TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4x37-5rh2-hp8c
Summary: Hijacked Environment Variables in node-opencv
Aliases: CVE-2017-16067
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:50:59Z

The `node-opencv` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-g2qx-6ghw-67hm
Summary: Denial of Service in Gitea
Aliases: CVE-2020-13246
Severity: HIGH
CVSS score: 7.5
CWE: CWE-667
Published: 2022-02-15T00:33:30Z

An issue was discovered in Gitea in which an attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.
Vulnerability: GHSA-29gr-w57f-rpfw
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-7818
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.
Vulnerability: GHSA-5c66-v29h-xjh8
Summary: XSS Cross Site Scripting
Aliases: CVE-2021-29459
Severity: CRITICAL
CVSS score: 9.6
CWE: CWE-79
Published: 2021-04-22T16:11:55Z

### Impact
It is possible to persistently inject scripts in XWiki.

For unregistred users:
- By filling simple text fields

For registered users:
- By filling their personal information
- (if they have edit rights) By filling the values of static lists using App Within Minutes

That can lead to user's session hijacking, and if used in conjunction with a social engineering attack it can also lead to disclosure of sensitive data, CSRF attacks and other security vulnerabilities.
That can also lead to the attacker taking over an account.
If the victim has administrative rights it might even lead to code execution on the server, depending on the application and the privileges of the account.
### Patches
It has been patched on XWiki 12.8 and 12.6.3.

### Workarounds
There is no easy workaround except upgrading XWiki.

### References
https://jira.xwiki.org/browse/XWIKI-17374

### For more information
If you have any questions or comments about this advisory:
  * Open an issue in [Jira XWiki](https://jira.xwiki.org)
  * Email us at our [security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-wc7v-77jr-5c3m
Summary: bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3944
Severity: LOW
CVSS score: 3.1
CWE: CWE-352
Published: 2021-12-03T20:38:37Z

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-j7j5-752x-wr4v
Summary: Downloads Resources over HTTP in xd-testing
Aliases: CVE-2016-10653
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:45:21Z

Affected versions of `xd-testing` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `xd-testing`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-4vhj-98r6-424h
Summary: In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate
Aliases: CVE-2016-1000338
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2018-10-17T16:23:26Z

In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Vulnerability: GHSA-cx7r-634m-2q2h
Summary: Cross-Site Scripting in harp
Severity: MODERATE
CVSS score: 0
Published: 2020-09-02T18:20:21Z

# Withdrawn

This advisory has been withdrawn per request from the maintainer.  Given harp is a static webserver, a XSS type of vulnerability is not appropriate.

### Original advisory description

All versions of `harp` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `harp` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-vwxp-9qmf-w299
Summary: Cross-site Scripting in LiveHelperChat
Aliases: CVE-2022-0394
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-01T00:49:48Z

LiveHelperChat (remdex/livehelperchat in Packagist) has a stored Cross-site Scripting (XSS) vulnerability prior to version 3.93.
Vulnerability: GHSA-grpf-gg7v-5g5h
Summary: SQL Injection in Apache SkyWalking
Aliases: CVE-2020-13921
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2021-05-07T15:53:31Z

Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
Vulnerability: GHSA-rf3h-xgv5-2q39
Summary: Division by zero in TFLite's implementation of `DepthwiseConv`
Aliases: CVE-2021-29602
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:28:12Z

### Impact
The implementation of the `DepthwiseConv` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/1a8e885b864c818198a5b2c0cbbeca5a1e833bc8/tensorflow/lite/kernels/depthwise_conv.cc#L287-L288):

```cc
int num_input_channels = SizeOfDimension(input, 3);
TF_LITE_ENSURE_EQ(context, num_filter_channels % num_input_channels, 0);
```

An attacker can craft a model such that `input`'s fourth dimension would be 0.

### Patches
We have patched the issue in GitHub commit [cbda3c6b2dbbd3fbdc482ff8c0170a78ec2e97d0](https://github.com/tensorflow/tensorflow/commit/cbda3c6b2dbbd3fbdc482ff8c0170a78ec2e97d0).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-rfq3-w54c-f9q5
Summary: OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
Aliases: CVE-2020-15233
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20, CWE-601
Published: 2021-05-24T17:00:12Z

### Impact

[fosite#400](https://github.com/ory/fosite/pull/400) (released as v0.30.2) introduced a new feature for handling redirect URLs pointing to loopback interfaces ([rfc8252#section-7.3](https://tools.ietf.org/html/rfc8252#section-7.3)). As part of that change new behavior was introduced which failed to respect the redirect URL's (only for loopback interfaces!) query parameters

1. Registering a client with allowed redirect URL `http://127.0.0.1/callback`
2. Performing OAuth2 flow and requesting redirect URL `http://127.0.0.1/callback?bar=foo`
3. Instead of an error, the browser is redirected to `http://127.0.0.1/callback?bar=foo` with a potentially successful OAuth2 response.

as well as the host parameter (as long as the host is a loopback interface):

1. Registering a client with allowed redirect URL `https://example.com/callback`
2. Performing OAuth2 flow and requesting redirect URL `http://127.0.0.1/callback`
3. Instead of an error, the browser is redirected to `http://127.0.0.1/callback` with a potentially successful OAuth2 response.

These bugs are only applicable in scenarios where the attacker has control over the loopback interface (`localhost`, `127.0.0.1`, `[::1]`) where the browser performing the OAuth2 flow is running.
Vulnerability: GHSA-rfjc-xrmf-5vvw
Summary: Privilege escalation by backend users assigned to the default "Publisher" system role
Aliases: CVE-2020-15248
Severity: LOW
CVSS score: 4
CWE: CWE-863, CWE-269
Published: 2020-11-23T19:47:27Z

### Impact
Backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. 

### Patches
Issue has been patched in Build 470 (v1.0.470) & v1.1.1.

### Workarounds
Apply https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829 to your installation manually if unable to upgrade to Build 470 or v1.1.1.

### References
Reported by [Hoan Hoang](https://github.com/hoanhp)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1098" alt="Screen Shot 2020-10-10 at 1 37 25 PM" src="https://user-images.githubusercontent.com/7253840/95663611-e6326c80-0afd-11eb-8a1e-8b767a7202fb.png">
Vulnerability: GHSA-f246-xrrj-g8j6
Summary: Cross-site Scripting in markdown-it-highlightjs
Aliases: CVE-2020-7773
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T20:19:47Z

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);
Vulnerability: GHSA-x9p2-fxq6-2m5f
Summary: Reverse Tabnapping in swagger-ui
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-1022
Published: 2019-06-20T14:33:07Z

Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is commonly used for phishing attacks.


## Recommendation

Upgrade to version 3.18.0 or later.
Vulnerability: GHSA-rqjq-mrgx-85hp
Summary: Allocation of Resources Without Limits or Throttling in Hashicorp Consul
Aliases: CVE-2020-13250
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2021-05-18T18:21:35Z

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.
Vulnerability: GHSA-xwqr-xmgg-j69q
Summary: Integer overflow in solana_rbpf
Aliases: CVE-2021-46102
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2022-01-28T22:59:28Z

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.st_value + refd_pa) as u64";
Vulnerability: GHSA-xp5q-77mh-6hm2
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3728
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2021-08-25T14:50:17Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-jrfj-98qg-qjgv
Summary: Denial of service in sidekiq
Aliases: CVE-2022-23837
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-770
Published: 2022-01-27T14:42:37Z

In api.rb in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
Vulnerability: GHSA-3wwj-wh2w-g4xp
Summary: CRLF Injection in microweber
Aliases: CVE-2022-0666
Severity: HIGH
CVSS score: 7.6
CWE: CWE-93
Published: 2022-02-19T00:01:35Z

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-4952-p58q-6crx
Summary: JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
Aliases: CVE-2021-32797
Severity: HIGH
CVSS score: 7.4
CWE: CWE-87, CWE-79, CWE-75
Published: 2021-08-23T19:40:22Z

### Impact

Untrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.

### Patches

Patched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21.

### References

[OWASP Page on Restricting Form Submissions](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.

Credit: Guillaume Jeanne from Google
Vulnerability: GHSA-934x-72xh-5hrg
Summary: OS command injection in aws-lambda
Aliases: CVE-2019-10777
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-02-14T23:09:45Z

In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".
Vulnerability: GHSA-4p92-fv6v-fhfj
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0723
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-27T00:00:15Z

Microweber prior to 1.2.11 is vulnerable to reflected cross-site scripting.
Vulnerability: GHSA-m7jv-hq7h-mq7c
Summary: Infinite Loop in Apache Tomcat
Aliases: CVE-2020-13935
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2022-02-08T22:05:17Z

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Vulnerability: GHSA-hjgm-f7vx-m5g7
Summary: Deserialization of Untrusted Data in Apache Heron
Aliases: CVE-2020-1964
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2022-01-06T19:44:49Z

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
Vulnerability: GHSA-jcpv-g9rr-qxrc
Summary: Regular Expression Denial of Service in hawk
Aliases: CVE-2016-2515
Severity: HIGH
CVSS score: 7.5
Published: 2018-07-31T22:52:00Z

Versions of `hawk` prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long headers and URI's.



## Recommendation

Update to hawk version 4.1.1 or later.
Vulnerability: GHSA-x825-rjww-2245
Summary: Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user
Aliases: CVE-2017-9799
Severity: HIGH
CVSS score: 8.8
Published: 2018-10-17T18:30:01Z

It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
Vulnerability: GHSA-ch68-7cf4-35vr
Summary: Limited ability to spoof SAML authentication with missing audience verification in Fleet
Aliases: CVE-2022-23600
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-287, CWE-284
Published: 2022-02-07T21:57:38Z

### Impact

This impacts deployments using SAML SSO in two specific cases:

1. A malicious or compromised Service Provider (SP) could reuse the SAML response to log into Fleet as a user -- only if the user has an account with the same email in Fleet, _and_ the user signs into the malicious SP via SAML SSO from the same Identity Provider (IdP) configured with Fleet.
2. A user with an account in Fleet could reuse a SAML response intended for another SP to log into Fleet. This is only a concern if the user is blocked from Fleet in the IdP, but continues to have an account in Fleet. If the user is blocked from the IdP entirely, this cannot be exploited.

### Patches
Fleet 4.9.1 resolves this issue.

### Workarounds and good practices
* Reduce the length of sessions on your IdP to reduce the window for malicious re-use.
* Limit the amount of SAML Service Providers/Applications used by user accounts with access to Fleet.
* When removing access to Fleet in the IdP, delete the Fleet user from Fleet as well.

### For more information
If you have any questions or comments about this advisory:
* Join us in the #fleet channel of [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw).
* Email us at [security@fleetdm.com](mailto:security@fleetdm.com).
Vulnerability: GHSA-p6vg-p826-qp3v
Summary: URL Redirection to Untrusted Site ('Open Redirect') in fastify-static
Aliases: CVE-2021-22963
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-10-05T20:24:49Z

### Impact

A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//google.com/%2e%2e`.

The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

### Patches
The issue has been patched in `fastify-static@4.2.4`

### Workarounds
If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.

### References

+ Bug founder: drstrnegth
+ [hackerone Report](https://hackerone.com/reports/1354255)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)
* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)
Vulnerability: GHSA-3fx5-fwvr-xrjg
Summary: Regular Expression Denial of Service in ms
Aliases: CVE-2015-8315
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2017-10-24T18:33:36Z

Versions of `ms` prior to 0.7.1 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.

## Proof of Concept
```javascript
var ms = require('ms');
var genstr = function (len, chr) {
   var result = "";
   for (i=0; i<=len; i++) {
       result = result + chr;
   }

   return result;
}

ms(genstr(process.argv[2], "5") + " minutea");

```

### Results
Showing increase in execution time based on the input string.
```
$ time node ms.js 10000

real	0m0.758s
user	0m0.724s
sys	0m0.031s

$ time node ms.js 20000

real	0m2.580s
user	0m2.494s
sys	0m0.047s

$ time node ms.js 30000

real	0m5.747s
user	0m5.483s
sys	0m0.080s

$ time node ms.js 80000

real	0m41.022s
user	0m38.894s
sys	0m0.529s
```
Vulnerability: GHSA-xqxm-2rpm-3889
Summary: Comment reply notifications sent to incorrect users
Aliases: CVE-2022-21683
Severity: LOW
CVSS score: 3.5
CWE: CWE-200
Published: 2022-01-21T23:43:50Z

### Impact
When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not had editing access to, as long as they have left a comment or reply somewhere on the site.

### Patches
A patched version has been released as Wagtail 2.15.2 (for the current LTS), which restores the intended behaviour - to send notifications for new replies to the participants in the active thread only (editing permissions are not considered).

### Workarounds
New comments can be disabled by setting `WAGTAILADMIN_COMMENTS_ENABLED = False` in the Django settings file.

### Acknowledgements

Many thanks to Ihor Marhitych for identifying this issue.

### For more information
If you have any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at security@wagtail.io (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)
Vulnerability: GHSA-6rv4-4qv6-88g2
Summary: Prototype Pollution in set-or-get
Aliases: CVE-2021-25913
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-04-12T17:39:19Z

Prototype pollution vulnerability in ‘set-or-get’ version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-cqv6-7fwc-8m3c
Summary: Directory Traversal in xtalk
Aliases: CVE-2017-16091
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:44:59Z

Affected versions of `xtalk` are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL.

## Proof of Concept

```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost
```




## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.
Vulnerability: GHSA-84g3-cv89-m9gm
Summary: Prototype pollution vulnerability in 'patchmerge'
Aliases: CVE-2021-25916
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-10-13T15:33:20Z

Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-c265-37vj-cwcc
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14062
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2020-06-18T14:44:48Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
Vulnerability: GHSA-25pr-6pr6-68v7
Summary: Path traversal in atlasboard
Aliases: CVE-2021-39109
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2021-09-02T17:17:25Z

The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.
Vulnerability: GHSA-45w3-v3g4-54pm
Summary: Potential segfault in SPIFFE authenticator
Severity: LOW
CVSS score: 0
CWE: CWE-476
Published: 2022-02-11T19:11:36Z

### Impact
Several vulnerabilities have been reported in the `time` and `chrono` crates related to handling of calls to `localtime_r`. You can follow some of the discussions [here](https://github.com/chronotope/chrono/issues/602) and [here](https://github.com/time-rs/time/issues/293), and the associated CVE [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235). In our case, the issue with the dependency was flagged by our nightly CI build running [`cargo-audit`](https://github.com/parallaxsecond/parsec/issues/544). 

The vulnerability leads to a segfault in specific circumstances - namely, when one of a number of functions in the `time` crate is called while any other thread is setting an environment variable. Given that in the case of the Parsec service this affects the SPIFFE authenticator, Parsec service users can encounter the issue only when the JWT SVID authenticator is enabled and being used. We have not undergone any manual tracing to understand if the vulnerable methods are called anywhere in our stack, however it seems reasonable to expect that if that were to be the case, the issue would lie in JWT validation (i.e. when handling the dates found within a Json Web Token). JWT validation could thus fail, bringing down the thread in which the request happens. The rest of the threads continue to work. Since the threadpool implementation that we use [continues replenishing the pool](https://docs.rs/threadpool/latest/threadpool/) when one thread panics, the impact on the service should be minimal.

### Patches
No current patches exist as the problems lie in a number of dependencies that are not under our control (see more details [here](https://github.com/parallaxsecond/parsec/issues/544#issuecomment-1024185688)).

The issue tracking the required change in the `rust-spiffe` crate (through which the vulnerable dependencies are imported in Parsec) can be seen [here](https://github.com/maxlambrecht/rust-spiffe/issues/17). Once updates happen in our dependency chain that allow us to update beyond the vulnerable versions of `time` and `chrono`, a new version of the Parsec service will be tagged and released with the appropriate notifications.

### Workarounds
The only complete workaround is to use a different type of authenticator with the Parsec service. 

### References
As quoted in the initial paragraph, you can find out more information:
* in the `chrono` repo issue [here](https://github.com/chronotope/chrono/issues/602)
* in the `time` repo issue [here](https://github.com/time-rs/time/issues/293)
* in the official CVE report [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235)
* in our tracking issue [here](https://github.com/parallaxsecond/parsec/issues/544)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Parsec service repo](https://github.com/parallaxsecond/parsec)
* Email us at [cncf-parsec-maintainers@lists.cncf.io](mailto:cncf-parsec-maintainers@lists.cncf.io)
Vulnerability: GHSA-hgg3-g7gr-66r7
Summary: High severity vulnerability that affects pycryptodome
Aliases: CVE-2018-15560
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2018-08-27T19:52:28Z

PyCryptodome before 3.6.6 has an integer overflow in the data_len variable in AESNI.c, related to the AESNI_encrypt and AESNI_decrypt functions, leading to the mishandling of messages shorter than 16 bytes.
Vulnerability: GHSA-g397-v4w5-4m79
Summary: Command injection in cocoapods-downloader
Aliases: CVE-2022-21223
Severity: HIGH
CVSS score: 8.1
CWE: CWE-88, CWE-74
Published: 2022-04-02T00:00:13Z

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-jh5w-6964-x5cf
Summary: Downloads Resources over HTTP in chromedriver
Aliases: CVE-2016-10579
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:58:05Z

Affected versions of `chromedriver` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary file, replacing it with a malicious one. 



## Recommendation

Update to version 2.26.1 or later.
Vulnerability: GHSA-rjx9-2936-9ffx
Summary: Improper Input Validation in Apache Sanselan
Aliases: CVE-2018-17201
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-05-14T04:01:06Z

Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Vulnerability: GHSA-7v94-64hj-m82h
Summary: FPE in `ParallelConcat`
Aliases: CVE-2021-41207
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-11-10T19:02:57Z

### Impact
The [implementation of `ParallelConcat`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/inplace_ops.cc#L72-L97) misses some input validation and can produce a division by 0:

```python
import tensorflow as tf

@tf.function
def test():
  y = tf.raw_ops.ParallelConcat(values=[['tf']],shape=0)
  return y

test()
```

### Patches
We have patched the issue in GitHub commit [f2c3931113eaafe9ef558faaddd48e00a6606235](https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-3gw4-m5w7-v89c
Summary: Uncontrolled Resource Consumption in Indy Node
Aliases: CVE-2020-11090
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-06-11T00:04:15Z

# Summary
Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network.

# Discovery
On May 18, Evernym's monitoring of Sovrin StagingNet showed a report of StagingNet losing sufficient consensus to validate write transactions. The problem resolved itself within a few minutes. On May 20th we saw the alert multiple times, and we began analyzing the logs of our steward node. On May 21st we continued to see the alerts with increasing frequency.

It appears that someone is unknowingly sending a malformed transaction, and retrying when the transaction fails. The cause of the errors appear to be the TAA acceptance.

# Proposed actions
* Reproduce problem in integration tests and create a fix
* Do a hotfix release branching from last stable (current master have some things merged that are too risky)
* Upgrade BuilderNet, StagingNet and MainNet as soon as possible
* Improve testing strategy on Indy Node to reduce probability of such bugs

# Notes
* The journalctl logs also show an out-of-memory problem on the Australia node. We need to evaluate if this should be raised as a separate issue.
Vulnerability: GHSA-pgcr-7wm4-mcv6
Summary: Sensitive Data Exposure in pem
Severity: CRITICAL
CVSS score: 7.5
CWE: CWE-200
Published: 2019-06-04T15:42:45Z

Versions of `pem` before 1.13.2 expose sensitive data when the `readPkcs12` is used. 

The `readPkcs12` function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.



## Recommendation

Update to version 1.13.2 or later.
Vulnerability: GHSA-7vxr-6cxg-j3x8
Summary: OS Command Injection in ftpd
Aliases: CVE-2013-2512
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-10-12T22:33:59Z

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
Vulnerability: GHSA-v2wc-pfq2-5cm6
Summary: Possible XSS attack in Wagtail
Aliases: CVE-2020-11001
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-80
Published: 2020-04-14T23:09:29Z

### Impact
A cross-site scripting (XSS) vulnerability exists on the page revision comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).

### Workarounds
Site owners who are unable to upgrade to the new versions can disable the revision comparison view by adding the following URL route to the top of their project's `urls.py` configuration:

    from django.views.generic.base import RedirectView

    urlpatterns = [
        url(r'^admin/pages/(\d+)/revisions/compare/', RedirectView.as_view(url='/admin/')),
        # ...
    ]

### Acknowledgements
Many thanks to Vlad Gerasimenko for reporting this issue.

### For more information
If you have any questions or comments about this advisory:
* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at [security@wagtail.io](mailto:security@wagtail.io) (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)
Vulnerability: GHSA-hwvm-vfw8-93mw
Summary: Vulnerable dependency in XTDB connector
Severity: MODERATE
CVSS score: 5.3
Published: 2021-12-16T18:53:32Z

### Impact

The impacted portion of the XTDB connector is its connectivity to S3 as a backing store: this is the only portion of the connector that uses this vulnerable `httpclient` dependency. Per the description, the vulnerability regards URIs that may be misinterpreted, which given the area of impact within the connector we understand to be any URI used to configure connectivity to S3. Note therefore that if you do not use or configure S3 as a backing store in your use of the connector, you should not be exposed to any vulnerability from this component.

### Patches

The problem has been addressed in version 4.5.13 of the httpclient library, which is included as a replacement dependency version for the build of the XTDB connector from release 3.5 onwards. Therefore, using release 3.5 (or newer) of the connector will include the fixes to address this CVE.

### Workarounds

We have not investigated specific workarounds, but per the description of the issue it seems likely that ensuring the proper URIs are used for any S3 connectivity used by the connector (and ensuring there are appropriate controls around modifying such URIs in the connector's configuration) would be the first point of investigation.

### References

https://nvd.nist.gov/vuln/detail/CVE-2020-13956
Vulnerability: GHSA-xf46-8vvp-4hxx
Summary: Missing authentication for critical function
Aliases: CVE-2021-20262
Severity: MODERATE
CVSS score: 0
CWE: CWE-306
Published: 2021-03-12T21:33:42Z

A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Vulnerability: GHSA-828x-qc2p-wprq
Summary: Undefined behavior in `MaxPool3DGradGrad`
Aliases: CVE-2021-29574
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:26:10Z

### Impact
The implementation of `tf.raw_ops.MaxPool3DGradGrad` exhibits undefined behavior by dereferencing null pointers backing attacker-supplied empty tensors:

```python
import tensorflow as tf

orig_input = tf.constant([0.0], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
orig_output = tf.constant([0.0], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
grad = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
ksize = [1, 1, 1, 1, 1]
strides = [1, 1, 1, 1, 1]
padding = "SAME"

tf.raw_ops.MaxPool3DGradGrad(
    orig_input=orig_input, orig_output=orig_output, grad=grad, ksize=ksize,
    strides=strides, padding=padding)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/72fe792967e7fd25234342068806707bbc116618/tensorflow/core/kernels/pooling_ops_3d.cc#L679-L703) fails to validate that the 3 tensor inputs are not empty. If any of them is empty, then accessing the elements in the tensor results in dereferencing a null pointer.

### Patches
We have patched the issue in GitHub commit [a3d9f9be9ac2296615644061b40cefcee341dcc4](https://github.com/tensorflow/tensorflow/commit/a3d9f9be9ac2296615644061b40cefcee341dcc4).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-j5qg-w9jg-3wg3
Summary: Inability to de-op players if listed in ops.txt with non-lowercase letters
Severity: LOW
CVSS score: 3.3
Published: 2021-12-16T18:53:57Z

### Impact
Originally reported in iTXTech/Genisys#1188

```txt
PotterHarry98
potterharry98
```

`deop PotterHarry98`

will remove `potterharry98` from the ops.txt but not `PotterHarry98`.

Operator permissions are checked using `Config->exists()` with `lowercase=true`, which will result in a match:
https://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449

This means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.

### Patches
4d37b79ff7f9d9452e988387f97919a9a1c4954e

### Workarounds
This can be easily addressed by removing the offending lines from ops.txt manually.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-37vc-gwvp-6cgv
Summary: Malicious Package in bitcoijns-lib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:42:49Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-76p6-gpvf-6wmv
Summary: Directory Traversal in hftp
Aliases: CVE-2017-16039
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T15:50:28Z

Affected versions of `hftp` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-5gm3-px64-rw72
Summary: Uncontrolled Resource Consumption in Pillow
Aliases: CVE-2019-19911
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2020-04-01T16:36:44Z

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.
Vulnerability: GHSA-j5rj-g695-342r
Summary: Moderate severity vulnerability that affects fat_free_crm
Aliases: CVE-2018-1000842
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-12-20T22:01:54Z

FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear to be exploitable via Content with Javascript payload will be executed on end user browsers when they visit the page. This vulnerability appears to have been fixed in 0.18.1, 0.17.3, 0.16.4, 0.15.2, 0.14.2.
Vulnerability: GHSA-w4r4-65mg-45x2
Summary: Moderate severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-11770
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-287
Published: 2018-11-09T17:41:46Z

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future 2.4.x versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.
Vulnerability: GHSA-pr8j-3v7m-j4vv
Summary: Directory Traversal in myprolyz
Aliases: CVE-2017-16156
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:21:45Z

Affected versions of `myprolyz` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-9236-8w7q-rmrv
Summary: archivy is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4162
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2022-01-06T21:59:50Z

archivy is vulnerable to Cross-Site Request Forgery (CSRF). There is [a fix](https://github.com/archivy/archivy/commit/796c3ae318eea183fc88c87ec5a27355b0f6a99d) available in the master branch.
Vulnerability: GHSA-5pxj-mhwj-x5gv
Summary: Prototype Pollution in asciitable.js
Aliases: CVE-2020-7771
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-400
Published: 2021-04-13T15:24:59Z

The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
Vulnerability: GHSA-j38c-25fj-mr84
Summary: Stored XSS in Apache Airflow
Aliases: CVE-2020-9485
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-07-27T16:57:34Z

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.
Vulnerability: GHSA-344f-f5vg-2jfj
Summary: Potential remote code execution in Apache Tomcat
Aliases: CVE-2020-9484
Severity: HIGH
CVSS score: 7
CWE: CWE-502
Published: 2020-05-21T18:52:29Z

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
Vulnerability: GHSA-6g88-vr3v-76mf
Summary: Eval injection in Supybot/Limnoria
Aliases: CVE-2019-19010
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2019-11-20T01:31:31Z

Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
Vulnerability: GHSA-rffr-c932-cpxv
Summary: Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor
Aliases: CVE-2019-19025
Severity: MODERATE
CVSS score: 7.6
CWE: CWE-352
Published: 2021-05-18T18:27:50Z

Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
Vulnerability: GHSA-2q6w-rxf3-4wc9
Summary: Malicious Package in codify
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:49:18Z

Version 0.3.1 of `codify` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.3.1 of this module is found installed you will want to replace it with a version before or after 0.3.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-v9v4-7jp6-8c73
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-2197
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.
Vulnerability: GHSA-37g7-8vjj-pjpj
Summary: Hash flooding
Aliases: CVE-2020-14326
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-03-18T17:58:59Z

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.