TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fxhp-wrw9-3r97
Summary: XML external entity (XXE) injection in Apache Nutch
Aliases: CVE-2021-23901
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-611
Published: 2022-03-18T17:46:29Z

An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.  This issue is fixed in Apache Nutch 1.18.
Vulnerability: GHSA-4j46-mp85-mv8c
Summary: Path traversal in rollup-plugin-serve
Aliases: CVE-2020-7684
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2021-05-18T01:52:24Z

Path traversal in npm package `rollup-plugin-serve` before version 1.0.2. There is no path sanitization in `readFile` operation.
Vulnerability: GHSA-q7f7-544h-67h9
Summary: FPE in TFLite pooling operations
Aliases: CVE-2021-37684
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:40:13Z

### Impact
The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0.

### Patches 
We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-ffpv-c4hm-3x6v
Summary: actionpack is vulnerable to denial of service via a crafted HTTP Accept header
Aliases: CVE-2016-0751
Severity: HIGH
CVSS score: 7.5
Published: 2017-10-24T18:33:35Z

actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.
Vulnerability: GHSA-ff2w-cq2g-wv5f
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2020-7238
Severity: HIGH
CVSS score: 7.5
CWE: CWE-444
Published: 2020-02-21T18:55:50Z

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Vulnerability: GHSA-8786-wg74-f522
Summary: Improper Control of Dynamically-Managed Code Resources in Crafter CMS Crafter Studio
Aliases: CVE-2020-25803
Severity: HIGH
CVSS score: 7.2
CWE: CWE-913
Published: 2022-02-09T23:07:54Z

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
Vulnerability: GHSA-r577-4hq7-73qh
Summary: Remote Code Execution in Apache Dubbo
Aliases: CVE-2021-36162
Severity: HIGH
CVSS score: 8.8
CWE: CWE-77
Published: 2021-09-08T20:14:24Z

Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Vulnerability: GHSA-xxvw-45rp-3mj2
Summary: Deserialization Code Execution in js-yaml
Aliases: CVE-2013-4660
Severity: CRITICAL
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.

## Proof of Concept
```
const yaml = require('js-yaml');

const x = `test: !!js/function >
function f() { 
console.log(1); 
}();`

yaml.load(x);
```


## Recommendation

Update js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.
Vulnerability: GHSA-3gg9-f3vh-866f
Summary: Improper Certificate Validation in Graylog
Aliases: CVE-2020-15813
Severity: HIGH
CVSS score: 8.1
CWE: CWE-295
Published: 2022-02-10T22:39:58Z

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code (in all versions that support LDAP) does not implement proper certificate validation (regardless of whether the "Allow self-signed certificates" option is used). Therefore, any attacker with the ability to intercept network traffic between a Graylog server and an LDAP server is able to redirect traffic to a different LDAP server (unnoticed by the Graylog server due to the lack of certificate validation), effectively bypassing Graylog's authentication mechanism.
Vulnerability: GHSA-qc65-cgvr-93p6
Summary: Code injection in kill-process-by-name
Aliases: CVE-2021-23356
Severity: HIGH
CVSS score: 9.8
CWE: CWE-77
Published: 2021-03-19T21:19:18Z

This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file.
Vulnerability: GHSA-7qmm-q394-fmch
Summary: Command Injection in ps-kill
Aliases: CVE-2021-23355
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-03-19T21:19:29Z

This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. PoC (provided by reporter): var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)',function(){});
Vulnerability: GHSA-2mp5-m968-gwr2
Summary: Path Traversal in http-file-server
Aliases: CVE-2019-5447
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-07-16T00:41:34Z

All versions of `http-file-server` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-2m96-9w4j-wgv7
Summary: Prototype Pollution in lodash.merge
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T18:06:00Z

Versions of `lodash.merge` before 4.6.1 are vulnerable to Prototype Pollution. The function 'merge' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-cq58-r77c-5jjw
Summary: Cross-site scripting (XSS) from image block content in the site frontend
Aliases: CVE-2021-41258
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79, CWE-80
Published: 2021-11-16T17:04:41Z

### Impact

Kirby's [blocks field](https://getkirby.com/docs/reference/panel/fields/blocks) stores structured data for each block. This data is then used in [block snippets](https://getkirby.com/docs/reference/panel/fields/blocks#block-snippets) to convert the blocks to HTML for use in your templates. We recommend to [escape HTML special characters](https://getkirby.com/docs/guide/templates/escaping) against cross-site scripting (XSS) attacks.

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

The default snippet for the [image block](https://getkirby.com/docs/reference/panel/blocks/image) unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source, alt and link fields of the image block, which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site.

This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

You are *not* affected if you don't use the blocks field or specifically the image block in any of your blueprints. You are also protected if you use a custom [block snippet](https://getkirby.com/docs/reference/panel/fields/blocks#block-snippets) that either escapes the printed values or doesn't use them. The attack can only be performed by logged-in users and only surfaces in the site frontend (i.e. in your templates). The Panel itself is unaffected and will not execute JavaScript that was injected into the image block content.

### Patches

We have patched the vulnerability in [Kirby 3.5.8](https://github.com/getkirby/kirby/releases/tag/3.5.8) by escaping special HTML characters in the output from the default image block snippet. Please update to this or a [later version](https://github.com/getkirby/kirby/releases/) to fix the vulnerability.

### Credits

Thanks to Azrul Ikhwan Zulkifli (@azrultech) from BAE Systems AI Vulnerability Research Team for responsibly reporting the identified issue.
Vulnerability: GHSA-2fwq-wx47-hm6x
Summary: Malicious Package in bcion
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:31:39Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xhw6-hjc9-679m
Summary: Token validation bypass in Pac4j
Aliases: CVE-2021-44878
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2022-01-08T00:36:05Z

Pac4j v5.1 and earlier allows (by default) clients to accept and successfully validate ID Tokens with "none" algorithm (i.e., tokens with no signature) which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.
Vulnerability: GHSA-wch2-46wj-6x5j
Summary: Malicious Package in bip30
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:37:15Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3cgg-gh9j-w8vm
Summary: Directory Traversal in iter-http
Aliases: CVE-2017-16094
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T13:58:10Z

Affected versions of `iter-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rgjg-66cx-5x9m
Summary: Authentication Bypass
Aliases: CVE-2018-15727
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2022-02-15T01:57:18Z

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Vulnerability: GHSA-4j77-gg36-9864
Summary: Cross-Site Scripting in TYPO3 CMS Link Handling
Aliases: CVE-2020-11065
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-05-13T23:18:12Z

It has been discovered that link tags generated by `typolink` functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-003
Vulnerability: GHSA-c5r5-7pfh-6qg6
Summary: OS command injection in BibTeX-Ruby
Aliases: CVE-2019-10780
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-02-14T23:10:01Z

BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
Vulnerability: GHSA-763g-fqq7-48wg
Summary: XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))
Aliases: CVE-2019-10782
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-611
Published: 2020-01-31T18:00:07Z

Due to an incomplete fix for [CVE-2019-9658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9658), checkstyle was still vulnerable to XML External Entity (XXE) Processing.

### Impact

#### User: Build Maintainers

This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.

#### User: Static Analysis as a Service

If you operate a site/service that parses "untrusted" Checkstyle XML configuration files, you are vulnerable to this and should patch.

Note from the discoverer of the original CVE-2019-9658:

> While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it's a common pattern to run the static code analysis tool inside of a Docker container with the following flags:
> ```
> --net=none \
> --privileged=false \
> --cap-drop=ALL
> ```
> Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF.
> \- [Jonathan Leitschuh](https://twitter.com/jlleitschuh)

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Patched, will be released with version 8.29 at 26 Jan 2020.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No workaround are available

### References

 - [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)
 - GitHub Issue https://github.com/checkstyle/checkstyle/issues/7468

### For more information

If you have any questions or comments about this advisory:
* Open an issue in https://github.com/checkstyle/checkstyle/issues
Vulnerability: GHSA-qwmj-72mp-q3m2
Summary: Missing Authorization in TYPO3 extension
Aliases: CVE-2020-12700
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2021-07-26T21:34:58Z

The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
Vulnerability: GHSA-cjjf-94ff-43w7
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-12022
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2019-03-25T18:03:09Z

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Vulnerability: GHSA-hjhr-r3gq-qvp6
Summary: Timing Attack in csrf-lite
Aliases: CVE-2016-10535
Severity: HIGH
CVSS score: 0
CWE: CWE-208
Published: 2019-02-18T23:39:44Z

Affected versions of `csrf-lite` are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. 

Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.

Under favorable network conditions, an attacker can exploit this to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present. 


## Recommendation

Update to version 0.1.2 or later.
Vulnerability: GHSA-2363-cqg2-863c
Summary: XML External Entity (XXE) Injection in JDOM
Aliases: CVE-2021-33813
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2021-07-27T19:02:56Z

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.  At this time there is not released fixed version of JDOM.  As a workaround, to avoid external entities being expanded, one can call `builder.setExpandEntities(false)` and they won't be expanded.
Vulnerability: GHSA-2j2j-8rrv-264g
Summary: Cross-Site Scripting in exceljs
Aliases: CVE-2018-16459
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-09-11T18:58:40Z

Versions of `exceljs` before 1.6.0 are vulnerable to cross-site scripting. 

This vulnerability is due to `exceljs` does not  validate data from parsed XLSX file and allows to embed HTML tags, like `<script>`, directly in the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet were displayed in the browser.




## Recommendation

Update to version 1.6.0 or later.
Vulnerability: GHSA-5pg8-h4gv-m3p8
Summary: Null pointer deference in fltk
Aliases: CVE-2021-28306
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-08-25T20:53:56Z

An issue was discovered in the fltk crate before 0.15.3 for Rust. There is a NULL pointer dereference during attempted use of a multi label type if the image is nonexistent.
Vulnerability: GHSA-3pxp-6963-46r9
Summary: Command Injection in pdfinfojs
Aliases: CVE-2018-3746
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2018-06-07T19:43:00Z

Versions of `pdfinfojs` before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the `pdfinfojs` constructor.


## Recommendation

Update to version 0.4.1 or later.
Vulnerability: GHSA-h835-75hw-pj89
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2012-3464
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
Vulnerability: GHSA-vrc7-6g8w-jh56
Summary: Improper Input Validation in xdLocalStorage
Aliases: CVE-2015-9544
Severity: HIGH
CVSS score: 7.1
CWE: CWE-20
Published: 2021-12-09T19:29:36Z

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Vulnerability: GHSA-fhv4-fx3v-77w6
Summary: quinn invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2021-28036
Severity: HIGH
CVSS score: 7.5
CWE: CWE-119
Published: 2021-08-25T20:52:05Z

An issue was discovered in the quinn crate for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
Vulnerability: GHSA-g2xc-35jw-c63p
Summary: HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Aliases: CVE-2019-16786
Severity: HIGH
CVSS score: 7.1
CWE: CWE-444
Published: 2019-12-20T23:04:18Z

### Impact

Waitress would parse the `Transfer-Encoding` header and only look for a single string value, if that value was not `chunked` it would fall through and use the `Content-Length` header instead.

According to the HTTP standard `Transfer-Encoding` should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with `chunked`.

Requests sent with:

```
Transfer-Encoding: gzip, chunked
```

Would incorrectly get ignored, and the request would use a `Content-Length` header instead to determine the body size of the HTTP message.

This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining.

### Patches

This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 

Waitress will now return a 501 Not Implemented error if the `Transfer-Encoding` is not `chunked` or contains multiple elements. Waitress does not support any transfer codings such as `gzip` or `deflate`.

The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&#39;t cause any changes in behavior.

### Workarounds

Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).

### Issues/more security issues:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: GHSA-7xx3-m584-x994
Summary: A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Aliases: CVE-2019-16770
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-770
Published: 2019-12-05T19:26:37Z

## Keepalive thread overload/DoS

### Impact

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

### Patches

This vulnerability is patched in Puma 4.3.1 and 3.12.2.

### Workarounds

Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [puma](github.com/puma/puma).
Vulnerability: GHSA-6866-x7cf-rmh5
Summary: Directory Traversal in sencisho
Aliases: CVE-2017-16092
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T13:50:01Z

Affected versions of `sencisho` are vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rch9-xh7r-mqgw
Summary: Cross-Site Scripting in simple-server
Aliases: CVE-2018-3717
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2018-07-26T15:08:05Z

Versions of `simple-server` before 1.1.0 are vulnerable to stored cross-site scripting (XSS). This is exploitable if an attacker can control a filename on the server.


## Recommendation

Update to version 1.1.0 or later.
Vulnerability: GHSA-qg54-694p-wgpp
Summary: Regular expression denial of service vulnerability (ReDoS) in date
Aliases: CVE-2021-41817
Severity: MODERATE
CVSS score: 0
CWE: CWE-1333
Published: 2021-11-16T00:32:30Z

Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.

The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse.

Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import `date` from the standard library rather than as a gem you should update your Ruby install to `3.0.3`, `2.7.5`, `2.6.9` or later.

Users unable to upgrade may consider using `Date.strptime` instead with a predefined date format
```ruby
Date.strptime('2001-02-20', '%Y-%m-%d')
```
Vulnerability: GHSA-9j59-75qj-795w
Summary: Path traversal in Pillow
Aliases: CVE-2022-24303
Severity: CRITICAL
CVSS score: 9.1
Published: 2022-03-11T23:10:32Z

If the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary image file after im.show() (and related actions), and potentially remove an unrelated file. This been present since PIL.
Vulnerability: GHSA-v648-p92f-9996
Summary: Out-of-bounds write
Aliases: CVE-2019-0925
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:39Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-xxr8-833v-c7wc
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2011-4319
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
Vulnerability: GHSA-jfcc-rm7f-xgf8
Summary: Cross-Site Scripting in mavon-editor
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2020-09-03T20:36:35Z

All versions of `mavon-editor` are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-5875-p652-2ppm
Summary: Exposure of Resource to Wrong Sphere in microweber
Aliases: CVE-2022-0762
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-668
Published: 2022-02-27T00:00:16Z

Exposure of Resource to Wrong Sphere in microweber prior to 1.3 allows users to add deleted products to a cart and buy it.
Vulnerability: GHSA-4v5p-v5h9-6xjx
Summary: `CHECK`-failures in Tensorflow
Aliases: CVE-2022-23565
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-09T23:49:01Z

### Impact
An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated.

### Patches
We have patched the issue in GitHub commit [c2b31ff2d3151acb230edc3f5b1832d2c713a9e0](https://github.com/tensorflow/tensorflow/commit/c2b31ff2d3151acb230edc3f5b1832d2c713a9e0).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-9chw-xrwx-f86j
Summary: Downloads Resources over HTTP in frames-compiler
Aliases: CVE-2016-10649
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:07:53Z

Affected versions of `frames-compiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `frames-compiler`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5x33-h32w-6vr2
Summary: Cross site-scripting (XSS) moodle
Aliases: CVE-2020-25628
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-03-29T20:43:15Z

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Vulnerability: GHSA-vgwr-773q-7j3c
Summary: Path Traversal within joomla/archive zip class
Aliases: CVE-2021-26028
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2021-03-24T17:58:13Z

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.
Vulnerability: GHSA-hj5w-xgw9-w4rj
Summary: Malicious Package in coinstrng
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:41:44Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-mmjr-5q74-p3m4
Summary: Exposure of Resource to Wrong Sphere in Drupal Core
Aliases: CVE-2020-13670
Severity: HIGH
CVSS score: 7.5
CWE: CWE-668
Published: 2022-02-12T00:00:47Z

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Vulnerability: GHSA-7fw7-gh23-f832
Summary: Vulnerability in singleCrunch function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36381
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2021-11-01T19:19:29Z

aaptjs is a node wraper for aapt. An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-vvwv-h69m-wg6f
Summary: XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
Aliases: CVE-2019-12331
Severity: HIGH
CVSS score: 8.8
CWE: CWE-611
Published: 2019-11-20T01:39:57Z

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.
Vulnerability: GHSA-cxcf-78mr-wpg7
Summary: Malicious Package in oauth-validator
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:29:59Z

Version 1.0.2 of `oauth-validator` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-hx5x-49mm-vmhw
Summary: SQL Injection in sails-mysql
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2020-09-03T02:36:43Z

Versions of `sails-mysql` prior to 0.10.8 are vulnerable to SQL Injection. The `sort` keyword is not properly sanitized and may allow attackers to inject SQL statements and execute arbitrary SQL queries


## Recommendation

Upgrade to version 0.10.8 or later.
Vulnerability: GHSA-56cx-wf47-hx7w
Summary:  Improper Restriction of Excessive Authentication Attempts
Aliases: CVE-2021-3663
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-307
Published: 2021-08-09T20:38:37Z

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
Vulnerability: GHSA-8j49-49jq-vwcq
Summary: Prototype Pollution in getsetdeep
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:15:34Z

All versions of `getsetdeep` are vulnerable to prototype pollution. The `setDeep()` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6f34-pq9f-36vf
Summary: Hijacked Environment Variables in sqlite.js
Aliases: CVE-2017-16050
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T20:50:29Z

The `sqlite.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation




As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-3fjq-93xj-3f3f
Summary: Cross-Site Scripting in serialize-to-js
Aliases: CVE-2019-16772
Severity: MODERATE
CVSS score: 3.1
CWE: CWE-79
Published: 2019-12-06T23:20:26Z

Versions of `serialize-to-js` prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.


## Recommendation

Upgrade to version 3.0.1 or later.
Vulnerability: GHSA-v9qg-3j8p-r63v
Summary: Uncontrolled Recursion in Django
Aliases: CVE-2019-14235
Severity: HIGH
CVSS score: 7.5
CWE: CWE-674
Published: 2019-08-06T01:43:31Z

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
Vulnerability: GHSA-r863-p739-275c
Summary: Malicious Package in reuest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:09:24Z

All versions of `reuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-mpf2-q34c-fc6j
Summary: Infinite Loop in scapy
Aliases: CVE-2019-1010142
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2019-07-22T14:53:58Z

scapy 2.4.0 is affected by Denial of Service. The impact is infinite loop, resource consumption and program unresponsive. The component is _RADIUSAttrPacketListField.getfield(self..). The attack vector is over the network or in a pcap. both work.
Vulnerability: GHSA-67cx-rhhq-mfhq
Summary: High severity vulnerability that affects indico
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2019-10-11T18:28:07Z

## Local file disclosure through LaTeX injection

### Impact
An external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. `indico.conf`).

As far as we know it is not possible to write files or execute code using this vulnerability.

### Patches
You need to update to [Indico 2.2.3](https://github.com/indico/indico/releases/tag/v2.2.3) as soon as possible.
We also released [Indico 2.1.10](https://github.com/indico/indico/releases/tag/v2.1.10) in case you cannot update to 2.2 for some reason.
See https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update.

### Workarounds
Setting `XELATEX_PATH = None` in `indico.conf` will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused.

### For more information
If you have any questions or comments about this advisory:
* Open a thread in [our forum](https://talk.getindico.io/)
* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)
Vulnerability: GHSA-p4pj-9g59-4ppv
Summary: Remote Code Execution in SyliusResourceBundle
Aliases: CVE-2020-15143
Severity: HIGH
CVSS score: 7.7
CWE: CWE-917, CWE-74
Published: 2020-08-19T21:04:25Z

### Impact

Request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: `<=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3`.

### Example

```yaml
foo:
    path: /foo/{id}
    defaults:
        _sylius:
            repository:
                method: findSome
                arguments:
                    entity: "expr:service('repository').find($id)"
```

In this case, `$id` can be prepared in a way that calls other services. 

If you visit `/foo/"~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"`, it will result in a following expression `expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"")`, which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

### Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

### Workarounds

The fix requires adding `addslashes` in `ParametersParser::parseRequestValueExpression` to sanitize user input before evaluating it using the expression language.

```php
- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
```

### Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-wv23-pfj7-2mjj
Summary: Authenticated file write leads to remote code execution in october/system
Aliases: CVE-2021-32649
Severity: HIGH
CVSS score: 8.8
CWE: CWE-74
Published: 2022-01-14T21:08:23Z

### Impact

Assuming an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup.

### Patches

Issue has been patched in Build 473 and v1.1.6

### Workarounds

Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade.

### References

Credits to:
• David Miller

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-5w4r-wwc3-6qcp
Summary: Malicious Package in precode.js
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:23:29Z

Version 1.1.1 of `precode.js` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-mcx4-f5f5-4859
Summary: Prevent cache poisoning via a Response Content-Type header in Symfony
Aliases: CVE-2020-5255
Severity: LOW
CVSS score: 2.6
CWE: CWE-435
Published: 2020-03-30T20:09:16Z

Description
-----------

When a `Response` does not contain a `Content-Type` header, Symfony falls back to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can lead to a corrupted cache where the cached format is not the right one.

Resolution
----------

Symfony does not use the `Accept` header anymore to guess the `Content-Type`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6) for the 4.4 branch.

Credits
-------

I would like to thank Xavier Lacot from JoliCode for reporting & Yonel Ceruto and Tobias Schultze for fixing the issue.
Vulnerability: GHSA-qr82-2c78-4m8h
Summary: Reference binding to nullptr in map operations
Aliases: CVE-2021-37671
Severity: HIGH
CVSS score: 7.8
CWE: CWE-824
Published: 2021-08-25T14:41:42Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.Map*` and `tf.raw_ops.OrderedMap*` operations:

```python
import tensorflow as tf
  
tf.raw_ops.MapPeek(
  key=tf.constant([8],dtype=tf.int64),
  indices=[],
  dtypes=[tf.int32],
  capacity=8,
  memory_limit=128)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L222-L248) has a check in place to ensure that `indices` is in ascending order, but does not check that `indices` is not empty.
    
### Patches
We have patched the issue in GitHub commit [532f5c5a547126c634fefd43bbad1dc6417678ac](https://github.com/tensorflow/tensorflow/commit/532f5c5a547126c634fefd43bbad1dc6417678ac).
                       
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-h2f4-v4c4-6wx4
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2018-12545
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2019-03-28T18:33:38Z

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.