11980
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-918
Published: 2022-02-10T23:04:32Z

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role can call get*. It's possible to authenticate as a viewer role + invokes on the MLet getMBeansFromURL method, which goes off to a remote server to fetch the desired MBean, which is then registered in Karaf. At this point the attack fails as "viewer" doesn't have the permission to invoke on the MBean. Still, it could act as a SSRF style attack and also it essentially allows a "viewer" role to pollute the MBean registry, which is a kind of privilege escalation. The vulnerability is low as it's possible to add a ACL to limit access. Users should update to Apache Karaf 4.2.9 or newer.
Vulnerability: GHSA-5xp3-jfq3-5q8x
Summary: Improper Input Validation in pip
Aliases: CVE-2021-3572
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-20
Published: 2021-11-15T17:45:01Z

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
Vulnerability: GHSA-m342-ff57-4jcc
Summary: Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`
Aliases: CVE-2021-41210
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-11-10T19:01:44Z

### Impact
The [shape inference functions for `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/ops/count_ops.cc#L43-L50) can trigger a read outside of bounds of heap allocated array:

```python
import tensorflow as tf

@tf.function
def func():
  return tf.raw_ops.SparseCountSparseOutput(
    indices=[1],
    values=[[1]],
    dense_shape=[10],
    weights=[],
    binary_output= True)

func()
```

The function fails to check that the first input (i.e., `indices`) has rank 2:

```cc
  auto rank = c->Dim(c->input(0), 1);
```

### Patches
We have patched the issue in GitHub commit [701cfaca222a82afbeeb17496bd718baa65a67d2](https://github.com/tensorflow/tensorflow/commit/701cfaca222a82afbeeb17496bd718baa65a67d2).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-rwh9-8xx8-4wfm
Summary: Cross-site Scripting in OpenCRX
Aliases: CVE-2021-25959
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-09-30T20:50:21Z

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Vulnerability: GHSA-5h5r-ffc4-c455
Summary: strong_password Ruby gem malicious version causing Remote Code Execution vulnerability
Aliases: CVE-2019-13354
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2019-07-08T20:32:35Z

The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 0.0.6.
Vulnerability: GHSA-68gr-cmcp-g3mj
Summary: Directory Traversal in lactate
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-06-14T16:39:31Z

A crafted `GET` request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on the filesystem that the process has access to read.

Mitigating factors:
Only files that the user running `lactate` has permission to read will be accessible via this vulnerability.


[Proof of concept](https://hackerone.com/reports/296645):
Please globally install the `lactate` package and `cd` to a directory you wish to serve assets from. Next, run `lactate -p 8081` to start serving files from this location.

The following cURL request can be used to demonstrate this vulnerability by requesting the target `/etc/passwd` file:

```
curl "http://127.0.0.1:8081/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
```
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
[...]
```


## Recommendation

As there is currently no fix for this issue selecting an alternative static web server would be the best choice.
Vulnerability: GHSA-q93h-jc49-78gg
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-9547
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-05-15T18:59:10Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
Vulnerability: GHSA-pwrf-q7h8-jjr7
Summary: Authorization Bypass Through User-Controlled Key in Bagisto
Aliases: CVE-2019-16403
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-639
Published: 2019-11-08T20:06:24Z

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.
Vulnerability: GHSA-r37h-j483-cjjm
Summary: Improper rate limiting in Koel
Aliases: CVE-2021-33563
Severity: HIGH
CVSS score: 0
CWE: CWE-799, CWE-916
Published: 2021-06-01T21:38:20Z

Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
Vulnerability: GHSA-w4pv-w56c-mg4v
Summary: Path Traversal in stattic
Aliases: CVE-2018-3734
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-18T21:20:15Z

Versions of `stattic` before 0.3.0 are vulnerable to path traversal allowing a remote attacker to read arbitrary files with any extension from the server that users `stattic`.


## Recommendation

Update to version 0.3.0 or later.
Vulnerability: GHSA-8h46-5m9h-7553
Summary: Heap out of bounds write in `RaggedBinCount`
Aliases: CVE-2021-29514
Severity: LOW
CVSS score: 2.5
CWE: CWE-787
Published: 2021-05-21T14:20:51Z

### Impact
If the `splits` argument of `RaggedBincount` does not specify a valid [`SparseTensor`](https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow:

```python
import tensorflow as tf
tf.raw_ops.RaggedBincount(splits=[7,8], values= [5, 16, 51, 76, 29, 27, 54, 95],\
                          size= 59, weights= [0, 0, 0, 0, 0, 0, 0, 0],\
                          binary_output=False)
```

This will cause a read from outside the bounds of the `splits` tensor buffer in the [implementation of the `RaggedBincount` op](https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L446):
    
```cc 
    for (int idx = 0; idx < num_values; ++idx) {
      while (idx >= splits(batch_idx)) {
        batch_idx++;
      }
      ...
      if (bin < size) {
        if (binary_output_) {
          out(batch_idx - 1, bin) = T(1);
        } else {
          T value = (weights_size > 0) ? weights(idx) : T(1);
          out(batch_idx - 1, bin) += value;
        }
      } 
    }
```

Before the `for` loop, `batch_idx` is set to 0. The attacker sets `splits(0)` to be 7, hence the `while` loop does not execute and `batch_idx` remains 0. This then results in writing to `out(-1, bin)`, which is before the heap allocated buffer for the output tensor.

### Patches
We have patched the issue in GitHub commit [eebb96c2830d48597d055d247c0e9aebaea94cd5](https://github.com/tensorflow/tensorflow/commit/eebb96c2830d48597d055d247c0e9aebaea94cd5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 and TensorFlow 2.3.3, as these are also affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-w6rp-4vj7-v2m8
Summary: Missing Authorization in DayByDay CRM
Aliases: CVE-2022-22111
Severity: HIGH
CVSS score: 8.8
CWE: CWE-862
Published: 2022-01-08T00:31:49Z

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
Vulnerability: GHSA-jc84-3g44-wf2q
Summary: Denial of Service in ecstatic
Aliases: CVE-2019-10775
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2020-12-15T16:52:17Z

ecstatic have a denial of service vulnerability. Successful exploitation could lead to crash of an application.
Vulnerability: GHSA-2cf2-2383-h4jv
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen
Aliases: CVE-2020-7600
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-915
Published: 2021-05-07T16:16:43Z

querymen prior to 2.1.4 allows modification of object properties. The parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. This could be abused for Prototype Pollution attacks.
Vulnerability: GHSA-xfhp-gmh8-r8v2
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-23354
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-19T21:22:10Z

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.
Vulnerability: GHSA-rqxg-xvcq-3v2f
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2017-12605
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-10-12T22:02:04Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread.
Vulnerability: GHSA-8j6j-4h2c-c65p
Summary: Arbitrary Code Execution in require-node
Severity: CRITICAL
CVSS score: 0
CWE: CWE-78
Published: 2020-09-03T17:02:52Z

Versions of `require-node` prior to 1.3.4 for 1.x and 2.0.4 for 2.x are vulnerable to Arbitrary Code Execution. The package fails to sanitize requests to the `require-node` endpoint, allowing attackers to execute arbitrary code in the server through the injection of OS commands in the request body.


## Recommendation

- If you are using 1.x, upgrade to version 1.3.4 or later.
- If you are using 2.x, upgrade to version 2.0.4 or later.
Vulnerability: GHSA-w6jr-wj64-mc9x
Summary: Deserialization of Untrusted Data in Codeigniter4
Aliases: CVE-2022-21647
Severity: HIGH
CVSS score: 7.7
CWE: CWE-502
Published: 2022-01-06T22:52:41Z

### Impact
Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4.
Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, 
and possibly execute existing PHP code on the server.
We are aware of a working exploit, which can lead to SQL injection.

### Patches
Upgrade to v4.1.6 or later.

### Workarounds
Do not use:
- `old()` and form_helper
- `RedirectResponse::withInput()` and `redirect()->withInput()`

### References
- [PHP Object Injection | OWASP](https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-q4xf-3pmq-3hw8
Summary: Improper Restriction of XML External Entity Reference in Apache NiFi
Aliases: CVE-2020-13940
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-611
Published: 2022-01-06T20:41:00Z

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).
Vulnerability: GHSA-7vrq-vg6p-32fw
Summary: Downloads Resources over HTTP in libxl
Aliases: CVE-2016-10585
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:34:48Z

Affected versions of `libxl` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libxl`.


## Recommendation

The module author recommends installing the bindings using a pinned and verified version of SDK instead of the automated download. More information is available in the modules [README](https://www.npmjs.com/package/libxl).
Vulnerability: GHSA-x9r5-jxvq-4387
Summary: Self XSS on user input in jquery.terminal
Aliases: CVE-2021-43862
Severity: LOW
CVSS score: 3.7
CWE: CWE-80
Published: 2022-01-06T22:48:56Z

### Impact
This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees.

Also if the application use execHash option and execute code from URL the attacker can use this URL to execute his code. The scope is limited because the javascript code inside html attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible.

### Patches
Fixed version 2.31.1

### Workarounds
The user can use formatting that wrap whole user input and it's no op.

```javascript
$.terminal.new_formatter([/([\s\S]+)/g, '[[;;]$1]']);
```
The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way).

### References
The issue was reported here [jcubic/jquery.terminal#727](https://github.com/jcubic/jquery.terminal/issues/727)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jcubic/jquery.terminal](https://github.com/jcubic/jquery.terminal)
* Email us at [jcubic@onet.pl](mailto:jcubic@onet.pl)
Vulnerability: GHSA-v2jq-9475-r5g8
Summary: Cross-Site Scripting in bootstrap-tagsinput
Aliases: CVE-2016-1000227
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:29:51Z

All versions of `bootstrap-tagsinput` are vulnerable to cross-site scripting when user input is passed into the `itemTitle` parameter unmodified, as the package fails to properly sanitize or encode user input for that parameter.



## Recommendation

This package is not actively maintained, and has not seen an update since 2015. 

Because of this, the simplest mitigation is to avoid using the `itemTitle` parameter. With over 200 open issues and over 100 open pull requests as of 2/2018, it seems unlikely that the author has any intention of maintaining the module. If avoiding the use of `itemTitle` indefinitely is acceptable, this is a workable solution. If not, the best available mitigation is to use a fork of the module that is actively maintained and provides similar functionality. There are [many such forks to choose from available on github.](https://github.com/bootstrap-tagsinput/bootstrap-tagsinput/network/members).
Vulnerability: GHSA-rv49-54qp-fw42
Summary: Path Traversal in servey
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2019-06-06T15:30:20Z

Versions of `servey` prior to 3.x are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to the latest version
Vulnerability: GHSA-wf98-vxv9-jqfv
Summary: XSS Injection Vulnerability
Severity: LOW
CVSS score: 0
Published: 2022-04-05T18:31:51Z

### Impact

Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.

### Patches

This has been patched in Craft 3.7.29.

### References

* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18

### For more information

If you have any questions or comments about this advisory, email us at [support@craftcms.com](mailto:support@craftcms.com)

----------

Credits: https://github.com/noobpk
Vulnerability: GHSA-8qxj-f9rh-9fg2
Summary: Improper Verification of Cryptographic Signature in Pure-Python ECDSA
Aliases: CVE-2019-14859
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-347
Published: 2020-04-01T16:35:26Z

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions.
Vulnerability: GHSA-6vmq-jh76-hq43
Summary: Uninitialized memory access in outer_cgi
Aliases: CVE-2021-30454
Severity: CRITICAL
CVSS score: 0
CWE: CWE-119
Published: 2021-08-25T20:55:25Z

An issue was discovered in the outer_cgi crate before 0.2.1 for Rust. A user-provided Read instance receives an uninitialized memory buffer from KeyValueReader.
Vulnerability: GHSA-wgx2-6432-j3fw
Summary: Unsoundness in bigint
Aliases: CVE-2020-35880
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-704
Published: 2021-08-25T20:48:04Z

An issue was discovered in the bigint crate through 2020-05-07 for Rust. It allows a soundness violation.
Vulnerability: GHSA-4627-w373-375v
Summary: Malicious Package in grunt-radical
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:22:24Z

Version 0.0.14 of `grunt-radical` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-9824-rp6m-xx9w
Summary: Out-of-bounds write
Aliases: CVE-2019-0989
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:04Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
Vulnerability: GHSA-h822-r4r5-v8jg
Summary: Polymorphic Typing issue in FasterXML jackson-databind
Aliases: CVE-2019-14540
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-09-23T18:33:25Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
Vulnerability: GHSA-xq52-rv6w-397c
Summary: Directive injection when using dynamic overrides with user input
Aliases: CVE-2020-5217
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-95
Published: 2020-01-23T02:28:11Z

### Impact

If user-supplied input was passed into `append/override_content_security_policy_directives`, a semicolon could be injected leading to directive injection.

This could be used to e.g. override a `script-src` directive. Duplicate directives are ignored and the first one wins. The directives in `secure_headers` are sorted alphabetically so they pretty much all come before `script-src`. A previously undefined directive would receive a value even if `SecureHeaders::OPT_OUT` was supplied.

The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning when this happens. This will result in innocuous browser console messages if being exploited/accidentally used. In future releases, we will raise application errors resulting in 500s.

> Duplicate script-src directives detected.  All but the first instance will be ignored.

See https://www.w3.org/TR/CSP3/#parse-serialized-policy

> Note: In this case, the user agent SHOULD notify developers that a duplicate directive was ignored. A console warning might be appropriate, for example.

### Patches

Depending on what major version you are using, the fixed versions are 6.2.0, 5.1.0, 3.8.0.

### Workarounds

If you are passing user input into the above methods, you could filter out the input:

```ruby
override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
```

### References

Reported in https://github.com/twitter/secure_headers/issues/418
https://www.w3.org/TR/CSP3/#parse-serialized-policy

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [this repo](https://github.com/twitter/secure_headers/issues/new)
* DM @ndm on twitter
Vulnerability: GHSA-4g29-fccr-p59w
Summary: Reflected Cross-site Scripting in Shopware storefront
Aliases: CVE-2022-24873
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-28T20:59:24Z

### Impact
Not-stored XSS in storefront.
Request parameter were directly assigned to the template, so that malicious code could be send via an URL.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Vulnerability: GHSA-24fg-p96v-hxh8
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-0447
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2017-10-24T18:33:38Z

Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
Vulnerability: GHSA-r2gr-fhmr-66c5
Summary: "Arbitrary code execution in socket.io-file"
Aliases: CVE-2020-24807
Severity: HIGH
CVSS score: 7.8
CWE: CWE-20
Published: 2021-05-10T18:38:11Z

"The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
Vulnerability: GHSA-25fx-mxc2-76g7
Summary: Unauthorized access to Credit card form exposing payer name and not requiring 3DS
Aliases: CVE-2021-41120
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-10-06T17:49:11Z

### Impact
URL to the payment page done after checkout was created with autoincremented payment id (`/pay-with-paypal/{id}`) and therefore it was easy to access for anyone, not even the order's customer. The problem was, the Credit card form has prefilled "credit card holder" field with the Customer's first and last name.
Additionally, the mentioned form did not require a 3D Secure authentication, as well as did not checked the result of the 3D Secure authentication.

### Patches
The problem has been patched in Sylius/PayPalPlugin **1.2.4** and **1.3.1**

### Workarounds
One can override a `sylius_paypal_plugin_pay_with_paypal_form` route and change its URL parameters to (for example) `{orderToken}/{paymentId}`, then override the `Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction` service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method.
Additionally, one could override the `@SyliusPayPalPlugin/payWithPaypal.html.twig` template, to add `contingencies: ['SCA_ALWAYS']` line in `hostedFields.submit(...)` function call (line 421). It would then have to be handled in the function callback.

### For more information
If you have any questions or comments about this advisory:
- Open an issue in Sylius/PayPalPlugin issues
- Email us at security at sylius dot com
Vulnerability: GHSA-2vp8-jv5v-6qh6
Summary: Allocation of resources without limits or throttling in keycloak-model-infinispan
Aliases: CVE-2021-3637
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2021-07-13T17:43:23Z

A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.
Vulnerability: GHSA-v3rr-cph9-2g2q
Summary: Moderate severity vulnerability that affects rack-ssl
Aliases: CVE-2014-2538
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.
Vulnerability: GHSA-m874-69ww-w7jq
Summary: Directory Traversal in whispercast
Aliases: CVE-2017-16174
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:45:01Z

Affected versions of `whispercast` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-qw93-45r3-p66p
Summary: Prototype Pollution in merge-options
Aliases: CVE-2018-3752
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2018-10-09T00:19:57Z

All versions of `merge-options` are vulnerable to Prototype Pollution


## Recommendation

Update to version 1.0.1 or greater.
Vulnerability: GHSA-q58g-455p-8vw9
Summary: In RubyGem excon, interrupted Persistent Connections May Leak Response Data
Aliases: CVE-2019-16779
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-362, CWE-664
Published: 2019-12-16T19:30:17Z

### Impact
There was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

### Patches
The problem has been patched in 0.71.0, users should upgrade to this or a newer version (if one exists).

### Workarounds
Users can workaround the problem by disabling persistent connections, though this may cause performance implications.

### References
See the [patch](https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29) for further details.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [excon/issues](https://github.com/excon/excon/issues)
* Email us at [geemus+github@gmail.com](mailto:geemus+github@gmail.com)
Vulnerability: GHSA-gxpj-cx7g-858c
Summary: Regular Expression Denial of Service in debug
Aliases: CVE-2017-16137
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2018-08-09T20:18:07Z

Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. 

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.


## Recommendation

Version 2.x.x: Update to version 2.6.9 or later.
Version 3.x.x: Update to version 3.1.0 or later.
Vulnerability: GHSA-fr52-4hqw-p27f
Summary: Nokogiri does not forbid namespace nodes in XPointer ranges
Aliases: CVE-2016-4658
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2018-08-21T19:03:26Z

xpointer.c in libxml2 before 2.9.5 (as used in nokogiri before 1.7.1 amongst other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
Vulnerability: GHSA-j47f-4232-hvv8
Summary: Heap out of bounds read in `RaggedCross`
Aliases: CVE-2021-29532
Severity: LOW
CVSS score: 2.5
CWE: CWE-125
Published: 2021-05-21T14:22:17Z

### Impact
An attacker can force accesses outside the bounds of heap allocated arrays by passing in invalid tensor values to `tf.raw_ops.RaggedCross`:

```python
import tensorflow as tf

ragged_values = []
ragged_row_splits = [] 
sparse_indices = []
sparse_values = []
sparse_shape = []

dense_inputs_elem = tf.constant([], shape=[92, 0], dtype=tf.int64)
dense_inputs = [dense_inputs_elem]

input_order = "R"
hashed_output = False
num_buckets = 0
hash_key = 0 

tf.raw_ops.RaggedCross(ragged_values=ragged_values,
    ragged_row_splits=ragged_row_splits,
    sparse_indices=sparse_indices,
    sparse_values=sparse_values,
    sparse_shape=sparse_shape,
    dense_inputs=dense_inputs,
    input_order=input_order,
    hashed_output=hashed_output,
    num_buckets=num_buckets,
    hash_key=hash_key,
    out_values_type=tf.int64,
    out_row_splits_type=tf.int64)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/efea03b38fb8d3b81762237dc85e579cc5fc6e87/tensorflow/core/kernels/ragged_cross_op.cc#L456-L487) lacks validation for the user supplied arguments:

```cc
int next_ragged = 0;
int next_sparse = 0;
int next_dense = 0;
for (char c : input_order_) {
  if (c == 'R') {
    TF_RETURN_IF_ERROR(BuildRaggedFeatureReader(
        ragged_values_list[next_ragged], ragged_splits_list[next_ragged],
        features));
    next_ragged++;
  } else if (c == 'S') {
    TF_RETURN_IF_ERROR(BuildSparseFeatureReader(
        sparse_indices_list[next_sparse], sparse_values_list[next_sparse],
        batch_size, features));
    next_sparse++;
  } else if (c == 'D') {
    TF_RETURN_IF_ERROR(
        BuildDenseFeatureReader(dense_list[next_dense++], features));
  }
  ...
}
```

Each of the above branches call a helper function after accessing array elements via a `*_list[next_*]` pattern, followed by incrementing the `next_*` index. However, as there is no validation that the `next_*` values are in the valid range for the corresponding `*_list` arrays, this results in heap OOB reads.

### Patches
We have patched the issue in GitHub commit [44b7f486c0143f68b56c34e2d01e146ee445134a](https://github.com/tensorflow/tensorflow/commit/44b7f486c0143f68b56c34e2d01e146ee445134a).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-5v44-7647-xfw9
Summary: Blind SQL injection in PrestaShop productcomments module
Aliases: CVE-2020-26248
Severity: LOW
CVSS score: 8.2
CWE: CWE-89
Published: 2021-01-20T21:33:53Z

### Impact
An attacker can use a Blind SQL injection to retrieve data or stop the MySQL service.

### Patches
The problem is fixed in 4.2.1
Vulnerability: GHSA-x7fx-mcc9-27j7
Summary: Inappropriate implementation in V8 in CefSharp
Aliases: CVE-2020-16013
Severity: HIGH
CVSS score: 0
CWE: CWE-119, CWE-787
Published: 2020-11-27T20:12:55Z

High CVE-2020-16013: Inappropriate implementation in V8. 

- https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16013

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as `High` severity.