TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-3pc2-fm7p-q2vg
Summary: Cross-site Scripting in October
Aliases: CVE-2020-4061
Severity: LOW
CVSS score: 3.7
CWE: CWE-79
Published: 2020-07-02T16:55:11Z

### Impact
Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack.

### Patches
Issue has been patched in Build 467 (v1.0.467).

### Workarounds
Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually if unable to upgrade to Build 467.

### References
- https://research.securitum.com/the-curious-case-of-copy-paste/

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Low given that by the nature of the attack it can only impact users that do it to themselves by copying and pasting from malicious websites.

### Acknowledgements

Thanks to [Michał Bentkowski of Securitum](https://research.securitum.com/authors/michal-bentkowski/) for finding the original issue in Froala and @tomaszstrojny for reporting the issue to the October CMS team.
Vulnerability: GHSA-2p78-8hh6-96xc
Summary: Moderate severity vulnerability that affects feedparser
Aliases: CVE-2011-1157
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-23T19:52:21Z

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.
Vulnerability: GHSA-74r6-grj9-8rq6
Summary: Remote Code Execution in AjaxNetProfessional
Aliases: CVE-2021-23758
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-12-16T15:27:55Z

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
Vulnerability: GHSA-h77x-m5q8-c29h
Summary: Moderate severity vulnerability that affects rack
Aliases: CVE-2012-6109
Severity: MODERATE
CVSS score: 0
CWE: CWE-835
Published: 2017-10-24T18:33:37Z

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
Vulnerability: GHSA-6hr9-4692-fch9
Summary: OS Command Injection in effect
Aliases: CVE-2020-7624
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:45:54Z

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.
Vulnerability: GHSA-f7g4-fm4c-54m9
Summary: Malicious Package in yeoman-genrator
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:06:31Z

Version 2.0.2 of `yoeman-generator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hf9p-9r39-r2h3
Summary: Unrestricted Uploads in Concrete5
Aliases: CVE-2020-11476
Severity: HIGH
CVSS score: 7.2
CWE: CWE-434
Published: 2021-11-03T17:29:29Z

Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.
Vulnerability: GHSA-r53m-pfr5-7v87
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Severity: MODERATE
CVSS score: 0
Published: 2019-04-18T14:50:19Z

**Withdrawn:** Duplicate of GHSA-qcxh-w3j9-58qr
Vulnerability: GHSA-jpq3-xf27-5jf2
Summary: Prototype Pollution in safe-object2
Aliases: CVE-2020-7726
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:26:42Z

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.
Vulnerability: GHSA-59cj-99cw-rq64
Summary: Out-of-bounds write
Aliases: CVE-2019-0913
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:05Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-vcg8-98q8-g7mj
Summary: Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
Aliases: CVE-2020-1740
Severity: LOW
CVSS score: 4.7
CWE: CWE-200, CWE-377
Published: 2021-04-07T21:47:31Z

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Vulnerability: GHSA-6c37-2rw5-9j7x
Summary: Malicious Package in requesst
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:25:46Z

All versions of `requesst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-53jx-4wwh-gcqj
Summary: Malicious Package in angular-location-update
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:11:34Z

Version 0.0.3 of `angular-location-update` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-4228-7qvx-f4rq
Summary: Injection and Command Injection in devcert
Aliases: CVE-2020-8186
Severity: HIGH
CVSS score: 9.8
CWE: CWE-74, CWE-78, CWE-77
Published: 2021-05-18T01:41:56Z

A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.
Vulnerability: GHSA-7cgp-c3g7-qvrw
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2014-0082
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:36Z

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
Vulnerability: GHSA-8vfm-4388-6rpc
Summary: Apache is vulnerable to XXE in XSD validation processor
Aliases: CVE-2018-8027
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2018-10-16T23:06:25Z

Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.
Vulnerability: GHSA-jc35-q369-45pv
Summary: Remote code execution in Apache Struts
Aliases: CVE-2020-17530
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-917
Published: 2022-02-09T22:51:56Z

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Vulnerability: GHSA-qccf-q7p4-3q3j
Summary: Prototype Pollution in safe-object2
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:16:42Z

All versions of `safe-object2` are vulnerable to prototype pollution. The `settter()` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-x588-g38j-f672
Summary: Cross-site Scripting in Apache Pluto
Aliases: CVE-2021-36737
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-08T00:46:20Z

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
Vulnerability: GHSA-p9cf-qjxq-vxw6
Summary: Privilege Context Switching Error in wildlfy
Aliases: CVE-2020-1719
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-270
Published: 2021-06-08T18:52:27Z

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.
Vulnerability: GHSA-mpxf-gcw2-pw5q
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-6414
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
Vulnerability: GHSA-wc7q-qpm4-8pqv
Summary: Malicious Package in rrequest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:32:10Z

All versions of `rrequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-6pcc-3rfx-4gpm
Summary: Dom4j contains a XML Injection vulnerability
Aliases: CVE-2018-1000632
Severity: HIGH
CVSS score: 7.5
CWE: CWE-91
Published: 2018-10-16T17:01:25Z

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

Note: This advisory applies to `dom4j:dom4j` version 1.x legacy artifacts.  To resolve this a change to the latest version of `org.dom4j:dom4j` is recommended.
Vulnerability: GHSA-3mhm-jvqj-fvhg
Summary: Malicious Package in js-sia3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:09:37Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-45w5-pvr8-4rh5
Summary: Command injection in eslint-fixer
Aliases: CVE-2021-26275
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-04-13T15:19:14Z

The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted.
Vulnerability: GHSA-9279-7hph-r3xw
Summary: Buffer Overflow in Apache Mina SSHD
Aliases: CVE-2021-30129
Severity: HIGH
CVSS score: 7.5
CWE: CWE-772
Published: 2021-08-02T16:54:09Z

A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0
Vulnerability: GHSA-h385-52j6-9984
Summary: Withdrawn: HTTP Request Smuggling in Agoo
Aliases: CVE-2020-7670
Severity: MODERATE
CVSS score: 0
CWE: CWE-444
Published: 2020-10-20T19:15:38Z

# Withdrawn reason
Withdrawn on 1/13/2021 due to [this comment from the maintainer](https://github.com/ohler55/agoo/issues/88#issuecomment-723580783).  This is no longer considered a vulnerability.

# Original description
agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.
Vulnerability: GHSA-qq48-m4jx-xqh8
Summary: "Deserialization errors in MyBatis"
Aliases: CVE-2020-26945
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-04-22T16:14:38Z

MyBatis before 3.5.6 mishandles deserialization of object streams leading to potential cache poisoning.
Vulnerability: GHSA-p94w-42g3-f7h4
Summary: Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
Severity: HIGH
CVSS score: 0
Published: 2020-03-06T01:16:00Z

### Impact
The [`verifyVerifiableCredential()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.ts#L57) method check the cryptographic integrity of the Verifiable Credential, but it does not check if the [`credential.issuer`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L129) DID matches the signer of the credential.

The **verifier** is impacted by this vulnerability.

### Patches
Patch will be available in version 0.2.2.

### Workarounds
In case you trust certain issuers for certain credentials as a verifier, trust the issuer&#39;s public key from the `credential.proof.verificationMethod` field.

### References
[Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13)

### For more information
If you have any questions or comments about this advisory:
* Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13)
* [Contact me](https://github.com/rabomarnix)
Vulnerability: GHSA-m8qc-mf6p-pfq9
Summary: Link Following in rply
Aliases: CVE-2014-1938
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-59
Published: 2020-03-11T20:56:34Z

python-rply before 0.7.4 insecurely creates temporary files.
Vulnerability: GHSA-h5vj-f7r9-w564
Summary: Entropy Backdoor in text-qrcode
Severity: HIGH
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:22:35Z

All versions of `text-qrcode` contain malicious code that overwrites the `randomBytes` method for the `crypto` module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and hash them, resulting in a 32 byte value being returned, but one that is easily guessable. 


## Recommendation

Uninstall `text-qrcode` immediately. If the module was used to generate entropy that is load bearing, all such instances of generated entropy must be replaced. This includes things like bitcoin wallets, private keys, encrypted messages, etc.
Vulnerability: GHSA-vp9j-rghq-8jhh
Summary: Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
Aliases: CVE-2020-10744
Severity: MODERATE
CVSS score: 5
CWE: CWE-668, CWE-377
Published: 2022-02-09T21:59:42Z

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
Vulnerability: GHSA-m394-8rww-3jr7
Summary: DOS vulnerability for Quoted Quality CSV headers
Aliases: CVE-2020-27223
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-03-10T03:46:47Z

### Impact
When Jetty handles a request containing request headers with a large number of “quality” (i.e. q) parameters (such as what are seen on the `Accept`, `Accept-Encoding`, and `Accept-Language` request headers), the server may enter a denial of service (DoS) state due to high CPU usage while sorting the list of values based on their quality values.  A single request can easily consume minutes of CPU time before it is even dispatched to the application.

The only features within Jetty that can trigger this behavior are:

- Default Error Handling - the `Accept` request header with the `QuotedQualityCSV` is used to determine what kind of content to send back to the client (html, text, json, xml, etc)
- `StatisticsServlet` - uses the `Accept` request header with the `QuotedQualityCSV` to determine what kind of content to send back to the client (xml, json, text, html, etc)
- `HttpServletRequest.getLocale()` - uses the `Accept-Language` request header with the `QuotedQualityCSV` to determine which “preferred” language is returned on this call.
- `HttpservletRequest.getLocales()` - is similar to the above, but returns an ordered list of locales based on the quality values on the `Accept-Language` request header.
- `DefaultServlet` - uses the `Accept-Encoding` request header with the `QuotedQualityCSV` to determine which kind of pre-compressed content should be sent back for static content (content that is not matched against a url-pattern in your web app)

### Versions
`QuotedQualityCSV` was introduced to Jetty 9.3.9.v20160517 and the bug that introduced the vulnerability was in 9.4.6.v20170531. 

Currently, known vulnerable versions include:

- 9.4.6.v20170531 thru to 9.4.36.v20210114
- 10.0.0
- 11.0.0

### Workarounds

Quality ordered values are used infrequently by jetty so they can be avoided by:

 * Do not use the default error page/handler.
 * Do not deploy the `StatisticsServlet` exposed to the network
 * Do not call `getLocale` API
 * Do not enable precompressed static content in the `DefaultServlet` 

### Patches

All patches are available for download from the Eclipse Jetty website at [https://www.eclipse.org/jetty/download.php](https://www.eclipse.org/jetty/download.php)
- 9.4.37.v20210219 and greater
- 10.0.1 and greater 
- 11.0.1 and greater
Vulnerability: GHSA-x5c7-x7m2-rhmf
Summary: Local directory executable lookup in sops (Windows-only)
Severity: LOW
CVSS score: 0
Published: 2021-05-20T16:50:34Z

### Impact
Windows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe`

This attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using `cmd.exe` or the Windows C library [SearchPath function](https://docs.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-searchpatha). This is a result of these Windows tools including `.` within their `PATH` by default.

**If you are using sops within untrusted directories on Windows via `cmd.exe`, please upgrade immediately** 

**As well, if you have `.` within your default $PATH, please upgrade immediately.**

More information can be found on the official Go blog: https://blog.golang.org/path-security

### Patches
The problem has been resolved in v3.7.1

Now, if Windows users using cmd.exe run into this issue, a warning message will be printed:
`vim resolves to executable in current directory (.\vim.exe)`

### References
* https://blog.golang.org/path-security

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [sops](https://github.com/mozilla/sops/discussions)
Vulnerability: GHSA-5q54-8p9j-x74j
Summary: Cross-site Scripting in pandao editor.md
Aliases: CVE-2019-14517
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-23T00:05:03Z

pandao Editor.md 1.5.0 allows XSS via the Javas&#99;ript: string.
Vulnerability: GHSA-f7xw-46vh-5jw2
Summary: livehelperchat is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4132
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-05T20:33:47Z

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-69gw-hgj3-45m7
Summary: Memory corruption in smallvec
Aliases: CVE-2019-15554
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2021-08-25T20:43:58Z

An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than the current capacity.
Vulnerability: GHSA-gvm7-8fq3-qjj2
Summary: Malicious Package in bs85
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:43:18Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-gx6h-936c-vrrr
Summary: Cross site scripting in registration template in xwiki-platform
Aliases: CVE-2022-23622
Severity: HIGH
CVSS score: 7.4
CWE: CWE-79
Published: 2022-02-09T23:25:44Z

### Impact

We found a possible XSS vector in the `registerinline.vm` template related to the `xredirect` hidden field. 
This template is only used in the following conditions:
  - the wiki must be open to registration for anyone
  - the wiki must be closed to view for Guest users (more specifically the XWiki.Registration page must be forbidden in View for guest user)

A way to obtain the second condition is when administrators checked the "Prevent unregistered users from viewing pages, regardless of the page rights" box in the administration rights.

### Patches

The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3.

### Workarounds

There are two main ways for protecting against this vulnerability, the easiest and the best one is by applying a patch in the `registerinline.vm` template, the patch consists in checking the value of the xredirect field to ensure it matches the following:
```
<input type="hidden" name="xredirect" value="$escapetool.xml($!request.xredirect)" />
```

If for some reason it's not possible to patch this file, another workaround is to ensure "Prevent unregistered users from viewing pages, regardless of the page rights" is not checked in the rights and apply a better right scheme using groups and rights on spaces. 

### References

https://jira.xwiki.org/browse/XWIKI-19291

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-g3r2-65gc-qpqc
Summary: Denial of Service in mqtt-packet
Aliases: CVE-2016-10523
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2019-02-18T23:38:45Z

Versions of `mqtt-packet` prior to 3.4.6, or 4.x prior to 4.0.5 are affected by a denial of service vulnerability wherein specific sequences of MQTT packets can crash the application.




## Recommendation

Version 3.x: Update to version 3.4.6 or later.
Version 4.x: Update to version 4.0.5 or later.
Vulnerability: GHSA-rgcg-28xm-8mmw
Summary: Cross-Site Scripting in Backend Grid View
Aliases: CVE-2021-32669
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2021-07-22T19:37:41Z

### Problem
Failing to properly encode settings for _backend layouts_, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.
Vulnerability: GHSA-8c5p-4362-9333
Summary: Path traversal in grav
Aliases: CVE-2021-3924
Severity: HIGH
CVSS score: 8.8
CWE: CWE-22
Published: 2021-11-10T16:48:15Z

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerability: GHSA-4wv4-mgfq-598v
Summary: Code injection in nobelprizeparser
Severity: CRITICAL
CVSS score: 0
CWE: CWE-94
Published: 2021-03-12T23:00:19Z

Code injection through use of eval.
Vulnerability: GHSA-r82c-j4mq-5xfw
Summary: Update bitlyshortener to >=0.5.0 to prevent generating some invalid short URLs
Severity: HIGH
CVSS score: 0
CWE: CWE-601
Published: 2020-10-27T19:19:56Z

### Impact
Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.5.0 can generate an invalid short URL when a vanity domain exists.

### Patches
Upgrading `bitlyshortener` to 0.5.0 or newer will prevent the generation of any such invalid short URLs.

### References
* [Release notes](https://github.com/impredicative/bitlyshortener/releases)
Vulnerability: GHSA-2w7w-2j92-44hx
Summary: HTTP Request Smuggling in akka-http-core
Aliases: CVE-2021-23339
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-444
Published: 2021-05-10T15:17:09Z

A vulnerable Akka HTTP server will accept a malformed message and hand it over to the user. If the user application proxies this message to another server unchanged and that server also accepts that message but interprets it as two HTTP messages, the second message has reached the second server without having been inspected by the proxy.
Vulnerability: GHSA-h95j-h2rv-qrg4
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2011-4140
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2018-07-23T19:51:19Z

The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
Vulnerability: GHSA-jxcc-g75x-qgw9
Summary: Arbitrary File Write via Archive Extraction (Zip Slip)
Aliases: CVE-2021-23391
Severity: HIGH
CVSS score: 7.3
CWE: CWE-668, CWE-29
Published: 2021-06-08T18:47:18Z

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.
Vulnerability: GHSA-2v88-qq7x-xq5f
Summary: Improper Encoding or Escaping of Output in Asset Metadata Component
Aliases: CVE-2021-39170
Severity: HIGH
CVSS score: 8
CWE: CWE-116, CWE-79
Published: 2021-09-01T18:21:55Z

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.
Vulnerability: GHSA-gcm4-q2pg-xw89
Summary: Moderate severity vulnerability that affects ipycache
Aliases: CVE-2019-7539
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94, CWE-502
Published: 2019-03-25T16:16:55Z

A code injection issue was discovered in ipycache through 2016-05-31.
Vulnerability: GHSA-m4vv-p6fq-jhqp
Summary: Directory Traversal in @vivaxy/here
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T19:04:07Z

The @vivaxy/here module is a small web server that serves files with the process' working directory acting as the web root.

It is vulnerable to a directory traversal attack. 

This means that files on the local file system which exist outside of the web root may be disclosed to an attacker. This might include confidential files.

Mitigating Factors:
If the node process is run as a user with very limited filesystem permissions, there is significantly less risk of exposing confidential/private information.


Proof of Concept:
```
curl "http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd"
```


## Recommendation

Run `npm i @vivaxy/here` to install the latest version that addresses this vulnerability.
Vulnerability: GHSA-5rcv-m4m3-hfh7
Summary: Infinite Loop in Go
Aliases: CVE-2020-14040
Severity: HIGH
CVSS score: 6.7
CWE: CWE-835, CWE-400
Published: 2021-05-18T18:34:35Z

Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
Vulnerability: GHSA-mgg8-9pvp-6qcw
Summary: MvccRwLock allows data races & aliasing violations
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T20:59:59Z

Affected versions of the `noise_search` crate unconditionally implement Send/Sync for `MvccRwLock`.
This can lead to data races when types that are either `!Send` or `!Sync` (e.g. `Rc<T>`, `Arc<Cell<_>>`) are contained inside `MvccRwLock` and sent across thread boundaries. The data races can potentially lead to memory corruption (as demonstrated in the PoC from the original report issue).

Also, safe APIs of `MvccRwLock` allow aliasing violations by allowing `&T` and `LockResult<MutexGuard<Box<T>>>` to co-exist in conflicting lifetime regions. The APIs of `MvccRwLock` should either be marked as `unsafe` or `MbccRwLock` should be changed to private or pub(crate).
Vulnerability: GHSA-pm9v-325f-5g74
Summary: Malicious Package in saync
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:30:11Z

All versions of `saync ` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-h86x-mv66-gr5q
Summary: OS Command Injection in Locutus
Aliases: CVE-2020-13619
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-07-26T21:21:43Z

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
Vulnerability: GHSA-wq7q-5v6j-xfv6
Summary: Command Injection in picotts
Aliases: CVE-2021-23378
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-05-07T16:06:11Z

This affects all versions up to and including version 0.1.1 of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-w4cc-pc2h-whcj
Summary: Out-of-bounds Write in derive-com-impl
Aliases: CVE-2021-45681
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2022-01-06T22:16:10Z

An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
Vulnerability: GHSA-3cf2-x423-x582
Summary: Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman
Aliases: CVE-2021-4024
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-346
Published: 2022-01-06T21:12:50Z

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.
Vulnerability: GHSA-vp9c-fpxx-744v
Summary: Validation bypass vulnerability
Severity: LOW
CVSS score: 0
Published: 2020-09-23T17:19:55Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-v3vf-2r98-xw8w
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-1322
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-200
Published: 2018-11-06T23:17:25Z

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters.
Vulnerability: GHSA-4mg4-wvmx-5332
Summary: Server-Side Request Forgery in Plone
Aliases: CVE-2021-33510
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-918
Published: 2021-06-15T16:11:47Z

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.
Vulnerability: GHSA-w4g2-9hj6-5472
Summary: Moderate severity vulnerability that affects com.rabbitmq:amqp-client and org.springframework.amqp:spring-amqp
Aliases: CVE-2018-11087
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2018-10-18T18:06:08Z

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
Vulnerability: GHSA-hw7r-qrhp-5pff
Summary: Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Severity: MODERATE
CVSS score: 4.3
Published: 2021-08-30T16:16:46Z

Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled `Checkbox` inside enabled `CheckboxGroup` component via unspecified vectors.

- https://vaadin.com/security/cve-2021-33605
Vulnerability: GHSA-p5f8-gfw5-33w4
Summary: Heap buffer overflow in Tensorflow
Aliases: CVE-2020-15201
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-20, CWE-787, CWE-122
Published: 2020-09-25T18:28:34Z

### Impact
The `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the `splits` tensor generate a valid partitioning of the `values` tensor. Hence, this code is prone to heap buffer overflow:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L248-L251

If `split_values` does not end with a value at least `num_values` then the `while` loop condition will trigger a read outside of the bounds of `split_values` once `batch_idx` grows too large. 

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-2cxf-6567-7pp6
Summary: Local Information Disclosure Vulnerability
Aliases: CVE-2021-21331
Severity: LOW
CVSS score: 3
CWE: CWE-379, CWE-378
Published: 2021-03-03T23:01:17Z

### Impact
Local information disclosure of sensitive information downloaded via the API using the API Client. 

### Finding
The Datadog API is executed on a unix-like system with multiple users. The API is used to download a file containing sensitive information. This sensitive information is exposed locally to other users. This vulnerability exists in the API Client for version 1 and 2. The method `prepareDownloadFilecreates` creates a temporary file with the permissions bits of `-rw-r--r--` on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded via the `downloadFileFromResponse` method will be visible to all other users on the local system.

Analysis of the finding determined that the affected code was unused, meaning that the exploitation likelihood is low. The unused code has been removed, effectively mitigating this issue. 

This vulnerability was found due to [this query](https://lgtm.com/query/8938575359870595124/) that [Jonathan Leitschuh](https://github.com/JLLeitschuh) contributed to the Semmle QL project.

### Patches
This issue has been patched in [version 1.0.0-beta.9](https://github.com/DataDog/datadog-api-client-java/releases/tag/datadog-api-client-1.0.0-beta.9). 

See also [Remove unused downloadFile helpers](https://github.com/DataDog/datadog-api-client-java/pull/637). 

### Workarounds
The recommended workaround is to specify `java.io.tmpdir` when starting the JVM with the flag `-Djava.io.tmpdir`, specifying a path to a directory with `drw-------` permissions owned by `dd-agent`.

### References
* [CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)
* [CWE-379: Creation of Temporary File in Directory with Insecure Permissions](https://cwe.mitre.org/data/definitions/379.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [DataDog/datadog-api-client-java](https://github.com/DataDog/datadog-api-client-java)	
* Email us at [security@datadoghq.com](mailto:security@datadoghq.com)
Vulnerability: GHSA-3grc-fgh6-g5gp
Summary: Directory Traversal in http_static_simple
Aliases: CVE-2017-16134
Severity: HIGH
CVSS score: 0
CWE: CWE-12, CWE-22
Published: 2018-07-23T22:08:39Z

Affected versions of `http_static_simple` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-48rw-j489-928m
Summary: Signature wrapping vulnerability in Spring Security
Aliases: CVE-2020-5407
Severity: HIGH
CVSS score: 8.8
CWE: CWE-347
Published: 2020-06-05T16:13:29Z

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.
Vulnerability: GHSA-gvg7-pp82-cff3
Summary: Cross-Site Scripting in c3
Aliases: CVE-2016-1000240
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:59:11Z

Affected versions of `c3` are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips. 



## Recommendation

Update to 0.4.11 or later.
Vulnerability: GHSA-8hxh-r6f7-jf45
Summary: Memory exhaustion in http4s-async-http-client with large or malicious compressed responses
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2020-10-16T17:03:43Z

### Impact
A server we connect to with http4s-async-http-client could theoretically respond with a large or malicious compressed stream and exhaust memory in the client JVM.  It does not affect http4s servers, other client backends, or clients that speak only to trusted servers.  This is related to a transitive dependency on netty-codec-4.1.45.Final, which is affected by [CVE-2020-11612](https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897).

### Patches
Upgrade to http4s-async-http-client >= 0.21.8.  All 1.0 milestones are also safe.

### Workarounds
Add an explicit runtime dependency on async-http-client's netty dependencies that evicts them to an unaffected version:

```scala
libraryDependencies ++= Seq(
  "io.netty" %  "netty-codec"         % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-codec-socks"   % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler-proxy" % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-common"        % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-transport"     % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-handler"       % "4.1.53.Final" % Runtime,
  "io.netty" %  "netty-resolver-dns"  % "4.1.53.Final" % Runtime
)
```

### References
* https://app.snyk.io/vuln/SNYK-JAVA-IONETTY-564897
* https://github.com/http4s/http4s/issues/3681

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http4s](https://github.com/http4s/http4s/issues/new)
* Contact a maintainer privately per [http4s' security policy](https://github.com/http4s/http4s/blob/master/SECURITY.md#reporting-a-vulnerability)
Vulnerability: GHSA-73cw-jxmm-qpgh
Summary: Path Traversal in localhost-now
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-06-11T16:40:48Z

All versions of `localhost-now` are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2

Proof of concept:

```
$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd" 
```


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Vulnerability: GHSA-xhjx-mfr6-9rr4
Summary: Command Injection in samsung-remote
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-01T21:20:28Z

Versions of `samsung-remote` before 1.3.5 are vulnerable to command injection. This vulnerability is exploitable if user input is passed into the `ip` option of the package constructor.


## Recommendation

Update to version 1.3.5 or later.
Vulnerability: GHSA-39q4-p535-c852
Summary: Uncontrolled Resource Consumption in locutus
Aliases: CVE-2021-23392
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-10T17:25:05Z

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
Vulnerability: GHSA-6gw4-x63h-5499
Summary: Ability to switch customer email address on account detail page and stay verified
Aliases: CVE-2020-15245
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862, CWE-79
Published: 2020-10-19T20:40:59Z

### Impact
The user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).

### Patches
Patch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.

### Workarounds
If for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here.

### Acknowledgements

This security issue has been reported by Mircea Silviu (@decemvre), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-856q-xv3c-7f2f
Summary: Unauthenticated control plane denial of service attack in Istio
Aliases: CVE-2022-23635
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2022-02-23T14:59:08Z

### Impact
The Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker.

For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet.

### Patches

- Istio 1.13.1 and above
- Istio 1.12.4 and above
- Istio 1.11.7 and above

### Workarounds
There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2022-003)

### For more information
If you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)
Vulnerability: GHSA-hvqc-pc78-x9wh
Summary: Soundness issue in raw-cpuid
Aliases: CVE-2021-26306
Severity: HIGH
CVSS score: 7.5
CWE: CWE-198
Published: 2021-08-25T20:53:10Z

An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods.