TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-pvh2-pj76-4m96
Summary: Specification non-compliance in JUMPI
Aliases: CVE-2021-41153
Severity: HIGH
CVSS score: 8.7
CWE: CWE-670
Published: 2021-10-19T15:28:35Z

### Impact 

In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check.

### Patches

This is a **high** severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`.

This is a **low** severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is **not** recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.

### Workarounds

If you are dependent on an older version of `evm` and cannot update due to API interface changes, please contact Wei by email (wei@that.world), who will be happy to help you to publish patch releases for older `evm` versions.

### References

Fix PR: https://github.com/rust-blockchain/evm/pull/67

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the `evm` repo.

### Special thanks

Special thanks to @rakita for reporting this issue.
Vulnerability: GHSA-73q9-7pwj-gm46
Summary: icecoder is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3862
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-21T23:46:12Z

icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-vrxj-4qhw-5vwq
Summary: Malicious Package in scryptys
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:03:41Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-mm9x-g8pc-w292
Summary: Denial of Service in Netty
Aliases: CVE-2020-11612
Severity: HIGH
CVSS score: 7.5
CWE: CWE-119, CWE-400, CWE-770
Published: 2020-06-15T19:36:16Z

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Vulnerability: GHSA-3v43-877x-qgmq
Summary: Moderate severity vulnerability that affects league/commonmark
Aliases: CVE-2019-10010
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-09-17T22:47:47Z

## CVE-2019-10010

### Impact

In `league/commonmark` 0.18.2 and below, malicious users can insert double-encoded HTML entities into their Markdown like this:

```md
[XSS](javascript&amp;colon;alert%28&#039;XSS&#039;%29)
```

This library would (correctly) unescape the `&amp;` entity to `&` during the parsing step.  However, **the renderer step would fail to properly re-escape the resulting `&colon;` string**, thus producing the following malicious HTML output:

```html
<p><a href="javascript&colon;alert('XSS')">XSS</a></p>
```

Browsers would interpret `&colon;` as a `:` character and allow the JS to be executed when the link is clicked.

This vulnerability was present in the upstream library this project was forked from and therefore exists in all prior versions of `league/commonmark`.

### Solution

The new [0.18.3](https://github.com/thephpleague/commonmark/releases/tag/0.18.3) release mirrors [the fix made upstream](https://github.com/commonmark/commonmark.js/commit/c89b35c5fc99bdf1d2181f7f0c9fcb8a1abc27c8) - we no longer attempt to preserve entities when rendering HTML attributes like `href`, `src`, `title`, etc.

The `$preserveEntities` parameter of `Xml::escape()` is therefore no longer used internally, so it has been deprecated and marked for removal in the next major release (0.19.0).

### Credits

 - Mohit Fawaz for identifying the issue
 - Sebastiaan Knijnenburg and Ross Tuck for responsibly disclosing/relaying the issue
 - John MacFarlane for investigating it and implementing the upstream fix we mirrored here

### References

 - https://nvd.nist.gov/vuln/detail/CVE-2019-10010
 - https://github.com/thephpleague/commonmark/releases/tag/0.18.3
 - https://github.com/thephpleague/commonmark/issues/353
- https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2019-10010.yaml
Vulnerability: GHSA-77vh-xpmg-72qh
Summary: Clarify `mediaType` handling
Severity: LOW
CVSS score: 3
CWE: CWE-843
Published: 2021-11-18T16:02:41Z

### Impact
In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index.

### Patches
The Image Specification will be updated to recommend that both manifest and index documents contain a `mediaType` field to identify the type of document.
Release [v1.0.2](https://github.com/opencontainers/image-spec/releases/tag/v1.0.2) includes these updates.

### Workarounds
Software attempting to deserialize an ambiguous document may reject the document if it contains both “manifests” and “layers” fields or “manifests” and “config” fields.

### References
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/opencontainers/image-spec
* Email us at [security@opencontainers.org](mailto:security@opencontainers.org)
* https://github.com/opencontainers/image-spec/commits/v1.0.2
Vulnerability: GHSA-4wp3-8q92-mh8w
Summary: Cross Site Request Forgery in Gitea
Aliases: CVE-2021-45326
Severity: HIGH
CVSS score: 0
CWE: CWE-352
Published: 2022-02-09T00:00:29Z

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state altering POST requests.
Vulnerability: GHSA-84cm-x2q5-8225
Summary: Critical severity vulnerability that affects dojox
Aliases: CVE-2018-15494
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-116
Published: 2018-10-15T22:03:48Z

In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
Vulnerability: GHSA-qxx8-292g-2w66
Summary: Improper Authentication
Severity: HIGH
CVSS score: 0
CWE: CWE-287
Published: 2021-03-08T15:50:01Z

### Impact
A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot.

### Patches
The problem has been patched in all affected versions. Please see the list of patched versions for the most appropriate one for your individual case.

### Workarounds
Users who do not wish or are not able to upgrade can add an authentication configuration containing ClaimsValidator which throws an exception if the Claims are Skill Claims.

For detailed instructions, see the link in the References section.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Microsoft Bot Builder SDK](https://github.com/microsoft/botbuilder-dotnet)
* Email us at [bf-reports@microsoft.com](mailto:bf-reports@microsoft.com)
Vulnerability: GHSA-2r9c-46v3-43fc
Summary: Downloads Resources over HTTP in haxe3
Aliases: CVE-2016-10688
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-08-17T20:28:13Z

Affected versions of `haxe3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe3`.


## Recommendation

No patch is currently available for this vulnerability. This vulnerability has been left unpatched for several years, despite active maintenance on the package. Because of this, it appears that the package author has accepted the risk, and is unlikely to patch this package in the future.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-vf26-7gjf-f92r
Summary: OS Command Injection in rpi
Aliases: CVE-2019-10796
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:23:29Z

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.
Vulnerability: GHSA-9q5w-79cv-947m
Summary: Unsafe defaults in `remark-html`
Aliases: CVE-2021-39199
Severity: CRITICAL
CVSS score: 10
CWE: CWE-79
Published: 2021-09-07T23:10:56Z

### Impact

The documentation of `remark-html` has mentioned that it was safe by default. In practise the default was never safe and had to be opted into. This means arbitrary HTML can be passed through leading to potential XSS attacks.

### Patches

The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation.

### Workarounds

On older affected versions, pass `sanitize: true`, like so:

```diff
-  .use(remarkHtml)
+  .use(remarkHtml, {sanitize: true})
```

### References

n/a

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [`remark-html`](https://github.com/remarkjs/remark-html)
* Email us at [security@unifiedjs.com](mailto:security@unifiedjs.com)
Vulnerability: GHSA-wjw6-2cqr-j4qr
Summary: Client metadata path-traversal
Aliases: CVE-2021-41131
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-10-19T20:14:36Z

### Impact
In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`).

The impact is mitigated by a few facts:
* It only affects implementations that allow arbitrary rolename selection for delegated targets metadata
* The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata
* The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json.

### Patches
A fix is available in version 0.19 or newer.

### Workarounds
None that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.

### References
- [The issue where this was discovered](https://github.com/theupdateframework/python-tuf/issues/1527)
- [Proof of Concept demonstrating the flaw](https://github.com/jku/path-traversal-poc)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [python-tuf](https://github.com/theupdateframework/python-tuf/issues)
* Contact the maintainers by email or Slack
Vulnerability: GHSA-8p5p-ff7x-hw7q
Summary: Cross-Site Scripting in public
Aliases: CVE-2018-3747
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-10T17:27:58Z

Versions of `public` prior to 0.1.4 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

Upgrade to version 0.1.4 or later.
Vulnerability: GHSA-8j34-9876-pvfq
Summary: Hugo can execute a binary from the current directory on Windows
Aliases: CVE-2020-26284
Severity: HIGH
CVSS score: 7.7
CWE: CWE-78
Published: 2021-06-23T17:28:26Z

## Impact

Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. However, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one.

Windows users who run `hugo` inside untrusted Hugo sites are affected.

## Patches
Users should upgrade to Hugo v0.79.1.
Vulnerability: GHSA-ffw3-6mp6-jmvj
Summary: Improper Access Control in Airflow
Aliases: CVE-2021-26559
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-284, CWE-269
Published: 2021-04-07T21:05:57Z

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Vulnerability: GHSA-vhxc-fhm5-qcp9
Summary: Prototype Pollution in bodymen
Aliases: CVE-2022-25296
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)
Vulnerability: GHSA-jm56-5h66-w453
Summary: Repository index file allows for duplicates of the same chart entry in helm
Aliases: CVE-2020-15185
Severity: LOW
CVSS score: 2.2
CWE: CWE-74, CWE-20, CWE-694
Published: 2021-05-24T16:57:06Z

### Impact

During a security audit of Helm's code base, security researchers at Trail of Bits identified a bug in which the a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository.

To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection).

### Patches

This issue has been patched in Helm 3.3.2 and 2.16.11

### Workarounds

- do not install charts from repositories you do not trust
- fetch charts using a secure channel of communication (such as TLS)
- use `helm pull` to fetch the chart, then review the chart’s content (either manually, or with `helm verify` if it has been signed) to ensure it has not been tampered with
- manually review the index file in the Helm repository cache before installing software.
Vulnerability: GHSA-r6j9-8759-g62w
Summary: Improper Restriction of XML External Entity Reference in jackson-mapper-asl
Aliases: CVE-2019-10172
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2020-02-04T22:39:19Z

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar to CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Vulnerability: GHSA-mvch-rh6h-2m47
Summary: Malicious Package in equest
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:10:29Z

All versions of `equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-gc79-gh4f-9g6w
Summary: Server Side Template Injection in MCMS
Aliases: CVE-2021-46063
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-74
Published: 2022-02-19T00:01:24Z

MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
Vulnerability: GHSA-cccf-7xw3-p2vr
Summary: HTTP Request Smuggling in Undertow
Aliases: CVE-2020-10719
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-444
Published: 2021-04-30T17:28:33Z

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
Vulnerability: GHSA-38j9-7pp9-2hjw
Summary: Invalid session token expiration 
Aliases: CVE-2021-32923
Severity: HIGH
CVSS score: 7.4
CWE: CWE-613
Published: 2021-06-08T18:52:05Z

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
Vulnerability: GHSA-p7v4-gm6j-cw9m
Summary: XSS in Mautic
Aliases: CVE-2021-3142
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2021-01-29T20:51:20Z

### Impact
This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed.

This vulnerability was reported by Dardan Prebreza at Bishop Fox.

### Patches
Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

### Workarounds
None

### References
https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4

### For more information
If you have any questions or comments about this advisory:
* Post in https://forum.mautic.org/c/support
* Email us at security@mautic.org
Vulnerability: GHSA-h79p-32mx-fjj9
Summary: Apache Camel Netty enables Java deserialization by default
Aliases: CVE-2020-11973
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2020-05-21T21:09:04Z

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Vulnerability: GHSA-wjr4-2jgw-hmv8
Summary: Command Injection in whereis
Aliases: CVE-2018-3772
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2018-07-31T18:28:53Z

Versions of `whereis` before 0.4.1 are vulnerable to command injection if untrusted user input is passed into `whereis`.


## Recommendation

Update to version 0.4.1 or later.
Vulnerability: GHSA-pjj4-jjgc-h3r8
Summary: Authenticated remote code execution
Severity: MODERATE
CVSS score: 0
CWE: CWE-74
Published: 2021-03-12T23:09:24Z

### Impact
Authenticated remote code execution using plugin manager without ACL permissions.

### Patches
We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021
Vulnerability: GHSA-cqcf-4g4h-rghf
Summary: Cross-site scripting in Apache Archiva
Aliases: CVE-2019-0213
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2019-05-14T04:00:31Z

In Apache Archiva before 2.2.4, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Vulnerability: GHSA-93c4-vf86-3rj7
Summary: Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
Aliases: CVE-2021-33611
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-11-03T17:33:32Z

Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.
Vulnerability: GHSA-ppfm-rj6p-38q6
Summary: Improper Authorization in librenms
Aliases: CVE-2022-0587
Severity: HIGH
CVSS score: 7.1
CWE: CWE-285
Published: 2022-02-16T00:01:53Z

Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-x5m8-2r8v-8f97
Summary: Prototype Pollution in libnested
Aliases: CVE-2022-25352
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
Vulnerability: GHSA-h58v-g3q6-q9fx
Summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu
Aliases: CVE-2021-41169
Severity: MODERATE
CVSS score: 6.2
CWE: CWE-79
Published: 2021-10-22T16:20:53Z

### Impact

_What kind of vulnerability is it? Who is impacted?_

It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form.
Only admin users are affected and only admin users can create tags.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

The problem is patched with Version 1.6.42.

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Create a custom request listener to avoid that this kind of tags are created.

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [sulu/sulu repository](https://github.com/sulu/sulu/issues)
* Email us at [security@sulu.io](mailto:security@sulu.io)
Vulnerability: GHSA-6whf-q6p5-84wg
Summary: Improper Access Control in Webauthn Framework
Aliases: CVE-2021-38299
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-863
Published: 2021-09-29T17:16:07Z

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
Vulnerability: GHSA-4h44-w6fm-548g
Summary: Potential Remote Code Execution in TYPO3 with mediace extension
Aliases: CVE-2020-15086
Severity: HIGH
CVSS score: 9.8
CWE: CWE-200, CWE-325, CWE-20, CWE-502
Published: 2020-07-29T16:15:12Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1)
> * CWE-325, CWE-20, CWE-200, CWE-502

### Problem
It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below.

* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007), [CVE-2020-15099](https://nvd.nist.gov/vuln/detail/CVE-2020-15099): Potential Privilege Escalation
  + the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network)
  + `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5, high)
* [TYPO3-CORE-SA-2016-013](https://typo3.org/security/advisory/typo3-core-sa-2016-013), [CVE-2016-5091](https://nvd.nist.gov/vuln/detail/CVE-2016-5091): Insecure Deserialization & Remote Code Execution
  + an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation
  + `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1, critical)

The overall severity of this vulnerability is critical (9.1) based on mentioned attack chains and the fact it does not require any privileges.

### Solution
In case the extension is not used and required at all, it is suggested to uninstall and remove it from the system completely. Otherwise, an updated version 7.6.5 is available from the TYPO3 extension manager, Packagist and the TYPO3 extension repository:

* https://extensions.typo3.org/extension/download/mediace/7.6.5/zip/
* https://packagist.org/packages/friendsoftypo3/mediace#7.6.5

As a precautionary measure it is advised to change `encryptionKey` and database credentials in `typo3conf/LocalConfiguration.php`.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-EXT-SA-2020-014](https://typo3.org/security/advisory/typo3-ext-sa-2020-014)
Vulnerability: GHSA-6g85-3hm8-83f9
Summary: CHECK-fail in `QuantizeAndDequantizeV4Grad`
Aliases: CVE-2021-29544
Severity: LOW
CVSS score: 2.5
CWE: CWE-754
Published: 2021-05-21T14:23:22Z

### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.QuantizeAndDequantizeV4Grad`:

```python
import tensorflow as tf

gradient_tensor = tf.constant([0.0], shape=[1])
input_tensor = tf.constant([0.0], shape=[1])
input_min = tf.constant([[0.0]], shape=[1, 1])
input_max = tf.constant([[0.0]], shape=[1, 1])

tf.raw_ops.QuantizeAndDequantizeV4Grad(
  gradients=gradient_tensor, input=input_tensor,
  input_min=input_min, input_max=input_max, axis=0)
```                     
                        
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L162-L163) does not validate the rank of the `input_*` tensors. In turn, this results in the tensors being passes as they are to [`QuantizeAndDequantizePerChannelGradientImpl`](https://github.com/tensorflow/tensorflow/blob/95078c145b5a7a43ee046144005f733092756ab5/tensorflow/core/kernels/quantize_and_dequantize_op.h#L295-L306):

```cc 
template <typename Device, typename T>
struct QuantizeAndDequantizePerChannelGradientImpl {
  static void Compute(const Device& d,
                      typename TTypes<T, 3>::ConstTensor gradient,
                      typename TTypes<T, 3>::ConstTensor input,
                      const Tensor* input_min_tensor,
                      const Tensor* input_max_tensor,
                      typename TTypes<T, 3>::Tensor input_backprop,
                      typename TTypes<T>::Flat input_min_backprop,
                      typename TTypes<T>::Flat input_max_backprop) {
    ...
    auto input_min = input_min_tensor->vec<T>();
    auto input_max = input_max_tensor->vec<T>();
    ...
}
```

However, the `vec<T>` method, requires the rank to 1 and triggers a `CHECK` failure otherwise.

### Patches
We have patched the issue in GitHub commit [20431e9044cf2ad3c0323c34888b192f3289af6b](https://github.com/tensorflow/tensorflow/commit/20431e9044cf2ad3c0323c34888b192f3289af6b).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 as this is the only other affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-v54f-xcmp-43cr
Summary: Deserialization of Untrusted Data in Apache ShardingSphere
Aliases: CVE-2020-1947
Severity: HIGH
CVSS score: 9.8
CWE: CWE-502
Published: 2022-02-10T20:39:47Z

In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere&#39;s web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.
Vulnerability: GHSA-76f4-fw33-6j2v
Summary: Potential sensitive data exposure in applications using Vaadin 15
Severity: LOW
CVSS score: 3.1
CWE: CWE-200
Published: 2021-04-19T14:48:26Z

Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`

- https://vaadin.com/security/cve-2020-36319
Vulnerability: GHSA-2p89-ppc2-mrq4
Summary: Cross site scripting in getgrav/grav
Aliases: CVE-2022-0743
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-79
Published: 2022-03-02T00:00:22Z

User input is not properly sanitized leading to cross site scrpting (xss) in grav.
Vulnerability: GHSA-5mc5-5j6c-qmf9
Summary: High severity vulnerability that affects cfscrape
Aliases: CVE-2017-7235
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2018-07-13T16:01:01Z

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0.
Vulnerability: GHSA-9272-59x2-gwf2
Summary: Malicious Package in ripedm160
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:04:13Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rpx7-33j2-xx9x
Summary: Arbitrary file deletion in NeMo ASR webapp
Severity: LOW
CVSS score: 2
Published: 2022-02-15T01:57:18Z

### Description

NVIDIA NeMo contains a vulnerability in ASR WebApp, where Relative Path Traversal (CWE-23) may lead to deletion of any directory through the "../" structure when admin privileges are available.

CVSS Score = 2.0
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

### Impact
When the optional tool ASR Webapp (https://github.com/NVIDIA/NeMo/tree/main/tools/asr_webapp) is used prior to commit https://github.com/NVIDIA/NeMo/commit/f7e4ed7e4f7f2fa43765a38c2fafa1b6d1ebd7c0, some interfaces do not verify user input. Malicious attackers can construct malicious requests to delete any directory through the "../" structure.

The vulnerability affects only cases where this particular web app is started by a user with superuser permissions. The web application is *not* a part of the regular pip release or the corresponding container, and impacts only users that clone the repository in its entirety and execute the web app (while also possessing superuser permissions).

## Patches

This vulnerability has been patched via https://github.com/NVIDIA/NeMo/commit/f7e4ed7e4f7f2fa43765a38c2fafa1b6d1ebd7c0, which is effectively any clone of the repository post r1.5.1 branch. Since the web app is not distributed via pip release or container, users who clone the main branch post this commit will possess the patch.

### Workarounds
The changes in commit https://github.com/NVIDIA/NeMo/commit/f7e4ed7e4f7f2fa43765a38c2fafa1b6d1ebd7c0 can be applied to any version of the web app without any adverse effect.

### Additional Information
Exploit Found on: 2021.12.16
Exploit Found by: @haby0
Vulnerability: GHSA-685w-vc84-wxcx
Summary: Moderate severity vulnerability that affects doorkeeper
Aliases: CVE-2014-8144
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2018-09-17T21:55:22Z

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.
Vulnerability: GHSA-2g9q-chq2-w8qw
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2017-12625
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200
Published: 2019-03-14T15:40:16Z

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.
Vulnerability: GHSA-pqg8-crx9-g8m4
Summary: Backend Same-Site Request Forgery in TYPO3 CMS
Aliases: CVE-2020-11069
Severity: HIGH
CVSS score: 8
CWE: CWE-352, CWE-346
Published: 2020-05-13T23:40:09Z

> ### Meta
> * CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
> * CWE-352
> * CWE-346

### Problem
It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session.

In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it’s actually a same-origin request forgery.

Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location.

The attacked victim requires an active and valid backend or install tool user sessions at the time of the attack to be successful.

### Solution
Update to TYPO3 versions 9.5.17 or 10.4.2 that mitigates the problem described.

### Additional Considerations

The deployment of additional mitigation techniques is suggested as described below.

#### Sudo Mode Extension

This TYPO3 extension intercepts modifications to security relevant database tables, e.g. those storing user accounts or storages of the file abstraction layer. Modifications need to confirmed by again by the acting user with providing their password again - this technique is known as "sudo mode". This way unintended actions happening in the background can be mitigated.

* https://github.com/FriendsOfTYPO3/sudo-mode
* https://extensions.typo3.org/extension/sudo_mode

#### Content Security Policy

[Content Security Policies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) tell (modern) browsers how resources served a particular site are handled - it also it possible to disallow script executions for specific locations. In a TYPO3 context it is suggested to disallow direct script execution at least for locations `/fileadmin/` and `/uploads/`.

```
# in fileadmin/.htaccess
<IfModule mod_headers.c>
	Header add Content-Security-Policy "default-src 'self'; script-src 'none';"
</IfModule>
```

### Credits
Thanks to Matteo Bonaker who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-006
Vulnerability: GHSA-886v-mm6p-4m66
Summary: High severity vulnerability that affects gun
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-06-05T09:48:02Z

## Urgent Upgrade

The static file server module included with GUN had a **serious vulnerability**:

 - Using `curl --path-as-is` allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

 ### Fixed

This has been fixed since version `0.2019.416` and higher.

 ### Who Was Effected?

Most NodeJS users who use the default setup, such as:

 - `npm start`
 - `node examples/http.js`
 - `Heroku` 1-click-deploy
 - `Docker`
 - `Now`

If you have a custom NodeJS code then you are probably safe *unless* you have something like `require('http').createServer(Gun.serve(__dirname))` in it.

If you have not upgraded, it is **mandatory** or else it is highly likely your environment variables and AWS (or other) keys could be leaked.

 ### Credit

It was reported and fixed by [JK0N](https://github.com/amark/gun/pull/527), but I did not understand the `--path-as-is` condition.

Joonas Loppi from [function61](http://function61.com) rediscovered it and explained the urgency to me to fix it.
Vulnerability: GHSA-33f9-j839-rf8h
Summary: Prototype Pollution in immer
Aliases: CVE-2021-23436
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-843, CWE-1321
Published: 2021-09-02T17:17:37Z

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
Vulnerability: GHSA-pgh6-m65r-2rhq
Summary: DOS and Open Redirect with user input
Aliases: CVE-2021-22964
Severity: HIGH
CVSS score: 8.8
CWE: CWE-248, CWE-601
Published: 2021-10-12T16:04:17Z

### Impact

A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.

A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`

The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

### Patches
The issue has been patched in `fastify-static@4.4.1`

### Workarounds
If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.

### References

+ Bug founder: drstrnegth
+ [hackerone Report](https://hackerone.com/reports/1361804)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)
* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)
Vulnerability: GHSA-g7v2-2qxx-wjrw
Summary: Symlink Attack in Libcontainer and Docker Engine
Aliases: CVE-2015-3627
Severity: MODERATE
CVSS score: 0
CWE: CWE-59
Published: 2022-02-15T01:18:02Z

Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Vulnerability: GHSA-cj2h-ww36-v932
Summary: Improper Certificate Validation in HashiCorp Nomad
Aliases: CVE-2020-7956
Severity: HIGH
CVSS score: 9.8
CWE: CWE-295
Published: 2021-05-18T18:20:26Z

HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.
Vulnerability: GHSA-4w8p-x6g8-fv64
Summary: Server-Side Request Forgery in calibreweb
Aliases: CVE-2022-0339
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-918
Published: 2022-02-01T00:48:54Z

calibreweb prior to version 0.6.16 contains a Server-Side Request Forgery (SSRF) vulnerability.
Vulnerability: GHSA-qh7x-j4v8-qw5w
Summary: Clipboard-based XSS
Aliases: CVE-2021-41086
Severity: HIGH
CVSS score: 8.7
CWE: CWE-79
Published: 2021-09-22T20:39:26Z

### Impact
XSS against the user.

### Details
jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` causing XSS.

### References
The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers: https://research.securitum.com/the-curious-case-of-copy-paste/
Vulnerability: GHSA-v9w2-v7j9-rjpr
Summary: Remote code execution in Eclipse Theia
Aliases: CVE-2021-34435
Severity: HIGH
CVSS score: 8.8
CWE: CWE-668, CWE-942
Published: 2021-09-02T22:02:36Z

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.
Vulnerability: GHSA-333w-rxj3-f55r
Summary: Regular Expression Denial Of Service in uri-js
Aliases: CVE-2017-16021
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:00:30Z

Affected versions of `uri-js` is susceptible to a regular expression denial of service vulnerability when user input is sent to the `.parse()` method.



## Recommendation

Update to v3.0.0 or later.
Vulnerability: GHSA-mq47-6wwv-v79w
Summary: Path traversal in claircore
Aliases: CVE-2021-3762
Severity: HIGH
CVSS score: 7.8
CWE: CWE-22
Published: 2022-03-04T00:00:16Z

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
Vulnerability: GHSA-j8g6-2wh7-6439
Summary: Apache Tika allows Java code execution for serialized objects embedded in MATLAB files
Aliases: CVE-2016-6809
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-17T15:44:36Z

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Vulnerability: GHSA-cfxm-4p54-5w7h
Summary: Directory traversal in pooledwebsocket
Aliases: CVE-2017-16107
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T00:20:57Z

Affected versions of `pooledwebsocket` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to version 0.0.19 or later.
Vulnerability: GHSA-7543-mr7h-6v86
Summary: Improper Authorization in googleapis
Severity: HIGH
CVSS score: 0
CWE: CWE-285
Published: 2020-09-02T16:00:26Z

Versions of `googleapis` prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials.


## Recommendation

Upgrade to version 39.1.0.
Vulnerability: GHSA-3gp6-hhfw-4gqx
Summary: Padding oracle attacks
Aliases: CVE-2010-3300
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-649
Published: 2021-08-13T15:22:24Z

It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.
Vulnerability: GHSA-hv7x-f3pv-gpwr
Summary: Wrong memory orderings violates mutual exclusion in spin
Aliases: CVE-2019-16137
Severity: HIGH
CVSS score: 7.5
CWE: CWE-662
Published: 2021-08-25T20:44:46Z

An issue was discovered in the spin crate before 0.5.2 for Rust, when RwLock is used. Because memory ordering is mishandled, two writers can acquire the lock at the same time, violating mutual exclusion.
Vulnerability: GHSA-rpcm-whqc-jfw8
Summary: Use after free in libflate
Aliases: CVE-2019-15552
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:44:53Z

An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code execution.
Vulnerability: GHSA-q4xr-rc97-m4xx
Summary: OS Command Injection in celery
Aliases: CVE-2021-23727
Severity: HIGH
CVSS score: 7.5
CWE: CWE-77, CWE-78
Published: 2022-01-06T22:22:02Z

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Vulnerability: GHSA-5hq2-xf89-9jxq
Summary: Open Redirect in Action Pack
Aliases: CVE-2021-22903
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-05-05T19:48:29Z

Impact
------
This is similar to CVE-2021-22881. Specially crafted Host headers in
combination with certain "allowed host" formats can cause the Host
Authorization middleware in Action Pack to redirect users to a malicious
website.

Since rails/rails@9bc7ea5, strings in config.hosts that do not have a leading
dot are converted to regular expressions without proper escaping. This causes,
for example, config.hosts << "sub.example.com" to permit a request with a Host
header value of sub-example.com.


Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
The following monkey patch put in an initializer can be used as a workaround.

```ruby
class ActionDispatch::HostAuthorization::Permissions
  def sanitize_string(host)
    if host.start_with?(".")
      /\A(.+\.)?#{Regexp.escape(host[1..-1])}\z/i
    else
      /\A#{Regexp.escape host}\z/i
    end
  end
end
```

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 6-1-open-redirect.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at
present. Users of earlier unsupported releases are advised to upgrade as soon
as possible as we cannot guarantee the continued availability of security
fixes for unsupported releases.

Credits
-------

Thanks Jonathan Hefner (https://hackerone.com/jonathanhefner) for reporting this bug!
Vulnerability: GHSA-9xr8-8hmc-389f
Summary: Cross-Site Scripting in vant
Severity: HIGH
CVSS score: 9.1
CWE: CWE-79
Published: 2019-11-22T13:45:33Z

Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.1.8 or later.
Vulnerability: GHSA-r2vw-jgq9-jqx2
Summary: Improper Authorization in @sap-cloud-sdk/core
Severity: HIGH
CVSS score: 0
CWE: CWE-285
Published: 2020-09-03T15:54:11Z

Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs.  The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded.  Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.


## Recommendation

Upgrade to version 1.21.2 or later.