TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7wfc-x4f7-gg2x
Summary: Code injection in Apache Dubbo
Aliases: CVE-2021-30180
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-444
Published: 2022-03-18T17:58:01Z

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Vulnerability: GHSA-whq6-mj2r-mjqc
Summary: OS Command Injection in lsof
Aliases: CVE-2019-10783
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:17:53Z

All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
Vulnerability: GHSA-g9hh-vvx3-v37v
Summary: Denial of service in HtmlUnit-Neko
Aliases: CVE-2022-28366
Severity: HIGH
CVSS score: 7.5
Published: 2022-04-23T00:03:04Z

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.
Vulnerability: GHSA-4m8h-h59m-m34j
Summary: Prototype Pollution in bmoor
Aliases: CVE-2021-23558
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2022-02-01T00:50:09Z

The package bmoor before 0.10.1 is vulnerable to Prototype Pollution due to missing sanitization in set function. **Note:** This vulnerability derives from an incomplete fix in [CVE-2020-7736](https://security.snyk.io/vuln/SNYK-JS-BMOOR-598664)
Vulnerability: GHSA-5xc6-fpc7-4qvg
Summary: High severity vulnerability that affects CoAPthon
Aliases: CVE-2018-12680
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2019-04-08T15:19:01Z

The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect CoAP server and client) when they receive crafted CoAP messages.
Vulnerability: GHSA-9829-jj5p-j6hf
Summary: Prototype Pollution in worksmith
Aliases: CVE-2020-7725
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:26:30Z

All versions up to and including 1.0.0 of the package worksmith are vulnerable to Prototype Pollution via the setValue function.
Vulnerability: GHSA-428f-mh7w-6w2x
Summary: Infecting Module in pandora-doomsday
Aliases: CVE-2017-16127
Severity: MODERATE
CVSS score: 0
CWE: CWE-509
Published: 2020-09-01T18:56:40Z

The `pandora-doomsday` package is a malicious package that adds itself to the package.json of other packages discovered on the victim host and attempts to publish the package. 

It has been removed from the npm registry.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4q98-wr72-h35w
Summary: Improper input validation in Apache Santuario XML Security for Java
Aliases: CVE-2019-12400
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2019-08-27T17:41:33Z

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
Vulnerability: GHSA-wmx6-vxcf-c3gr
Summary: Validation Bypass in slp-validate
Aliases: CVE-2019-16761
Severity: CRITICAL
CVSS score: 5.7
CWE: CWE-20
Published: 2019-11-15T23:10:19Z

Versions of `slp-validate` prior to 1.0.1 are vulnerable to a validation bypass. Bitcoin scripts may cause the validation result from `slp-validate` to differ from the specified SLP consensus. This allows an attacker to create a Bitcoin script that causes a hard-fork from the SLP consensus.


## Recommendation

Upgrade to version 1.0.1 or later.
Vulnerability: GHSA-ghww-cv4v-hmxx
Summary: Cross-Site Request Forgery microweber
Aliases: CVE-2022-0638
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2022-02-18T00:00:34Z

microweber prior to version 1.2.11 is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-6cj2-92m5-7mvp
Summary: Improperly Controlled Modification of Object Prototype Attributes
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2021-08-03T16:48:46Z

### Impact

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

### Patches

`think-config@1.1.3` patched it, anyone used `think-config` should upgrade to `>=1.1.3` version.

### References

https://cwe.mitre.org/data/definitions/1321.html

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [thinkjs/thinkjs](https://github.com/thinkjs/thinkjs)
* Email us at [i@imnerd.org](mailto:i@imnerd.org)
Vulnerability: GHSA-h4hv-m4h4-mhwg
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2017-7234
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2019-01-04T17:50:17Z

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the ``django.views.static.serve()`` view could redirect to any other domain, aka an open redirect vulnerability.
Vulnerability: GHSA-58pp-9c76-5625
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11112
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2020-06-10T21:12:41Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
Vulnerability: GHSA-fvxv-9xxr-h7wj
Summary: Moderate severity vulnerability that affects pyspark
Aliases: CVE-2018-11760
Severity: MODERATE
CVSS score: 5.5
Published: 2019-02-07T18:02:21Z

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Vulnerability: GHSA-7fhm-mqm4-2wp7
Summary: Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution)
Severity: MODERATE
CVSS score: 0
Published: 2020-03-13T20:36:16Z

**Withdrawn**
GitHub has withdrawn this advisory in place of GHSA-vh95-rmgr-6w4m and GHSA-6chw-6frg-f759.
The reason for withdrawing is that some mistakes were made during the ingestion of CVE-2020-7598
which caused this advisory to be published with incorrect information.

In order to provide accurate advisory information, new advisories were created:

- minimist: https://github.com/advisories/GHSA-vh95-rmgr-6w4m
- acorn: https://github.com/advisories/GHSA-6chw-6frg-f759
Vulnerability: GHSA-79wf-qcqv-r22r
Summary: Remote code execution in better-macro
Aliases: CVE-2021-38196
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94, CWE-78
Published: 2021-08-25T20:56:00Z

An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose.
Vulnerability: GHSA-9pr3-7449-977r
Summary: Cross-Site Scripting in express-cart
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T18:21:26Z

All versions of `harp` are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-77jf-fjjf-xcww
Summary: Invalid Curve Attack in openpgp
Aliases: CVE-2019-9155
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-327
Published: 2019-08-23T21:42:22Z

Versions of `openpgp` prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package's implementation of ECDH fails to verify the validity of the communication partner's public key. The package calculates the resulting key secret based on an altered curve instead of the specified elliptic curve. Attackers may exfiltrate the victim's private key by choosing the altered curve. An attack requires the attacker being able to initiate message decryption and record the result. Furthermore the victim's key must offer an ECDH public key.


## Recommendation

Upgrade to version 4.3.0 or later.
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Vulnerability: GHSA-f3rf-v9qm-9c89
Summary: Cross-site Scripting in the femanager TYPO3 extension
Aliases: CVE-2021-36787
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-09-01T18:36:51Z

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.

Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
Vulnerability: GHSA-v8v8-6859-qxm4
Summary: Arbitrary shell command execution in logkitty
Aliases: CVE-2020-8149
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2020-06-05T14:47:02Z

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before version 0.7.1.
Vulnerability: GHSA-26hm-r6mg-963c
Summary: SQL Injection in JeecgBoot
Aliases: CVE-2021-46089
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-01-26T00:01:25Z

In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. A patch has been released on the repository's `master` branch.
Vulnerability: GHSA-jjhg-qw5v-r8xx
Summary: Malicious Package in anarchy
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:01:20Z

All versions of `anarchy` contain malicious code. The package ran `rm - rf /` as an install script.


## Recommendation

Remove the package from your environment.
Vulnerability: GHSA-74cr-77xc-8g6r
Summary: Prototype Pollution in @apollo/gateway
Severity: HIGH
CVSS score: 7.3
CWE: CWE-400, CWE-1321
Published: 2019-06-13T20:37:39Z

Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability: GHSA-9c8w-jrw3-q2c3
Summary: Cross-site Scripting in OWASP AntiSamy
Aliases: CVE-2021-35043
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-02T16:58:43Z

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.
Vulnerability: GHSA-h2fj-77wh-fh5w
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0612
Severity: MODERATE
CVSS score: 6.7
CWE: CWE-79
Published: 2022-02-17T00:00:36Z

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Vulnerability: GHSA-5q75-cxcq-wr26
Summary: Low severity vulnerability that affects org.apache.jspwiki:jspwiki-war
Aliases: CVE-2018-20242
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-02-12T17:26:07Z

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
Vulnerability: GHSA-h4m4-pgp4-whgm
Summary: The reset password form reveal users email address
Aliases: CVE-2021-32731
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-668
Published: 2021-07-02T19:19:04Z

### Impact
The reset password form reveals the email address of users just by giving their username.

### Patches
The problem has been patched on XWiki 13.2RC1.

### Workarounds
It's possible to manually modify the `resetpasswordinline.vm` to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2

### References
https://jira.xwiki.org/browse/XWIKI-18400

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xiwki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-4rcq-jv2f-898j
Summary: Incorrect Provision of Specified Functionality in qutebrowser
Aliases: CVE-2020-11054
Severity: LOW
CVSS score: 3.5
CWE: CWE-684
Published: 2020-05-08T19:05:05Z

# Description

After a certificate error was overridden by the user, qutebrowser displays the URL as yellow (`colors.statusbar.url.warn.fg`). However, when the affected website was subsequently loaded again, the URL was mistakenly displayed as green (`colors.statusbar.url.success_https`). While the user already has seen a certificate error prompt at this point (or set `content.ssl_strict` to `false` which is not recommended), this could still provide a false sense of security.

# Affected versions and patches

All versions of qutebrowser are believed to be affected, though versions before v0.11.x couldn't be tested.

The issue is fixed in qutebrowser v1.11.1 (pending release) and v1.12.0 (unreleased). Backported patches for older versions are available, but no further releases are planned.

# Mitigation

If you are unable to upgrade:

- Treat any host with a certificate exception as insecure, ignoring the URL color
- Or set `content.ssl_strict` to `True` (instead of `'ask'`), preventing certificate exceptions

# References

- qutebrowser issue: https://github.com/qutebrowser/qutebrowser/issues/5403
- Fix (master branch): https://github.com/qutebrowser/qutebrowser/commit/021ab572a319ca3db5907a33a59774f502b3b975
- Related issue for KDE Falkon: https://bugs.kde.org/show_bug.cgi?id=420902
- Related issue for eric6 Web Browser: https://tracker.die-offenbachs.homelinux.org/eric/issue328 (fixed in eric6 20.6)
Vulnerability: GHSA-vf23-f26f-mjj9
Summary: Moderate severity vulnerability that affects yourls/yourls
Aliases: CVE-2019-14537
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-843
Published: 2019-09-23T18:32:02Z

## Type juggling vulnerability in the API

### Impact
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass.

### Patches
https://github.com/YOURLS/YOURLS/releases/tag/1.7.4
https://github.com/YOURLS/YOURLS/pull/2542

### References
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537
* https://github.com/Wocanilo/CVE-2019-14537

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [YOURLS repository](https://github.com/YOURLS/YOURLS)
Vulnerability: GHSA-4pww-fqgh-36hj
Summary: Unrestricted Upload of File with Dangerous Type in Croogo
Aliases: CVE-2021-44673
Severity: HIGH
CVSS score: 8.8
CWE: CWE-434
Published: 2022-03-11T00:02:02Z

A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2 via admin/file-manager/attachments, which lets a malicious user upload a web shell script.
Vulnerability: GHSA-wpfc-3w63-g4hm
Summary: Malicious Package in axois
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:09:48Z

All versions of `axois` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-xr7r-88qv-q7hm
Summary: Out of bounds write in serde_cbor
Aliases: CVE-2019-25001
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-08-25T20:45:51Z

An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.
Vulnerability: GHSA-3pqx-4fqf-j49f
Summary: Deserialization of Untrusted Data in PyYAML
Aliases: CVE-2019-20477
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2021-04-20T16:40:42Z

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
Vulnerability: GHSA-c5gj-w4hx-gvmx
Summary: Business Logic Errors in microweber
Aliases: CVE-2022-0688
Severity: LOW
CVSS score: 2.7
Published: 2022-02-21T00:00:21Z

Microweber prior to 1.2.11 can suffer from insecure direct object reference(s). A malicious actor can remove items from a victim's cart.
Vulnerability: GHSA-3qr6-qrqm-8v86
Summary: Integer Overflow or Wraparound in Microweber
Aliases: CVE-2022-1036
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2022-03-23T00:00:23Z

In Microweber prior to 1.2.12, a user can create an account with a password thousands of characters in length, leading to memory corruption/integer overflow. Version 1.2.2 sets maximum password length at 500 characters.
Vulnerability: GHSA-g5mm-vmx4-3rg7
Summary: Improper handling of case sensitivity in Spring Framework
Aliases: CVE-2022-22968
Severity: LOW
CVSS score: 0
CWE: CWE-178
Published: 2022-04-15T00:00:32Z

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. Versions 5.3.19 and 5.2.21 contain a patch for this issue.
Vulnerability: GHSA-wqq8-mqj9-697f
Summary: PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
Severity: HIGH
CVSS score: 0
Published: 2020-01-08T03:10:30Z

### Impact

We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).

### Patches

In the [security patch](https://github.com/PrestaShop/autoupgrade/releases/tag/v4.10.1), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com
Vulnerability: GHSA-gf7h-vg5v-cch6
Summary: Directory Traversal in ritp
Aliases: CVE-2017-16198
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2018-08-06T20:03:21Z

Affected versions of `ritp` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-337x-4q8g-prc5
Summary: Low severity vulnerability that affects django
Aliases: CVE-2019-3498
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2019-01-14T16:20:05Z

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Vulnerability: GHSA-3vjm-36rr-7qrq
Summary: NULL Pointer Dereference in cbox
Aliases: CVE-2020-35860
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-476
Published: 2021-08-25T20:47:16Z

An issue was discovered in the cbox crate through 2020-03-19 for Rust. The CBox API allows dereferencing raw pointers without a requirement for unsafe code.
Vulnerability: GHSA-qhh5-9738-g9mx
Summary: Incorrect Default Permissions in Apache DolphinScheduler
Aliases: CVE-2020-13922
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-276
Published: 2022-02-09T22:26:32Z

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
Vulnerability: GHSA-x2mc-8fgj-3wmr
Summary: Improper Input Validation in tar-fs
Aliases: CVE-2018-20835
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-05-01T18:37:18Z

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
Vulnerability: GHSA-gwrp-pvrq-jmwv
Summary: Path Traversal and Improper Input Validation in Apache Commons IO
Aliases: CVE-2021-29425
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20, CWE-22
Published: 2021-04-26T16:04:00Z

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Vulnerability: GHSA-w46j-8hm6-h8mm
Summary: XSS in apexcharts
Aliases: CVE-2021-23327
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-02-11T20:47:34Z

The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
Vulnerability: GHSA-mp9m-g7qj-6vqr
Summary: Unauthorized privilege escalation in Mod module
Severity: MODERATE
CVSS score: 0
CWE: CWE-285
Published: 2020-10-27T20:30:48Z

### Impact
An unauthorized privilege escalation exploit has been discovered in the Mod module: this exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it's possible to perform destructive actions within the guild the user has high privileges in.

### Patches
This exploit has been fixed on version & ``3.4.1``.

### Workarounds
Unloading the Mod module with ``unload mod`` __or__, disabling the ``massban`` command with ``command disable global massban`` can render this exploit not accessible. We still highly recommend updating to ``3.4.1`` to completely patch this issue.

### References
* https://github.com/Cog-Creators/Red-DiscordBot/commit/726bfd38adfdfaef760412a68e01447b470f438b

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)
* Over on our [Discord server](https://discord.gg/red)
Vulnerability: GHSA-x2fr-v8wf-8wwv
Summary: High severity vulnerability that affects ruby-saml
Aliases: CVE-2017-11428
Severity: HIGH
CVSS score: 7.7
CWE: CWE-287
Published: 2019-07-05T21:11:35Z

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Vulnerability: GHSA-7774-7vr3-cc8j
Summary: Authorization Policy Bypass Due to Case Insensitive Host Comparison
Aliases: CVE-2021-39155
Severity: HIGH
CVSS score: 8.3
CWE: CWE-178
Published: 2021-08-30T16:15:56Z

### Impact
According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive.  The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy could be bypassed.
 
As an example, the user may have an authorization policy that rejects request with hostname "httpbin.foo" for some source IPs, but the attacker can bypass this by sending the request with hostname "Httpbin.Foo".

### Patches
* Istio 1.11.1 and above
* Istio 1.10.4 and above
* Istio 1.9.8 and above

### Workarounds
A Lua filter may be written to normalize Host header before the authorization check.  This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008).

### For more information
If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com
Vulnerability: GHSA-4q96-6xhq-ff43
Summary: malicious SVG attachment causing stored XSS vulnerability
Aliases: CVE-2020-15275
Severity: LOW
CVSS score: 8.7
CWE: CWE-79
Published: 2020-11-11T15:54:41Z

### Impact
An attacker with `write` permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki.

### Patches
Users are strongly advised to upgrade to a patched version.

MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

### Workarounds
It is not advised to work around this, but to upgrade MoinMoin to a patched version.

That said, a work around via a Content Security Policy in the web server might be possible.

Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.

### For more information
If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).

### Credits

This vulnerability was discovered by:

Catarina Leite from the Checkmarx SCA AppSec team
Vulnerability: GHSA-9c2j-593q-3g82
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2013-1856
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
Vulnerability: GHSA-hjcp-j389-59ff
Summary: Regular Expression Denial of Service in marked
Aliases: CVE-2015-8854
Severity: HIGH
CVSS score: 7.5
Published: 2017-10-24T18:33:36Z

Versions 0.3.3 and earlier of `marked` are affected by a regular expression denial of service ( ReDoS ) vulnerability when passed inputs that reach the `em` inline rule.



## Recommendation

Update to version 0.3.4 or later.
Vulnerability: GHSA-38fc-wpqx-33j7
Summary: Uncontrolled Resource Consumption in trim-off-newlines
Aliases: CVE-2021-23425
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-09-02T17:15:42Z

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
Vulnerability: GHSA-ghpq-vjxw-ch5w
Summary: Use after free in libpulse-binding
Severity: HIGH
CVSS score: 0
CWE: CWE-416
Published: 2021-08-25T20:56:52Z

### Overview

Version 1.2.1 of the `libpulse-binding` Rust crate, released on the 15th of June 2018, fixed a pair of use-after-free issues with the objects returned by the `get_format_info` and `get_context` methods of `Stream` objects. These objects were mistakenly being constructed without setting an important flag to prevent destruction of the underlying C objects they reference upon their own destruction.

This advisory is being written retrospectively, having previously only been noted in the changelog. No CVE assignment was sought.

### Patches

Users are required to update to version 1.2.1 or newer.

Versions older than 1.2.1 have been yanked from crates.io. This was believed to have already been done at the time of the 1.2.1 release, but upon double checking now they were found to still be available, so has been done now (22nd October 2020).
Vulnerability: GHSA-28w5-j8xj-2xwc
Summary: Cross-site Scripting in the yoast_seo TYPO3 extension
Aliases: CVE-2021-36788
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-09-01T18:36:44Z

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
Vulnerability: GHSA-f2vv-h5x4-57gr
Summary: Leak of information via Store-API
Severity: CRITICAL
CVSS score: 0
CWE: CWE-202
Published: 2021-02-10T02:32:21Z

### Impact
Leak of information via Store-API

### Patches
We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information.

https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
Vulnerability: GHSA-jqwc-jm56-wcwj
Summary: Cross-site scripting in Jupyter Notebook
Aliases: CVE-2018-21030
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-79
Published: 2019-11-08T17:07:42Z

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
Vulnerability: GHSA-rwr3-c2q8-gm56
Summary: Moderate severity vulnerability that affects Pillow
Aliases: CVE-2016-9189
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-190
Published: 2018-07-24T20:08:27Z

Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component.
Vulnerability: GHSA-wrvc-72w7-xpmj
Summary: Incorrect Comparison in sodiumoxide
Aliases: CVE-2019-25002
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-697
Published: 2021-08-25T20:45:54Z

An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties.
Vulnerability: GHSA-jr37-66pj-36v7
Summary: Cross-site Scripting in DayByDay CRM
Aliases: CVE-2022-22109
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-08T00:32:00Z

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
Vulnerability: GHSA-gqgv-6jq5-jjj9
Summary: Prototype Pollution Protection Bypass in qs
Aliases: CVE-2017-1000048
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2020-04-30T17:16:47Z

Affected version of `qs` are vulnerable to Prototype Pollution because it is possible to bypass the protection. The `qs.parse` function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing `[` or `]` may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances.


## Recommendation

Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.
Vulnerability: GHSA-4jm3-pfpf-h54p
Summary: espeak-ruby allows arbitrary command execution
Aliases: CVE-2016-10193
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-284
Published: 2017-10-24T18:33:35Z

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
Vulnerability: GHSA-7wgh-5q4q-6wx5
Summary: Malicious Package in 1337qq-js
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2020-09-04T17:30:39Z

All versions of `1337qq-js` contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes:
- Environment variables
- Running processes
- /etc/hosts
- uname -a
- npmrc file


## Recommendation

Remove the package from your system and rotate any compromised credentials.
Vulnerability: GHSA-66ww-999q-mffq
Summary: Arbitrary code execution in post-loader
Aliases: CVE-2022-0748
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2022-03-18T00:01:11Z

post-loader is webpack loader for blog posts written in Markdown. The package post-loader from 0.0.0 is vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed. At this time, there is no known workaround or patch available.
Vulnerability: GHSA-5chj-xprr-7qqx
Summary: Cross-site Scripting in GwtUpload
Aliases: CVE-2020-9447
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-22T16:15:33Z

The file-upload feature in GwtUpload 1.0.3 allows XSS via a crafted filename.
Vulnerability: GHSA-fc38-mxwr-pfhx
Summary: Cross-Site Scripting via SVG media files
Aliases: CVE-2021-37710
Severity: HIGH
CVSS score: 8
CWE: CWE-79
Published: 2021-08-23T19:43:00Z

### Impact
Cross-Site Scripting via SVG media files

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-hf55-c445-2w97
Summary: Cross-site Scripting in @rocket.chat/livechat
Aliases: CVE-2022-21830
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-03T00:01:00Z

A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
Vulnerability: GHSA-pf46-gqg9-j3v3
Summary: Insufficient Entropy in DotNetNuke
Aliases: CVE-2018-15812
Severity: HIGH
CVSS score: 7.5
CWE: CWE-331
Published: 2019-07-05T21:08:24Z

DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
Vulnerability: GHSA-v39p-96qg-c8rf
Summary: Prototype Pollution in object-path
Aliases: CVE-2021-23434
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-843, CWE-1321
Published: 2021-09-01T18:37:11Z

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.
Vulnerability: GHSA-gg6m-fhqv-hg56
Summary: Denial of Service in yar
Aliases: CVE-2014-4179
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-09-01T15:15:36Z

Versions of `yar` prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value.

When an invalid encryped session cookie value is provided, the process will crash.


## Recommendation

Update to version 2.2.0 or later.
Vulnerability: GHSA-r89v-cgv7-3jhx
Summary: Bypass of fix for CVE-2020-15247, Twig sandbox escape
Aliases: CVE-2020-26231
Severity: LOW
CVSS score: 5.2
CWE: CWE-862
Published: 2020-11-23T20:54:18Z

### Impact
A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247:

An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 470 (v1.0.470) and v1.1.1.

### Workarounds
Apply https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 to your installation manually if unable to upgrade to Build 470 or v1.1.1.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">
Vulnerability: GHSA-jm5c-rv3w-w83m
Summary: Denial of service in geth
Aliases: CVE-2020-26242
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400, CWE-191, CWE-125
Published: 2021-06-29T21:13:20Z

### Impact
Denial-of-service (crash) during block processing

### Details

Affected versions suffer from a vulnerability which can be exploited through the `MULMOD` operation, by specifying a modulo of `0`: `mulmod(a,b,0)`, causing a `panic` in the underlying library. 
The crash was in the `uint256` library, where a buffer [underflowed](https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L442).

	if `d == 0`, `dLen` remains `0`

and https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L451 will try to access index `[-1]`.

The `uint256` library was first merged in this [commit](https://github.com/ethereum/go-ethereum/commit/cf6674539c589f80031f3371a71c6a80addbe454), on 2020-06-08. 
Exploiting this vulnerabilty would cause all vulnerable nodes to drop off the network. 

The issue was brought to our attention through a [bug report](https://github.com/ethereum/go-ethereum/issues/21367), showing a `panic` occurring on sync from genesis on the Ropsten network.
 
It was estimated that the least obvious way to fix this would be to merge the fix into `uint256`, make a new release of that library and then update the geth-dependency.

- https://github.com/holiman/uint256/releases/tag/v1.1.1 was made the same day, 
- PR to address the issue: https://github.com/holiman/uint256/pull/80 
- PR to update geth deps: https://github.com/ethereum/go-ethereum/pull/21368 


### Patches
Upgrade to v1.9.18 or higher

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-8h8v-6qqm-fwpq
Summary: Path Traversal in express-cart
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T21:06:38Z

Versions of `express-cart` before 1.1.7 are vulnerable to Path Traversal.


## Recommendation

Update to version 1.1.7 or later.
Vulnerability: GHSA-jp46-fw6c-3pm9
Summary: Directory Traversal in scott-blanch-weather-app
Aliases: CVE-2017-16184
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:46:58Z

Affected versions of `scott-blanch-weather-app` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-76wf-2xcf-6wmx
Summary: Malicious Package in ngx-pica
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T00:31:28Z

Version 1.1.5 of `ngx-pica` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-rvcw-f68w-8h8h
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime
Aliases: CVE-2021-29446
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-208, CWE-696, CWE-203
Published: 2021-04-19T15:00:05Z

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-9rf5-jm6f-2fmm
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2014-3514
Severity: HIGH
CVSS score: 0
Published: 2017-10-24T18:33:36Z

activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Vulnerability: GHSA-qv2v-m59f-v5fw
Summary: Insecure randomness in socket.io
Aliases: CVE-2017-16031
Severity: HIGH
CVSS score: 7.5
CWE: CWE-330
Published: 2018-11-07T00:29:37Z

Affected versions of `socket.io` depend on `Math.random()` to create socket IDs, and therefore the IDs are predictable. With enough information on prior IDs, an attacker may be able to guess the socket ID and gain access to socket.io servers without authorization.


## Recommendation

Update to v0.9.7 or later.
Vulnerability: GHSA-pr49-5hhf-6mm6
Summary: Directory Traversal in serverabc
Aliases: CVE-2017-16180
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:44:34Z

Affected versions of `serverabc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-9mr8-6prp-gwjv
Summary: SQL Injection in query-mysql
Aliases: CVE-2018-3754
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2018-09-10T15:20:30Z

All versions of `query-mysql` are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is passed into this module.
Vulnerability: GHSA-34jx-wx69-9x8v
Summary: Symlink Attack in kubectl cp
Aliases: CVE-2019-1002101
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-59
Published: 2022-02-15T01:57:18Z

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.