TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-p6j9-7xhc-rhwp
Summary: Hostname spoofing via backslashes in URL
Aliases: CVE-2021-27516
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2021-03-01T20:03:53Z

### Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (`\`) character as part of the scheme delimiter, e.g. `scheme:/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https:/\expected-example.com/path`
Escaped string: `https:/\\expected-example.com/path` (JavaScript strings must escape backslash)

Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches
Version 1.19.6 is patched against all known payload variants.

### References
https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for this particular bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

### Reporter credit
[Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec team at Checkmarx
Vulnerability: GHSA-mq5c-prh3-3f3h
Summary: Invalid validation in `QuantizeAndDequantizeV2`
Aliases: CVE-2021-29610
Severity: LOW
CVSS score: 3.6
CWE: CWE-665
Published: 2021-05-21T14:28:32Z

### Impact
The validation in `tf.raw_ops.QuantizeAndDequantizeV2` allows invalid values for `axis` argument:

```python
import tensorflow as tf

input_tensor = tf.constant([0.0], shape=[1], dtype=float)
input_min = tf.constant(-10.0)
input_max = tf.constant(-10.0)

tf.raw_ops.QuantizeAndDequantizeV2(
  input=input_tensor, input_min=input_min, input_max=input_max,
  signed_input=False, num_bits=1, range_given=False, round_mode='HALF_TO_EVEN',
  narrow_range=False, axis=-2)
``` 

The [validation](https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L74-L77) uses `||` to mix two different conditions:

```cc
OP_REQUIRES(ctx,
  (axis_ == -1 || axis_ < input.shape().dims()),
  errors::InvalidArgument(...));
```

If `axis_ < -1` the condition in `OP_REQUIRES` will still be true, but this value of `axis_` results in heap underflow. This allows attackers to read/write to other data on the heap.

### Patches
We have patched the issue in GitHub commit [c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9](https://github.com/tensorflow/tensorflow/commit/c5b0d5f8ac19888e46ca14b0e27562e7fbbee9a9).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-g4g4-3pqw-8m7f
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45718
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:02:01Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free.
Vulnerability: GHSA-vpch-rxw3-fgx8
Summary: Cross-Site Scripting in @risingstack/protect
Aliases: CVE-2018-1000160
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-04-25T14:30:43Z

All versions of `@risingstack/protect` are vulnerable to Cross-Site Scripting. The  `isXss()` XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package. The package is not actively maintained and will not be patched.
Vulnerability: GHSA-9v62-24cr-58cx
Summary: Denial of Service in node-sass
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2020-09-11T21:12:39Z

Affected versions of `node-sass` are vulnerable to Denial of Service (DoS). Crafted objects passed to the `renderSync` function may trigger C++ assertions in `CustomImporterBridge::get_importer_entry` and `CustomImporterBridge::post_process_return_value` that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.


## Recommendation

Upgrade to version 4.13.1 or later
Vulnerability: GHSA-4mvj-rq4v-2fxw
Summary: Prototype Pollution in x-assign
Aliases: CVE-2021-23452
Severity: HIGH
CVSS score: 8.6
CWE: CWE-1321, CWE-915
Published: 2021-10-21T17:50:44Z

This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.
Vulnerability: GHSA-mf22-92pm-m8p8
Summary: Cross site scripting in @awsui/components-react
Aliases: CVE-2022-24709
Severity: HIGH
CVSS score: 8.8
CWE: CWE-79
Published: 2022-02-25T15:36:47Z

### Impact
Components could potentially allow cross-site scripting (XSS) in certain circumstances. These components could render content without adequate neutralization.

### Patches
Fixed in 3.0.367.
Vulnerability: GHSA-rh5w-82wh-jhr8
Summary: XSS vulnerability on asset view
Aliases: CVE-2021-27912
Severity: HIGH
CVSS score: 7.1
CWE: CWE-79
Published: 2021-09-01T18:40:31Z

### Impact
Mautic versions before 3.3.4 / 4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. 

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-5rrv-m36h-qwf8
Summary: Use-after-free in chttp
Aliases: CVE-2019-16140
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:44:40Z

An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.
Vulnerability: GHSA-5wv5-4vpf-pj6m
Summary: Unexpected memory usage in Pallets Project Flask
Aliases: CVE-2019-1010083
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2019-07-19T16:12:46Z

The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656.
Vulnerability: GHSA-4x5j-v9v9-w8gw
Summary: Downloads Resources over HTTP in httpsync
Aliases: CVE-2016-10614
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:40Z

Affected versions of `httpsync` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `httpsync`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-qpxw-6473-ppww
Summary: Session Fixation in Subrion CMS
Aliases: CVE-2020-12467
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-384
Published: 2021-06-22T15:23:04Z

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
Vulnerability: GHSA-36rh-ggpr-j3gj
Summary: Azure DevOps token leakage in logs
Severity: MODERATE
CVSS score: 0
Published: 2020-09-14T16:38:40Z

### Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the `http.extraheader=AUTHORIZATION` parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

### Patches

Fixed in 23.25.1

### Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@renovatebot.com](mailto:security@renovatebot.com)
Vulnerability: GHSA-h6wf-hvwc-fm77
Summary: Out-of-bounds write
Aliases: CVE-2019-0914
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:02Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-gqf6-75v8-vr26
Summary: Arbitrary File Write in bin-links
Severity: LOW
CVSS score: 0
Published: 2020-09-04T16:56:11Z

Versions of `bin-links` prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended `node_modules` folder through the `bin` field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist.


## Recommendation

Upgrade to version 1.1.5 or later.
Vulnerability: GHSA-jhq3-57xh-6643
Summary: Privilege Escalation due to Blind NoSQL Injection in flintcms
Aliases: CVE-2018-3783
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2018-08-21T17:03:59Z

Versions of `flintcms` before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset.


## Recommendation

Update to version 1.1.10 or later.
Vulnerability: GHSA-9m95-8hx6-7p9v
Summary: Improper input validation in umoci
Aliases: CVE-2021-29136
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2022-02-15T01:17:37Z

### Impact

umoci 0.4.6 and earlier can be tricked into modifying host files by
creating a malicious layer that has a symlink with the name "." (or
"/"). Because umoci deletes inodes if they change types, this results in
the rootfs directory being replaced with an attacker-controlled symlink.
Subsequent image layers will then be applied on top of the target of the
symlink (which could be any directory on the host filesystem the user
running umoci has access to).

While umoci does have defences against symlink-based attacks, they are
all implemented by resolving things relative to the rootfs directory --
if the rootfs itself is a symlink, umoci resolves it first.

This vulnerability affects both "umoci unpack" and "umoci raw unpack".

### Patches
This issue has been patched in umoci 0.4.7, see the references section
for the specific commit which fixed this vulnerability.

### Workarounds
Note that if you use umoci as an unprivileged user (using the --rootless
flag) then umoci will not be able to overwrite any files that your user
doesn't have access to. Other possible mitigations are to run umoci
under an LSM profile such as AppArmor or SELinux to restrict the level
of access it has outside of container image directories.

### References
* [oss-security public disclosure](https://www.openwall.com/lists/oss-security/2021/04/06/2)
* [patch](https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57)

### Credits
Thanks to Robin Peraglie from Cure53 for discovering and reporting this
vulnerability.

### For more information

If you have any questions or comments about this advisory
* Open an issue in <https://github.com/opencontainers/umoci>.
* Email us at <security@opencontainers.org>.
Vulnerability: GHSA-4999-659w-mq36
Summary: Authentication bypass issue in the Operator Console
Aliases: CVE-2021-41266
Severity: HIGH
CVSS score: 8.6
CWE: CWE-306
Published: 2021-11-15T23:16:49Z

During an internal security audit, we detected an authentication bypass issue in the Operator Console when an external IDP is enabled. The security issue has been reported internally. We have not observed this exploit in the wild or reported elsewhere in the community at large. All users are advised to upgrade ASAP.

### Impact

All users on release v0.12.2 and before are affected.

### Patches

This issue was fixed by PR https://github.com/minio/console/pull/1217, users should upgrade to latest release.

### Workarounds

Add `automountServiceAccountToken: false` to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the `CONSOLE_IDP_URL`, `CONSOLE_IDP_CLIENT_ID`, `CONSOLE_IDP_SECRET` and `CONSOLE_IDP_CALLBACK` environment variable and instead use the Kubernetes service account token.

### References

#1217 for more information on the fix and how it was fixed.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [console issues](https://github.com/minio/console/issues)
* Email us at [security@minio.io](mailto:security@minio.io)
Vulnerability: GHSA-r4m5-47cq-6qg8
Summary: Server-Side Request Forgery in ftp-srv
Severity: HIGH
CVSS score: 0
CWE: CWE-918
Published: 2020-09-04T17:25:13Z

All versions of `ftp-srv` are vulnerable to Server-Side Request Forgery (SSRF). The package fails to prevent remote clients to access other resources in the network, for example when connecting to the server through telnet. This allows attackers to access any network resources available to the server, including private resources in the hosting environment.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-q6pj-jh94-5fpr
Summary: OS Command Injection in docker-compose-remote-api
Aliases: CVE-2020-7606
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-07T16:14:39Z

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within &#39;index.js&#39; of the package, the function &#39;exec(serviceName, cmd, fnStdout, fnStderr, fnExit)&#39; uses the variable &#39;serviceName&#39; which can be controlled by users without any sanitization.
Vulnerability: GHSA-3pcr-4982-548m
Summary: Exposure of .env if project root is configured as web root in shopware/production
Severity: MODERATE
CVSS score: 0
CWE: CWE-552
Published: 2021-04-13T15:13:37Z

### Impact

The .env and other sensitive files can be leaked if the project root and not `/public` is configured as the web root.

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

You should always use `/public` as the web root.

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Vulnerability: GHSA-5c8j-xr24-2665
Summary: Potential Command Injection in printer
Aliases: CVE-2014-3741
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2017-11-28T22:44:52Z

Versions 0.0.1 and earlier of `printer` are affected by a command injection vulnerability resulting from a failure to sanitize command arguments properly in the `printDirect()` function. 



## Recommendation

Update to version 0.0.2 or later.
Vulnerability: GHSA-qg48-85hg-mqc5
Summary: Division by 0 in `DenseCountSparseOutput`
Aliases: CVE-2021-29554
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:23:55Z

### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`:

```python
import tensorflow as tf

values = tf.constant([], shape=[0, 0], dtype=tf.int64)
weights = tf.constant([])

tf.raw_ops.DenseCountSparseOutput(
  values=values, weights=weights,
  minlength=-1, maxlength=58, binary_output=True)
```
  
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division:

```cc
int num_batch_elements = 1;
for (int i = 0; i < num_batch_dimensions; ++i) {
  num_batch_elements *= data.shape().dim_size(i);
}
int num_value_elements = data.shape().num_elements() / num_batch_elements;
```

Since `data` is given by the `values` argument, `num_batch_elements` is 0.

### Patches
We have patched the issue in GitHub commit [da5ff2daf618591f64b2b62d9d9803951b945e9f](https://github.com/tensorflow/tensorflow/commit/da5ff2daf618591f64b2b62d9d9803951b945e9f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-5xf4-f2fq-f69j
Summary: Improper link resolution before file access (Link Following)
Aliases: CVE-2019-10773
Severity: HIGH
CVSS score: 7.8
CWE: CWE-78
Published: 2020-02-14T23:10:16Z

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Vulnerability: GHSA-wg6j-r28m-7293
Summary: Code Injection in simple_captcha2
Aliases: CVE-2019-14282
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2019-07-31T04:21:19Z

The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Vulnerability: GHSA-37pw-qw47-4jxm
Summary: Privilege escalation vulnerability in Apache Hadoop
Aliases: CVE-2018-8029
Severity: HIGH
CVSS score: 8.8
CWE: CWE-285
Published: 2019-05-31T16:09:15Z

In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
Vulnerability: GHSA-fvx8-v524-8579
Summary: Cleartext Storage of Sensitive Information
Aliases: CVE-2020-17495
Severity: HIGH
CVSS score: 7.5
CWE: CWE-312
Published: 2021-06-04T21:46:52Z

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
Vulnerability: GHSA-r4x3-g983-9g48
Summary: Moderate severity vulnerability that affects sprockets
Severity: MODERATE
CVSS score: 0
Published: 2018-10-10T17:29:34Z

Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.
Vulnerability: GHSA-wfcc-pff6-rgc5
Summary: Exposure of Sensitive Information in org.eclipse.jetty:jetty-server
Aliases: CVE-2017-9735
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-203
Published: 2018-10-19T16:15:46Z

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.
Vulnerability: GHSA-4363-x42f-xph6
Summary: Malicious Package in hw-trnasport-u2f
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:05:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hf8c-xr89-vfm5
Summary: Command Injection in ungit
Aliases: CVE-2022-25766
Severity: HIGH
CVSS score: 8.8
CWE: CWE-77
Published: 2022-03-22T00:00:41Z

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.
Vulnerability: GHSA-2ccx-2gf3-8xvv
Summary: .dev domains and some reverse proxy setups were treated as local in Kirby
Aliases: CVE-2020-26253
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-346
Published: 2021-01-14T19:15:19Z

### Impact

#### About our registration block

In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. 

In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk.

To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. 

#### The issue

As noted by [Jukka Rautanen](https://github.com/jukra), this installation block implementation in Kirby versions before 3.3.6 still assumed that .dev domains are local domains, which is no longer true. In the meantime, those domains became publicly available. This means that our installation block is no longer working as expected if you use a .dev domain for your Kirby site.

In fixing this issue, we've also found out that the local installation check may also fail if your site is behind a reverse proxy. 

#### Am I affected?

You are only affected if:

1. you use a .dev domain or your site is behind a reverse proxy &
2. you have not yet registered your first Panel account on the public server & 
3. someone finds your site and tries to login at `yourdomain.dev/panel` before you register your first account.

You are not affected if you have already created one or multiple Panel accounts (no matter if on a .dev domain or behind a reverse proxy).

### Patches

The problem has been patched in [Kirby 2.5.14](https://github.com/getkirby-v2/panel/releases/tag/2.5.14) and [Kirby 3.3.6](https://github.com/getkirby/kirby/releases/tag/3.3.6). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

**Note:** Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

### Workarounds

Kirby 2 sites on older releases can also be patched by applying the [changes from this commit](https://github.com/getkirby-v2/panel/commit/7f9ac1876bacb89fd8f142f5e561a02ebb725baa).
Vulnerability: GHSA-vqwg-4v6f-h6x5
Summary: Stored XSS vulnerability in Matrix Project Plugin
Aliases: CVE-2022-20615
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-13T00:01:04Z

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
Vulnerability: GHSA-3rcw-9p9x-582v
Summary: Code injection in `saved_model_cli`
Aliases: CVE-2021-41228
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94, CWE-78
Published: 2021-11-10T16:54:02Z

### Impact
TensorFlow's `saved_model_cli` tool is vulnerable to a code injection as it [calls `eval` on user supplied strings](https://github.com/tensorflow/tensorflow/blob/87462bfac761435a46641ff2f10ad0b6e5414a4b/tensorflow/python/tools/saved_model_cli.py#L524-L550)
  
```python
def preprocess_input_exprs_arg_string(input_exprs_str):
  ... 
  for input_raw in filter(bool, input_exprs_str.split(';')):
    ...
    input_key, expr = input_raw.split('=', 1)
    input_dict[input_key] = eval(expr)
  ...
``` 
  
This can be used by attackers to run arbitrary code on the plaform where the CLI tool runs.

However, given that the tool is always run manually, the impact of this is not severe. We have patched this by adding a `safe` flag which defaults to `True` and an explicit warning for users.

### Patches
We have patched the issue in GitHub commit [8b202f08d52e8206af2bdb2112a62fafbc546ec7](https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Omer Kaspi from Vdoo.
Vulnerability: GHSA-c3hr-wwh3-qm54
Summary: Directory Traversal in fsk-server
Aliases: CVE-2017-16090
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:47:09Z

Affected versions of `fsk-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-p6p8-q4pj-f74m
Summary: Improper Certificate Validation in twitter-stream
Aliases: CVE-2020-24392
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2021-03-29T16:28:42Z

In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).
Vulnerability: GHSA-g78m-2chm-r7qv
Summary: Regular Expression Denial of Service in websocket-extensions (NPM package)
Aliases: CVE-2020-7662
Severity: HIGH
CVSS score: 8.2
CWE: CWE-400
Published: 2020-06-05T16:16:12Z

### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process
incoming requests by sending a WebSocket handshake request containing a header
of the following form:

    Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is
a repeating two-byte sequence of a backslash and some other character. The
parser takes exponential time to reject this header as invalid, and this will
block the processing of any other work on the same thread. Thus if you are
running a single-threaded server, such a request can render your service
completely unavailable.

### Patches

Users should upgrade to version 0.1.4.

### Workarounds

There are no known work-arounds other than disabling any public-facing
WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
Vulnerability: GHSA-xw22-wv29-3299
Summary: ApiKey secret could be revelated on network issue
Aliases: CVE-2021-21421
Severity: HIGH
CVSS score: 8.1
CWE: CWE-200
Published: 2021-04-06T17:29:52Z

### Impact
_What kind of vulnerability is it? Who is impacted?_
Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too

### Patches
_Has the problem been patched? What versions should users upgrade to?_

creharmony/node-etsy-client#18 fixes this issue. This is fixed in [node-etsy-client v0.3.0](https://github.com/creharmony/node-etsy-client/tree/v0.3.0) and later.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not report or log etsy client error if you are using version <= v0.2.0

Update your version of node-etsy-client

### References
_Are there any links users can visit to find out more?_

- https://github.com/creharmony/node-etsy-client/issues/17 : On connect error secret appears in error #17

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/creharmony/node-etsy-client/issues](https://github.com/creharmony/node-etsy-client/issues/)
Vulnerability: GHSA-46f2-3v63-3xrp
Summary: Path traversal in Tempfile on Windows
Aliases: CVE-2021-28966
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-06T15:01:36Z

There is an unintentional directory creation vulnerability in `tmpdir` library bundled with Ruby on Windows. And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby on Windows, because it uses tmpdir internally.
Vulnerability: GHSA-vvmr-8829-6whx
Summary: CSRF token missing in Symfony
Aliases: CVE-2022-23601
Severity: HIGH
CVSS score: 8.1
CWE: CWE-352
Published: 2022-02-01T00:46:57Z

Description
-----------

The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user.
When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled.

In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks.

Resolution
----------

Symfony restored the default configuration to enable the CSRF protection by default.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50) for branch 5.3.

Credits
-------

We would like to thank Catalin Dan and David Lochner for reporting the issue and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-g3p2-hfqr-9m25
Summary: Improper file handling in concrete5/core
Aliases: CVE-2021-22968
Severity: MODERATE
CVSS score: 0
CWE: CWE-98
Published: 2021-11-23T17:54:26Z

A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below. The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration. To fix this, a check for allowed file extensions was added before downloading files to a tmp directory
Vulnerability: GHSA-wvhv-rr3v-vhpj
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0823
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:57:11Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-v9j4-cp63-qv62
Summary: Tarslip in go-unarr
Aliases: CVE-2021-38197
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2021-09-01T18:32:02Z

unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
Vulnerability: GHSA-p7xc-35m8-57pr
Summary: FedMsg not properly completing message validation
Aliases: CVE-2017-1000001
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-07-13T15:17:14Z

FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.
Vulnerability: GHSA-5fw9-fq32-wv5p
Summary: OS Command Injection in node-notifier
Aliases: CVE-2020-7789
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-78
Published: 2020-12-21T16:04:07Z

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
Vulnerability: GHSA-754x-4jwp-cqp6
Summary: Cross-Site Scripting in http_server
Aliases: CVE-2019-15600
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-03-31T17:02:26Z

All versions of `http_server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-cf2j-vf36-c6w8
Summary: Communities and collections administrators can escalate their privilege up to system administrator
Aliases: CVE-2021-41189
Severity: HIGH
CVSS score: 7.2
CWE: CWE-863
Published: 2021-11-01T19:18:16Z

### Impact
Any community or collection administrator can escalate their permission up to become system administrator.

This vulnerability only existed in 7.0 and does not impact 6.x or below.

### Patches
Fix is included in [7.1](https://github.com/DSpace/DSpace/releases/tag/dspace-7.1). Please upgrade to 7.1 at your earliest convenience.

### Workarounds
In 7.0, temporarily disable the ability for community or collection administrators to manage permissions or workflows settings, i.e. set the following properties in your local.cfg / dspace.cfg file
```
core.authorization.collection-admin.policies = false
core.authorization.community-admin.policies = false
core.authorization.community-admin.collection.workflows = false
```
Once upgraded to 7.1, these settings can be safely reverted to the default values of `true`.

### References
Discovered during investigation of https://github.com/DSpace/DSpace/issues/7928

### For more information
If you have any questions or comments about this advisory:
* Email us at security@dspace.org
Vulnerability: GHSA-fvq6-392h-6mjj
Summary: Out-of-bounds Read in OpenCV 
Aliases: CVE-2017-12599
Severity: HIGH
CVSS score: 8.8
CWE: CWE-125
Published: 2021-10-12T22:01:08Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread.
Vulnerability: GHSA-xm9m-2vj8-fmfr
Summary: Uninitialized memory access in toodee
Aliases: CVE-2021-28029
Severity: HIGH
CVSS score: 7.5
CWE: CWE-908
Published: 2021-09-01T18:30:40Z

An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
Vulnerability: GHSA-xv8x-pr4h-73jv
Summary: Memory corruption when returning a literal struct with a private call inside of it
Aliases: CVE-2021-41121
Severity: HIGH
CVSS score: 7.5
CWE: CWE-119
Published: 2021-10-12T15:59:29Z

### Impact

When performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack.

### Patches
0.3.0 / #2447

*
Vulnerability: GHSA-8r98-rqg5-4vm3
Summary: Downloads Resources over HTTP in node-browser
Aliases: CVE-2016-10618
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:56:50Z

Affected versions of `node-browser` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-gwp4-hfv6-p7hw
Summary: Deserialization of untrusted data in FasterXML jackson-databind
Aliases: CVE-2019-14439
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2019-08-01T19:18:06Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Vulnerability: GHSA-26rr-v2j2-25fh
Summary: Layout XML Arbitrary Code Fix 
Aliases: CVE-2021-32758
Severity: HIGH
CVSS score: 0
CWE: CWE-91
Published: 2021-08-30T17:20:52Z

### Impact
Layout XML enabled admin users to execute arbitrary commands via block methods.
Vulnerability: GHSA-rvww-x6m4-4vc2
Summary: Malicious Package in blubird
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:12:39Z

Version 3.5.0 of `blubird` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-6rxj-58jh-436r
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2018-1304
Severity: MODERATE
CVSS score: 5.9
Published: 2018-10-17T16:31:17Z

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.
Vulnerability: GHSA-fm93-fhh2-cg2c
Summary: Prototype Pollution in min-dash
Aliases: CVE-2021-23460
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2022-01-27T14:21:53Z

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
Vulnerability: GHSA-2xwv-3cc9-fp7c
Summary: Sensitive Data Exposure in seneca
Aliases: CVE-2019-5483
Severity: LOW
CVSS score: 0
CWE: CWE-209
Published: 2019-09-11T23:07:57Z

Versions of `seneca` prior to 3.9.0 are vulnerable to Sensitive Data Exposure. When a process using the package crashes all environment variables are printed. This may leak sensitive data such as access keys, especially given scenarios when log-monitoring systems store the error output.


## Recommendation

Upgrade to version 3.9.0 or later.
Vulnerability: GHSA-5w25-hxp5-h8c9
Summary: Improper Verification of Cryptographic Signature
Aliases: CVE-2021-32685
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2021-06-21T17:12:13Z

tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`.
Vulnerability: GHSA-65p8-3hm4-h9h8
Summary: Denial of Service in rgb2hex
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2019-08-23T00:04:48Z

All versions of `rgb2hex` are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value.


## Recommendation

Update to version 0.1.6 or later.
Vulnerability: GHSA-45p7-c959-rgcm
Summary: Process crashes when the cell used as DepGroup is not alive
Severity: CRITICAL
CVSS score: 0
Published: 2021-08-25T21:01:18Z

### Impact

It's easy to create a malign transaction which uses the dead cell as the DepGroup in the DepCells. The transaction can crash all the receiving nodes.
Vulnerability: GHSA-c69w-jj56-834w
Summary: Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Apache Sling Commons Messaging Mail
Aliases: CVE-2021-44549
Severity: HIGH
CVSS score: 7.4
CWE: CWE-297, CWE-295
Published: 2021-12-16T14:12:49Z

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429
Vulnerability: GHSA-xm2v-8rrw-w9pm
Summary: Division by 0 in `Conv2DBackpropInput`
Aliases: CVE-2021-29525
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:21:51Z

### Impact
An attacker can trigger a division by 0 in `tf.raw_ops.Conv2DBackpropInput`:

```python
import tensorflow as tf

input_tensor = tf.constant([52, 1, 1, 5], shape=[4], dtype=tf.int32)
filter_tensor = tf.constant([], shape=[0, 1, 5, 0], dtype=tf.float32)
out_backprop = tf.constant([], shape=[52, 1, 1, 0], dtype=tf.float32)

tf.raw_ops.Conv2DBackpropInput(input_sizes=input_tensor, filter=filter_tensor,
                               out_backprop=out_backprop, strides=[1, 1, 1, 1],
                               use_cudnn_on_gpu=True, padding='SAME',
                               explicit_paddings=[], data_format='NHWC',
                               dilations=[1, 1, 1, 1])
```                 
                    
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/b40060c9f697b044e3107917c797ba052f4506ab/tensorflow/core/kernels/conv_grad_input_ops.h#L625-L655) does a division by a quantity that is controlled by the caller:

```cc 
  const size_t size_A = output_image_size * dims.out_depth; 
  const size_t size_B = filter_total_size * dims.out_depth;
  const size_t size_C = output_image_size * filter_total_size;
  const size_t work_unit_size = size_A + size_B + size_C;
  ...
  const size_t shard_size =
      use_parallel_contraction ? 1 :
      (target_working_set_size + work_unit_size - 1) / work_unit_size;
```

### Patches
We have patched the issue in GitHub commit [2be2cdf3a123e231b16f766aa0e27d56b4606535](https://github.com/tensorflow/tensorflow/commit/2be2cdf3a123e231b16f766aa0e27d56b4606535).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-6q48-vjq2-mwcj
Summary: Command Injection in umount
Aliases: CVE-2020-7628
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-06-10T20:28:03Z

All versions of `umount ` are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `umount` function . This may allow attackers to execute arbitrary code in the system if the `device` value passed to the function is user-controlled.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-p28m-34f6-967q
Summary: High severity vulnerability that affects pyopenssl
Aliases: CVE-2018-1000807
Severity: HIGH
CVSS score: 8.1
CWE: CWE-416
Published: 2018-10-10T16:10:38Z

Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.
Vulnerability: GHSA-8c76-mxv5-w4g8
Summary: Stored Cross-site Scripting in Microweber
Aliases: CVE-2022-0954
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2022-03-16T00:00:48Z

Microweber 1.2.11 and prior contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods.