TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-r2wf-q3x4-hrv9
Summary: Default development error handler in Ratpack is vulnerable to HTML content injection (XSS)
Aliases: CVE-2019-10770
Severity: MODERATE
CWE: CWE-779
Published: 2020-01-27T19:28:20Z

Versions of Ratpack from 0.9.10 through 1.7.5 are vulnerable to [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html) (aka. XSS) in the development error handler. An attacker can utilize this to perform XSS when an exception message contains untrusted data.

As a simplistic example:
```java
RatpackServer startedServer = RatpackServer.start(server -> {
    server.handlers(chain -> chain.all(ctx -> {
        // User supplied query parameter
        String message = ctx.getRequest().getQueryParams().get("message");
        // User supplied data appended to the message in an exception
        throw new RuntimeException("An error occurred: " + message);
    }));
});
```

### Impact

 - Cross-Site Scripting

### Patches

This vulnerability has been patched in Ratpack version 1.7.6.

### Workarounds

If you are unable to update your version of Ratpack, we recommend the following workarounds and mitigations.

 - Ensure that development mode is disabled in production.
 - Don't use real customer data (ie. untrusted user input) in development.

### References

 - [Ratpack development mode](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#development-boolean-)
 - [Code Patch - a3cbb13](https://github.com/ratpack/ratpack/commit/a3cbb13be1527874528c3b99fc33517c0297b6d3)

### For more information

If you have any questions or comments about this advisory:
 - Open an issue in [ratpack/ratpack](https://github.com/ratpack/ratpack/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc)
 - Ask in our [Slack channel](https://slack-signup.ratpack.io/)
Vulnerability: GHSA-43hg-g44q-474q
Summary: Cross Site Scripting (XSS) in XWiki
Aliases: CVE-2021-3137
Severity: MODERATE
CWE: CWE-79
Published: 2021-01-29T18:13:03Z

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
Vulnerability: GHSA-6x4w-8w53-xrvv
Summary: XXE in Apache Standard Taglibs
Aliases: CVE-2015-0254
Severity: HIGH
CWE: CWE-611
Published: 2020-09-14T18:44:01Z

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
Vulnerability: GHSA-2m9w-9xh2-wxc3
Summary: Link Following in Jenkins Pipeline Multibranch Plugin
Aliases: CVE-2022-25179
Severity: MODERATE
CWE: CWE-59
Published: 2022-02-16T00:01:33Z

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier follows symbolic links to locations outside of the checkout directory for the configured SCM when reading files using the readTrusted step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Vulnerability: GHSA-3ccq-5vw3-2p6x
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39149
Severity: HIGH
CWE: CWE-502, CWE-434
Published: 2021-08-25T14:47:28Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39149](https://x-stream.github.io/CVE-2021-39149.html).

### Credits
Lai Han of NSFOCUS security team found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-p6xc-xr62-6r2g
Summary: Improper Input Validation and Uncontrolled Recursion in Apache Log4j2
Aliases: CVE-2021-45105
Severity: HIGH
CWE: CWE-20, CWE-674
Published: 2021-12-18T18:00:07Z

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.


# Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.
Vulnerability: GHSA-r34r-f84j-5x4x
Summary: Moderate severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2017-7678
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:43:08Z

In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
Vulnerability: GHSA-pr38-qpxm-g88x
Summary: Uncontrolled Resource Consumption in Apache ActiveMQ Artemis
Aliases: CVE-2022-23913
Severity: HIGH
CWE: CWE-400
Published: 2022-02-06T00:00:55Z

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
Vulnerability: GHSA-5xqr-grq4-qwgx
Summary: Moderate severity vulnerability that affects com.github.junrar:junrar
Aliases: CVE-2018-12418
Severity: MODERATE
CWE: CWE-835
Published: 2018-10-17T00:04:05Z

Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.
Vulnerability: GHSA-xx65-cc7g-9pfp
Summary: Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Aliases: CVE-2018-1196
Severity: MODERATE
CWE: CWE-59
Published: 2018-10-18T18:05:57Z

Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which allows the "run_user" to overwrite and take ownership of any file on the same system. In order to instigate the attack, the application must be installed as a service and the "run_user" requires shell access to the server. Spring Boot application that are not installed as a service, or are not using the embedded launch script are not susceptible.
Vulnerability: GHSA-q25j-gcmv-5qpp
Summary: Moderate severity vulnerability that affects org.grails.plugins:fields and org.grails:grails-core
Aliases: CVE-2018-1000529
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-19T16:46:01Z

Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.
Vulnerability: GHSA-ghcq-472w-vf4h
Summary: Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
Aliases: CVE-2022-24821
Severity: MODERATE
CWE: CWE-648
Published: 2022-04-08T21:59:04Z

### Impact

Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. 

### Patches
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. 

### Workarounds
There's no easy workaround for this issue, administrators should upgrade their wiki.

### References
https://jira.xwiki.org/browse/XWIKI-19155

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-c2q3-4qrh-fm48
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14061
Severity: HIGH
CWE: CWE-502
Published: 2020-06-18T14:44:50Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
Vulnerability: GHSA-792r-mh2q-p8qp
Summary: Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server
Aliases: CVE-2021-26715
Severity: HIGH
CWE: CWE-918
Published: 2021-05-13T22:30:52Z

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.
Vulnerability: GHSA-6jq2-789q-fff2
Summary: High severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-11761
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T15:49:36Z

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Vulnerability: GHSA-9gcm-f4x3-8jpw
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-11039
Severity: MODERATE
Published: 2018-10-16T17:35:54Z

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Vulnerability: GHSA-c4r5-xvgw-2942
Summary: Metrics exposure in Wildfly
Aliases: CVE-2021-3503
Severity: MODERATE
CWE: CWE-200
Published: 2022-04-19T00:00:50Z

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.
Vulnerability: GHSA-4c32-xmgj-2g98
Summary: High severity vulnerability that affects org.apache.pdfbox:pdfbox
Aliases: CVE-2016-2175
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T18:22:15Z

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Vulnerability: GHSA-8q89-pwhh-7wfq
Summary: Moderate severity vulnerability that affects com.github.penggle:kaptcha
Aliases: CVE-2018-18531
Severity: CRITICAL
CWE: CWE-330
Published: 2018-10-23T16:08:56Z

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach.
Vulnerability: GHSA-2m7g-9q74-9m3q
Summary: Improper Certificate Validation in Apache Beam
Aliases: CVE-2020-1929
Severity: HIGH
CWE: CWE-295
Published: 2020-05-06T20:49:04Z

The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.
Vulnerability: GHSA-gww7-p5w4-wrfv
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2019-20330
Severity: CRITICAL
CWE: CWE-502
Published: 2020-03-04T20:52:11Z

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
Vulnerability: GHSA-qvxv-pmq9-4q7g
Summary: High severity vulnerability that affects org.scala-lang:scala-compiler
Aliases: CVE-2017-15288
Severity: HIGH
CWE: CWE-732
Published: 2018-10-19T16:51:11Z

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
Vulnerability: GHSA-cfh5-3ghh-wfjx
Summary: Moderate severity vulnerability that affects org.apache.httpcomponents:httpclient
Aliases: CVE-2014-3577
Severity: MODERATE
CWE: CWE-347
Published: 2018-10-17T00:05:06Z

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Vulnerability: GHSA-mx9v-gmh4-mgqw
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-19361
Severity: CRITICAL
CWE: CWE-502
Published: 2019-01-04T19:07:01Z

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Vulnerability: GHSA-p63h-7hw8-5cw4
Summary: Cross-Site Request Forgery in OpenNMS Horizon
Aliases: CVE-2021-25930
Severity: MODERATE
CWE: CWE-352
Published: 2021-05-25T18:46:49Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.
Vulnerability: GHSA-3rx2-x6mx-grj3
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-10089
Severity: MODERATE
CWE: CWE-79
Published: 2019-10-11T18:41:54Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-w9mp-p2wp-2xf7
Summary: Improper file downloads in Apache Tapestry
Aliases: CVE-2020-13953
Severity: MODERATE
CWE: CWE-552
Published: 2022-02-10T20:35:42Z

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Vulnerability: GHSA-9gp7-jvm2-r4mx
Summary: Moderate severity vulnerability that affects org.apache.struts:struts2-core
Aliases: CVE-2017-7672
Severity: MODERATE
CWE: CWE-20
Published: 2018-10-16T19:36:43Z

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
Vulnerability: GHSA-j39c-c8hj-x4j3
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Aliases: CVE-2021-25122
Severity: HIGH
CWE: CWE-200
Published: 2021-06-16T17:45:29Z

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Vulnerability: GHSA-p9w3-gwc2-cr49
Summary: HTTP Request Smuggling in Undertow
Aliases: CVE-2020-10687
Severity: MODERATE
CWE: CWE-444
Published: 2021-04-30T17:28:52Z

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
Vulnerability: GHSA-9jq9-c2cv-pcrj
Summary: Cross-site Scripting by SVG upload in xwiki-platform
Aliases: CVE-2021-43841
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T22:42:48Z

### Impact
When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. 

### Patches
This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser.

### Workarounds
This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload

### References
https://jira.xwiki.org/browse/XWIKI-18368

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-9mgm-gcq8-86wq
Summary: Improper Authentication in Apache ActiveMQ and Apache Artemis
Aliases: CVE-2021-26117
Severity: HIGH
CWE: CWE-287
Published: 2021-06-16T17:39:35Z

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Vulnerability: GHSA-4p6w-m9wc-c9c9
Summary: Sensitive Data Exposure in Apache Ant
Aliases: CVE-2020-1945
Severity: MODERATE
CWE: CWE-668, CWE-200
Published: 2020-09-14T18:13:29Z

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
Vulnerability: GHSA-55w9-c3g2-4rrh
Summary: Man-in-the-middle attack in Apache Axis
Aliases: CVE-2012-5784
Severity: MODERATE
CWE: CWE-20
Published: 2020-10-07T17:51:02Z

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerability: GHSA-6xp6-fmc8-pmmr
Summary: Temporary Directory Hijacking Vulnerability in Keycloak
Aliases: CVE-2021-20202
Severity: HIGH
CWE: CWE-377
Published: 2022-03-18T17:50:45Z

A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.
Vulnerability: GHSA-gv3v-92v6-m48j
Summary: Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)
Aliases: CVE-2020-7622
Severity: CRITICAL
CWE: CWE-444
Published: 2020-04-03T15:23:30Z

### Impact

 - Cross Site Scripting
 - Cache Poisoning
 - Page Hijacking

### Patches

This was fixed in version `2.2.1`.

### Workarounds

If you are unable to update, ensure that user supplied data isn't able to flow to HTTP headers. If it does, pre-sanitize for CRLF characters.

### References

##### [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)

I've been poking at libraries to see if they are vulnerable to HTTP Response Splitting and Jooby is my third case of finding this vulnerability.

### Root Cause

This roots cause back to this line in the Jooby codebase:

https://github.com/jooby-project/jooby/blob/93cfc80aa20c188f71a442ea7a1827da380e1c27/modules/jooby-netty/src/main/java/io/jooby/internal/netty/NettyContext.java#L102

The `DefaultHttpHeaders` takes a parameter `validate` which, when `true` (as it is for the no-arg constructor) validates that the header isn't being abused to do HTTP Response Splitting.

### Reported By

This vulnerability was reported by @JLLeitschuh ([Twitter](https://twitter.com/JLLeitschuh))

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jooby-project/jooby](https://github.com/jooby-project/jooby/issues)
Vulnerability: GHSA-mgh8-hcwj-h57v
Summary: Improper Restriction of XML External Entity Reference in Apache Olingo
Aliases: CVE-2019-17554
Severity: MODERATE
CWE: CWE-611
Published: 2020-02-04T22:37:43Z

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.
Vulnerability: GHSA-7v35-qwwj-p98g
Summary: Improper Restriction of XML External Entity Reference in DiffPlug Spotless
Aliases: CVE-2019-9843
Severity: HIGH
CWE: CWE-611
Published: 2019-07-05T21:07:40Z

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Vulnerability: GHSA-59g4-hpg3-3gcp
Summary: Files Accessible to External Parties in Opencast
Aliases: CVE-2021-43821
Severity: CRITICAL
CWE: CWE-552
Published: 2021-12-14T21:44:03Z

Opencast before version 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface.

### Impact

Before Opencast 10.6, Opencast would [open and include local files during ingests](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587). Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine.

For example, to expose the `custom.properties` of develop.opencast.org via the asset manager, an attacker could have run:

```
curl -f -i -u admin:opencast \
  https://develop.opencast.org/ingest/addMediaPackage/fast \
  -F 'flavor=presenter/source'\
  -F mediaUri=file:///srv/opencast/opencast-dist-allinone/etc/custom.properties\
  -F title="custom.properties"  
```

An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given.


### Patches

The issue has been fixed in Opencast 10.6 and 11.0.

### Workarounds

You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.

### References

-  [Example of problematic code](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587).
- [Patch fixing the issue](https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
Vulnerability: GHSA-535v-4x9q-446c
Summary: Moderate severity vulnerability that affects org.apache.hbase:hbase
Aliases: CVE-2019-0212
Severity: HIGH
CWE: CWE-285
Published: 2019-04-02T15:47:00Z

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
Vulnerability: GHSA-c9h6-xhg9-xxrv
Summary: Low severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
Aliases: CVE-2019-0200
Severity: HIGH
CWE: CWE-20
Published: 2019-03-07T18:48:08Z

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
Vulnerability: GHSA-p9m8-27x8-rg87
Summary: Critical vulnerability found in cron-utils
Aliases: CVE-2021-41269
Severity: CRITICAL
CWE: CWE-94
Published: 2021-11-15T23:27:11Z

### Impact
A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

### Patches
The issue was patched and a new version was released. Please upgrade to version 9.1.6.

### Workarounds
There are no known workarounds up to this moment.

### References
A description of the issue is provided in [issue 461](https://github.com/jmrozanec/cron-utils/issues/461)

### For more information
If you have any questions or comments about this advisory:

Open an issue in the [cron-utils Github repository](https://github.com/jmrozanec/cron-utils)
Vulnerability: GHSA-f6pc-crhh-cp96
Summary: Privilege escalation in Presto
Aliases: CVE-2020-15087
Severity: HIGH
CWE: CWE-285
Published: 2020-06-30T16:33:23Z

### Affected
This affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver.

### Impact
Authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured.

This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure.

### Patches
This issue has been fixed starting with PrestoSQL version 337.

### Workarounds
This issue can be mitigated by blocking network access to internal APIs on the coordinator and workers. 

### References
See the Presto documentation for [Secure Internal Communication](https://trino.io/docs/current/security/internal-communication.html).

### For more information
If you have any questions or comments about this advisory:
* Join the **#security** channel on [Slack](https://trino.io/slack.html).
* Contact the security team at [security@trino.io](mailto:security@trino.io).
Vulnerability: GHSA-77rv-6vfw-x4gc
Summary: Critical severity vulnerability that affects org.springframework.security.oauth:spring-security-oauth and org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2019-3778
Severity: CRITICAL
CWE: CWE-601
Published: 2019-03-14T15:39:30Z

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.

A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. 

This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Vulnerability: GHSA-2h63-qp69-fwvw
Summary: Server-side request forgery (SSRF) in Apache Batik
Aliases: CVE-2020-11987
Severity: HIGH
CWE: CWE-20, CWE-918
Published: 2022-01-06T20:35:54Z

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Vulnerability: GHSA-jpcm-4485-69p7
Summary: Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
Aliases: CVE-2021-21361
Severity: HIGH
CWE: CWE-532
Published: 2021-03-09T00:38:41Z

### Impact

The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.

When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.

### Patches
Fixed in version 3.0.0

### References

 - https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44
 - https://github.com/bmuschko/gradle-vagrant-plugin/issues/19
 - https://github.com/bmuschko/gradle-vagrant-plugin/pull/20

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [bmuschko/gradle-vagrant-plugin](https://github.com/bmuschko/gradle-vagrant-plugin)
Vulnerability: GHSA-rvgg-f8qm-6h7j
Summary: High severity vulnerability that affects io.vertx:vertx-web
Aliases: CVE-2018-12540
Severity: HIGH
CWE: CWE-352
Published: 2018-10-17T16:19:43Z

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.
Vulnerability: GHSA-94g7-hpv8-h9qm
Summary: Remote code injection in Log4j
Severity: CRITICAL
Published: 2021-12-14T21:46:35Z

### Impact
Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.

More Details:
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### Patches
Version 1.11.1 of the Splunk Logging for Java library.

There is also a backport to version 1.6.2 released as a patch: 1.6.2-0-0.

### Workarounds
If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/splunk/splunk-library-javalogging/issues
* Email us at [devinfo@splunk.com](mailto:devinfo@splunk.com)
Vulnerability: GHSA-qxf4-chvg-4r8r
Summary: Potential HTTP request smuggling in Apache Tomcat
Aliases: CVE-2020-1935
Severity: MODERATE
CWE: CWE-444
Published: 2020-02-28T01:10:48Z

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Vulnerability: GHSA-89r3-rcpj-h7w6
Summary: Path traversal attack on Windows platforms
Aliases: CVE-2019-0207
Severity: HIGH
CWE: CWE-22
Published: 2019-11-18T17:19:03Z

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.
Vulnerability: GHSA-jpv3-g4cc-6vfx
Summary: Moderate severity vulnerability that affects org.apache.activemq:activemq-client
Aliases: CVE-2019-0222
Severity: HIGH
CWE: CWE-94
Published: 2019-04-02T15:46:42Z

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
Vulnerability: GHSA-fmr4-w67p-vh8x
Summary: Moderate severity vulnerability that affects org.wildfly:wildfly-undertow
Aliases: CVE-2018-1047
Severity: MODERATE
CWE: CWE-20
Published: 2018-10-19T16:55:35Z

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
Vulnerability: GHSA-q76j-58cx-wp5v
Summary: Vulnerability in RPKI manifest validation
Severity: HIGH
CWE: CWE-20
Published: 2020-11-13T17:28:49Z


A vulnerability in RPKI manifest validation exists when objects on the manifest are hidden, or expired objects are replayed. An attacker successfully exploiting this vulnerability could prevent new ROAs from being received or selectively hide ROAs, causing routes to become INVALID.

To exploit this vulnerability, an attacker would need to perform a man in the middle attack on the TLS connection between the validator and an RRDP repository or perform a man in the middle attack against a rsync-only repository.

The update addresses the vulnerability by implementing validation methods from [RFC 6486bis](https://datatracker.ietf.org/doc/draft-ietf-sidrops-6486bis/00/) and enabling strict validation by default.
Vulnerability: GHSA-3pqg-4rqg-pg9g
Summary: Cross-site Scripting in OWASP AntiSamy
Aliases: CVE-2022-28367
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-23T00:03:04Z

OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Vulnerability: GHSA-c6c4-7x48-4cqp
Summary: Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Severity: MODERATE
CWE: CWE-208
Published: 2021-04-19T14:47:47Z

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

- https://vaadin.com/security/cve-2021-31404
Vulnerability: GHSA-qf76-pr7x-h7r4
Summary: Incorrect Access Control in Nacos
Aliases: CVE-2020-19676
Severity: MODERATE
CWE: CWE-200
Published: 2021-08-02T16:38:01Z

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)
Vulnerability: GHSA-7qfm-6m33-rgg9
Summary: XML External Entity Reference
Severity: HIGH
CWE: CWE-611
Published: 2021-08-13T15:21:59Z

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
Vulnerability: GHSA-m8p2-495h-ccmh
Summary: The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
Aliases: CVE-2019-10219
Severity: MODERATE
CWE: CWE-79
Published: 2020-01-08T17:01:52Z

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
Vulnerability: GHSA-85f9-w9cx-h363
Summary: Cross site request forgery in Jenkins Job and Node ownership Plugin
Aliases: CVE-2022-28150
Severity: HIGH
CWE: CWE-352
Published: 2022-03-30T00:00:23Z

Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints. This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Vulnerability: GHSA-gw55-jm4h-x339
Summary: Improper Validation of Certificate with Host Mismatch in Java-WebSocket
Aliases: CVE-2020-11050
Severity: HIGH
CWE: CWE-295, CWE-297
Published: 2020-05-08T18:54:39Z

The Java-WebSocket Client does not perform hostname verification.

 - This means that SSL certificates of other hosts are accepted as long as they are trusted. To exploit this vulnerability an attacker has to perform a man-in-the-middle (MITM) attack between a Java application using the Java-WebSocket Client and an WebSocket server it's connecting to.
 - TLS normally protects users and systems against MITM attacks, it cannot if certificates from other trusted hosts are accepted by the client.

For more information see: CWE-297: Improper Validation of Certificate with Host Mismatch - https://cwe.mitre.org/data/definitions/297.html

## Important note

The OWASP Dependency-Check (https://jeremylong.github.io/DependencyCheck/index.html) may report that a dependency of your project is affected by this security vulnerability, but you don't use this lib.
This is caused by the fuzzy search in the OWASP implementation.
Check out this issue (https://github.com/TooTallNate/Java-WebSocket/issues/1019#issuecomment-628507934) for more information and a way to suppress the warning.
Vulnerability: GHSA-fh63-4r66-jc7v
Summary: Cross-site scripting (XSS) in Apache Velocity Tools
Aliases: CVE-2020-13959
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-12T20:24:22Z

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.
Vulnerability: GHSA-m6x4-97wx-4q27
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36184
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:26Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
Vulnerability: GHSA-4vww-mc66-62m6
Summary: HTTP Request Smuggling in Apache Tomcat
Aliases: CVE-2021-33037
Severity: MODERATE
CWE: CWE-444
Published: 2021-08-13T15:21:14Z

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
Vulnerability: GHSA-2cc5-23r7-vc4v
Summary: Default client side session signing key is highly predictable
Aliases: CVE-2021-29480
Severity: MODERATE
CWE: CWE-330, CWE-340
Published: 2021-07-01T17:02:26Z

### Impact

The client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used (which is recommended, but is not on by default), the session data could be tampered with by someone with the ability to write cookies. 

The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible, but its use is not actively prevented.

### Vulnerability Location

https://github.com/ratpack/ratpack/blob/29434f7ac6fd4b36a4495429b70f4c8163100332/ratpack-session/src/main/java/ratpack/session/clientside/ClientSideSessionConfig.java#L29

### Patches

As of Ratpack 1.9.0 the default value is a securely randomly generated value, generated at application startup time. 

### Workarounds

Supply an alternative signing key, as per the documentation's recommendation.
Vulnerability: GHSA-36p3-wjmg-h94x
Summary: Remote Code Execution in Spring Framework
Aliases: CVE-2022-22965
Severity: CRITICAL
CWE: CWE-74
Published: 2022-03-31T18:30:50Z

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`. 

## Impact

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit:
- JDK 9 or higher
- Apache Tomcat as the Servlet container
- Packaged as WAR
- `spring-webmvc` or `spring-webflux` dependency

## Patches

- Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE)
- Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12)

## Workarounds

For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting.

To apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux).
Vulnerability: GHSA-hw3m-8h25-8frw
Summary: Command Injection in Apache Kylin
Aliases: CVE-2021-45456
Severity: MODERATE
CWE: CWE-77
Published: 2022-01-08T00:42:59Z

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
Vulnerability: GHSA-r8rm-4hfj-2x87
Summary: Data Amplification in Play Framework
Aliases: CVE-2020-26882
Severity: HIGH
CWE: CWE-674
Published: 2022-02-10T20:23:28Z

In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
Vulnerability: GHSA-52rg-hpwq-qp56
Summary: Allocation of Resources Without Limits or Throttling in Keycloak
Aliases: CVE-2020-10758
Severity: HIGH
CWE: CWE-770
Published: 2022-02-09T00:56:51Z

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.
Vulnerability: GHSA-2qrg-x229-3v8q
Summary: Deserialization of Untrusted Data in Log4j
Aliases: CVE-2019-17571
Severity: CRITICAL
CWE: CWE-502
Published: 2020-01-06T18:43:49Z

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Users are advised to migrate to `org.apache.logging.log4j:log4j-core`
Vulnerability: GHSA-8vfw-v2jv-9hwc
Summary: Reflected cross-site scripting in development mode handler in Vaadin
Severity: LOW
CWE: CWE-172
Published: 2021-06-28T16:52:45Z

URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

- https://vaadin.com/security/cve-2021-33604