TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-vcw4-8ph6-7vw8
Summary: Use after free in Rocket
Aliases: CVE-2021-29935
Severity: HIGH
CVSS score: 7.3
CWE: CWE-416
Published: 2021-08-25T20:54:20Z

An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.
Vulnerability: GHSA-4whq-r978-2x68
Summary: Arbitrary code execution in ExifTool
Severity: HIGH
CVSS score: 7.8
CWE: CWE-74
Published: 2021-05-04T17:43:52Z

### Impact

Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads.

### Patches

ExifTool has already been patched in version 12.24. exiftool-vendored, which vendors ExifTool, includes this patch in v14.3.0.

### Workarounds

No.

### References

https://twitter.com/wcbowling/status/1385803927321415687
https://nvd.nist.gov/vuln/detail/CVE-2021-22204

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [exiftool-vendored](https://github.com/photostructure/exiftool-vendored.js)
Vulnerability: GHSA-v6wh-2wvh-c8x5
Summary: Regular Expression Denial of Service in djvalidator
Aliases: CVE-2020-7779
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-09T23:15:46Z

All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.
Vulnerability: GHSA-8q5c-93vg-c747
Summary: WITHDRAWN
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:30Z

WITHDRAWN
Vulnerability: GHSA-vc5r-xfc4-4x22
Summary: Cross-site Scripting in Pimcore Datahub
Aliases: CVE-2022-0955
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2022-03-25T00:00:33Z

Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user's cookie being stolen.
Vulnerability: GHSA-xp5m-4c9f-498q
Summary: Moderate severity vulnerability that affects django-epiceditor
Aliases: CVE-2017-6591
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-07-13T15:17:18Z

There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.
Vulnerability: GHSA-pwfw-mgfj-7g3g
Summary: Low severity vulnerability that affects ecdsa
Aliases: CVE-2019-14853
Severity: HIGH
CVSS score: 7.5
CWE: CWE-391, CWE-755
Published: 2019-10-08T16:30:17Z

## possible DoS in signature verification and signature malleability 

### Impact
Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` may receive exceptions other than the documented `BadSignatureError` when signatures are malformed. If those other exceptions are not caught, they may lead to program termination and thus Denial of Service

Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` with `sigdecode` option using `ecdsa.util.sigdecode_der` will accept signatures even if they are not properly formatted DER. This makes the signatures malleable. It impacts only applications that later sign the signatures or verify signatures of signatures, e.g. Bitcoin.

All versions between 0.5 and 0.13.2 (inclusive) are thought to be vulnerable. Code before 0.5 may be vulnerable but didn't receive extended analysis to rule this issue out.

### Patches
The patches have been merged to `master` branch in https://github.com/warner/python-ecdsa/pull/115.
The backported patches for a release in the 0.13 branch are in https://github.com/warner/python-ecdsa/pull/124

They are part of the 0.13.3 release.

There are no plans to backport them to earlier releases.

### Workarounds
It may be possible to prevent the Denial of Service by catching also `UnexpectedDER`, `IndexError` and `AssertionError` exceptions. That list hasn't been verified to be complete though. If those exceptions are raised, the signature verification process should consider the signature to be invalid.

To remediate signature malleability and the Denial of Service vulnerability, it may be possible to first verify that the signature is properly DER formatted ECDSA-Sig-Value, as defined in [RFC3279](https://tools.ietf.org/html/rfc3279), before passing it to `verify()` or `verify_digest()` methods. If the signature is determined to not follow the DER or encode a different structure, the signature verification process should consider the signature to be invalid.

### References
https://en.bitcoinwiki.org/wiki/Transaction_Malleability

### For more information
If you have any questions or comments about this advisory please open an issue in [python-ecdsa](https://github.com/warner/python-ecdsa/issues) project.
Vulnerability: GHSA-5phf-pp7p-vc2r
Summary: Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
Aliases: CVE-2021-28363
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-295
Published: 2021-03-19T19:42:11Z

### Impact

Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`.
Only the default SSLContext is impacted.

### Patches

[urllib3 >=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.

### Workarounds

Upgrading is recommended as this is a minor release and not likely to break current usage.

Configuring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext`

### For more information
If you have any questions or comments about this advisory:
* Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)
Vulnerability: GHSA-vpmw-77vm-4mjg
Summary: Cross-site Scripting in Cipi
Aliases: CVE-2022-26332
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-02T00:00:21Z

Cipi 3.1.15 allows Add Server stored cross-site scripting via the /api/servers name field.
Vulnerability: GHSA-5rrq-pxf6-6jx5
Summary: Prototype Pollution in node-forge debug API.
Severity: LOW
CVSS score: 0
CWE: CWE-1321
Published: 2022-01-08T00:22:42Z

### Impact
The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised.  It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

### Patches
The `forge.debug` API and related functions were removed in 1.0.0.

### Workarounds
Don't use the `forge.debug` API directly or indirectly with untrusted input.

### References
- https://www.huntr.dev/bounties/1-npm-node-forge/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge).
* Email us at support@digitalbazaar.com.
Vulnerability: GHSA-xpxm-pf7g-2534
Summary: Cross-site scripting in media2click
Aliases: CVE-2021-31778
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-79
Published: 2021-06-08T20:11:52Z

The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
Vulnerability: GHSA-cfh5-3ghh-wfjx
Summary: Moderate severity vulnerability that affects org.apache.httpcomponents:httpclient
Aliases: CVE-2014-3577
Severity: MODERATE
CVSS score: 0
CWE: CWE-347
Published: 2018-10-17T00:05:06Z

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.
Vulnerability: GHSA-8v38-pw62-9cw2
Summary: Incorrect returned href via an '@' sign but no user info and hostname
Aliases: CVE-2022-0639
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-639
Published: 2022-02-18T00:00:33Z

A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,
`````
parse(\"http://@/127.0.0.1\")
`````
Will return:
`````
{
 slashes: true,
 protocol: 'http:',
 hash: '',
 query: '',
 pathname: '/127.0.0.1',
 auth: '',
 host: '',
 port: '',
 hostname: '',
 password: '',
 username: '',
 origin: 'null',
 href: 'http:///127.0.0.1'
 }
`````
If the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect.
Vulnerability: GHSA-7257-96vg-qf6x
Summary: Remote Code Execution in Red Discord Bot
Aliases: CVE-2020-15147
Severity: HIGH
CVSS score: 8.5
CWE: CWE-94, CWE-74
Published: 2020-08-21T17:03:24Z

### Impact
A RCE exploit has been discovered in the Streams module: this exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information.

### Patches
This critical exploit has been fixed on version ``3.3.12`` & ``3.4``.

### Workarounds
Unloading the Streams module with ``unload streams`` can render this exploit not accessible. We still highly recommend updating to ``3.3.12`` or ``3.4`` to completely patch this issue.

### References
* https://github.com/Cog-Creators/Red-DiscordBot/pull/4183

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)
* Over on our [Discord server](https://discord.gg/red)
Vulnerability: GHSA-mx9v-gmh4-mgqw
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-19361
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-01-04T19:07:01Z

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
Vulnerability: GHSA-48hw-37g6-3gw4
Summary: Malicious Package in mx-nested-menu
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T02:35:41Z

Version 0.1.30 of `mx-nested-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-4cww-f7w5-x525
Summary: Stack consumption in trust-dns-server
Aliases: CVE-2020-35857
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-08-25T20:46:13Z

An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. DNS MX and SRV null targets are mishandled, causing stack consumption.
Vulnerability: GHSA-fhpf-pp6p-55qc
Summary: Unsafe handling of user-specified cookies in treq
Aliases: CVE-2022-23607
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-601
Published: 2022-02-01T00:43:38Z

### Impact

Treq's request methods (`treq.get`, `treq.post`, `HTTPClient.request`, `HTTPClient.get`, etc.) accept cookies as a dictionary, for example:

```py
treq.get('https://example.com/', cookies={'session': '1234'})
```

Such cookies are not bound to a single domain, and are therefore sent to *every* domain ("supercookies"). This can potentially cause sensitive information to leak upon an HTTP redirect to a different domain., e.g. should `https://example.com` redirect to `http://cloudstorageprovider.com` the latter will receive the cookie `session`.

### Patches

Treq 2021.1.0 and later bind cookies given to request methods (`treq.request`, `treq.get`, `HTTPClient.request`, `HTTPClient.get`, etc.) to the origin of the *url* parameter.

### Workarounds

Instead of passing a dictionary as the *cookies* argument, pass a `http.cookiejar.CookieJar` instance with properly domain- and scheme-scoped cookies in it:

```py
from http.cookiejar import CookieJar
from requests.cookies import create_cookie

jar = CookieJar()
jar.add_cookie(
    create_cookie(
        name='session',
        value='1234',
        domain='example.com',
        secure=True,
    ),
)
client = HTTPClient(cookies=jar)
client.get('https://example.com/')
```

### References

* Originally reported at [huntr.dev](https://huntr.dev/bounties/3c9204fc-a3d1-4441-8599-924c5f57e7ae/?token=06d930e37046c914bcb037e85cc227dc7b510b475989fc69837566562ba899277d46b0fb4b1e21cdcb6ddc1b7d9b1ded632cf3a3551ecb89afca16a63b34641284b50479d5195bba2ac09b116f3dd4fad27f54404c2de922c05c8c8b744aec27bb4d4d198cb8b3abf479af0c2d5fbaa10412da7922594ac3eb39)
* A related issue in the handling of HTTP basic authentication was addressed in Twisted 22.1 ([GHSA-92x2-jw7w-xvvx](https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx), CVE-2022-21712).
Vulnerability: GHSA-7wpw-2hjm-89gp
Summary: Prototype Pollution in merge
Aliases: CVE-2020-28499
Severity: HIGH
CVSS score: 7.3
CWE: CWE-915
Published: 2021-05-04T20:18:47Z

All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .
Vulnerability: GHSA-wjm3-fq3r-5x46
Summary: Denial of service
Aliases: CVE-2020-36066
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-18T21:07:54Z

GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.
Vulnerability: GHSA-wjpc-cgvw-xx23
Summary: Prototype Pollution in sey
Aliases: CVE-2021-23663
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1321
Published: 2021-12-16T14:29:34Z

All versions of package `sey` are vulnerable to Prototype Pollution via the deepmerge() function.
Vulnerability: GHSA-772p-x54p-hjrv
Summary: Division by zero in `Conv3D`
Aliases: CVE-2021-29517
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:21:01Z

### Impact
A malicious user could trigger a division by 0 in `Conv3D` implementation:

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
filter_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)

tf.raw_ops.Conv3D(input=input_tensor, filter=filter_tensor, strides=[1, 56, 56, 56, 1], padding='VALID', data_format='NDHWC', dilations=[1, 1, 1, 23, 1])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/42033603003965bffac51ae171b51801565e002d/tensorflow/core/kernels/conv_ops_3d.cc#L143-L145) does a modulo operation based on user controlled input:

```cc
  const int64 out_depth = filter.dim_size(4);
  OP_REQUIRES(context, in_depth % filter_depth == 0, ...);
```

Thus, when `filter` has a 0 as the fifth element, this results in a division by 0.

Additionally, if the shape of the two tensors is not valid, an Eigen assertion can be triggered, resulting in a program crash:

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[2, 2, 2, 2, 0], dtype=tf.float32)
filter_tensor = tf.constant([], shape=[0, 0, 2, 6, 2], dtype=tf.float32)

tf.raw_ops.Conv3D(input=input_tensor, filter=filter_tensor, strides=[1, 56, 39, 34, 1], padding='VALID', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```

The shape of the two tensors must follow the constraints specified in the [op description](https://www.tensorflow.org/api_docs/python/tf/raw_ops/Conv3D).

### Patches
We have patched the issue in GitHub commit [799f835a3dfa00a4d852defa29b15841eea9d64f](https://github.com/tensorflow/tensorflow/commit/799f835a3dfa00a4d852defa29b15841eea9d64f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-pv55-r6j3-wp94
Summary: Malicious Package in eslint-config-eslint
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:45:57Z

Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Vulnerability: GHSA-p463-639r-q9g9
Summary: High severity vulnerability that affects dragonfly
Aliases: CVE-2013-1756
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
Vulnerability: GHSA-6956-83fg-5wc5
Summary: Prototype Pollution in set-in
Aliases: CVE-2022-25354
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
Vulnerability: GHSA-p63h-7hw8-5cw4
Summary: Cross-Site Request Forgery in OpenNMS Horizon
Aliases: CVE-2021-25930
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-05-25T18:46:49Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection, and since there is no validation of an existing user name while renaming a user. As a result, privileges of the renamed user are being overwritten by the old user and the old user is being deleted from the user list.
Vulnerability: GHSA-p9f8-gqjf-m75j
Summary: Uncontrolled Resource Consumption in fastify-multipart
Aliases: CVE-2020-8136
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-06T17:28:36Z

Prototype pollution vulnerability in `fastify-multipart` < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.
Vulnerability: GHSA-3rx2-x6mx-grj3
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-10089
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-10-11T18:41:54Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-3r9x-mjrm-2725
Summary: Prototype pollution vulnerability in 'libnested'
Aliases: CVE-2020-28283
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-10-12T16:27:02Z

Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-w9mp-p2wp-2xf7
Summary: Improper file downloads in Apache Tapestry
Aliases: CVE-2020-13953
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-552
Published: 2022-02-10T20:35:42Z

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
Vulnerability: GHSA-cxmj-qjv6-vx9p
Summary: Low severity vulnerability that affects mcstatic
Aliases: CVE-2018-16482
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2019-02-07T18:15:44Z

A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.
Vulnerability: GHSA-9gp7-jvm2-r4mx
Summary: Moderate severity vulnerability that affects org.apache.struts:struts2-core
Aliases: CVE-2017-7672
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-20
Published: 2018-10-16T19:36:43Z

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
Vulnerability: GHSA-rqp5-pg7w-832p
Summary: Code Injection in datagrid
Aliases: CVE-2019-14281
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2019-07-31T04:21:27Z

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Vulnerability: GHSA-j39c-c8hj-x4j3
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Aliases: CVE-2021-25122
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-06-16T17:45:29Z

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Vulnerability: GHSA-mrq4-7ch7-2465
Summary: Server Side Twig Template Injection
Aliases: CVE-2022-21686
Severity: CRITICAL
CVSS score: 9
CWE: CWE-94
Published: 2022-01-27T18:32:47Z

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
Vulnerability: GHSA-wgfq-7857-4jcc
Summary: Uncontrolled Resource Consumption in json-bigint
Aliases: CVE-2020-8237
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-07T16:47:19Z

Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
Vulnerability: GHSA-rw98-5846-pqhx
Summary: Open redirect in microweber
Aliases: CVE-2022-0597
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-02-16T00:01:45Z

Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-cr3x-7m39-c6jq
Summary: Potential remote code execution of user-provided local names in ActionView
Aliases: CVE-2020-8163
Severity: MODERATE
CVSS score: 0
CWE: CWE-94
Published: 2020-07-07T16:34:27Z

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Vulnerability: GHSA-8v99-48m9-c8pm
Summary: Incorrect Authorization in imgcrypt
Aliases: CVE-2022-24778
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863
Published: 2022-03-28T19:33:44Z

Imgcrypt implements a function `CheckAuthorization()` that is supposed to check whether a user is authorized to access an encrypted image given the keys that the user has provided on the command line that would enable decryption of the image. The check is to prevent that a user can start a container from an image that has previously been decrypted by another user on the same system and therefore a decrypted version of the image layers may be already available in the cache locally.

The failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. In the version prior to the fix, only the first architecture in the list was tested, which may not have its layers available locally (were not pulled) since it cannot be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run lead to other architectures in the ManifestList be able to run an image without providing keys if that image had previously been decrypted. The fixed version now skips over irrelevant architectures and tests the Manifest of the local architecture, if available.

Known projects that use the `CheckAuthorization()` of imgcrypt is for example the ctr-enc client tool provided by imgcrypt. In this implementation, the call to `CheckAuthorization()` is used on the client side and could therefore also be easily circumvented by a modified client tool not calling this function.

In relation to the vulnerability in ctr-enc, affected environments would have to allow different users to invoke ctr-enc indirectly using some sort of management stack that gives user indirect access to ctr-enc.

The patch has been applied to imgcrypt v1.1.4. Workarounds may include usage of different namespaces for each remote user.
Vulnerability: GHSA-qm58-cvvm-c5qr
Summary: Unsafe upload filtering leading to remote code execution
Aliases: CVE-2021-23394
Severity: HIGH
CVSS score: 8.1
CWE: CWE-434
Published: 2021-06-15T15:51:02Z

### Impact

Before elFinder 2.1.58, the upload filter did not disallow the upload of `.phar` files. As several Linux distributions are now shipping Apache configured in a way it will process these files as PHP scripts, attackers could gain arbitrary code execution on the server hosting the PHP connector (even in minimal configuration).

### Patches

The issue has been addressed with https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1, associating `.phar` files to the right MIME type. Unless explicitly allowed in the configuration, such files cannot be uploaded anymore. This patch is part of the last release of elFinder, 2.1.58.

### Workarounds

If you can't update to 2.1.58, make sure your connector is not exposed without authentication.

### Important tips

Server-side scripts can often be created as text files. Currently, elFinder has an appropriate MIME type set for file extensions that are generally runnable on a web server.

However, the server has various settings. In some cases, the executable file may be judged as "text/plain". Therefore, elFinder installers should understand the extensions that can be executed on the web server where elFinder is installed, and check if there are any missing items in the elFinder settings.

The elFinder PHP connector has an option "additionalMimeMap" that specifies the MIME type for each extension. See [#3295(comment)](https://github.com/Studio-42/elFinder/issues/3295#issuecomment-853042139) for more information.

### References

- https://snyk.io/vuln/composer:studio-42%2Felfinder
- https://github.com/Studio-42/elFinder/issues/3295
- Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to  support [at] snyk.io or vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-qx2f-477c-35rq
Summary: Regular Expression Denial of Service in method-override
Aliases: CVE-2017-16136
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:06:04Z

Affected versions of `method-override` are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the `X-HTTP-Method-Override` header.


## Recommendation

Update to version 2.3.10 or later
Vulnerability: GHSA-hwh3-fhf6-73x9
Summary: Malicious Package in bictoinjs-lib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:36:09Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4xcv-9jjx-gfj3
Summary: Denial of Service in mem
Severity: MODERATE
CVSS score: 5.1
CWE: CWE-400
Published: 2019-07-05T21:07:58Z

Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS).  The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.


## Recommendation

Upgrade to version 4.0.0 or later.
Vulnerability: GHSA-j8f4-2w4p-mhjc
Summary: Moderate severity vulnerability that affects Microsoft.AspNetCore.Mvc
Aliases: CVE-2017-0256
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2018-10-16T19:57:48Z

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.
Vulnerability: GHSA-9pv8-q5rx-c8gq
Summary: Critical severity vulnerability that affects django_make_app
Aliases: CVE-2017-16764
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-07-13T15:16:59Z

An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Vulnerability: GHSA-qvrv-2x7x-78x2
Summary: Reflected XSS in SilverStripe
Aliases: CVE-2019-19325
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-78
Published: 2020-02-24T17:33:31Z

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user&amp;#39;s credentials or other sensitive user input.
Vulnerability: GHSA-8gc6-65mm-xr6r
Summary: Malicious Package in bp66
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:46:28Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-c6fh-56w7-fvjw
Summary: Integer overflow in Tensorflow
Aliases: CVE-2022-21727
Severity: HIGH
CVSS score: 7.6
CWE: CWE-190
Published: 2022-02-09T18:29:13Z

### Impact 
The [implementation of shape inference for `Dequantize`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/ops/array_ops.cc#L3001-L3034) is vulnerable to an integer overflow weakness:

```python
import tensorflow as tf

input = tf.constant([1,1],dtype=tf.qint32)

@tf.function
def test():
  y = tf.raw_ops.Dequantize(
    input=input,
    min_range=[1.0],
    max_range=[10.0],
    mode='MIN_COMBINED',
    narrow_range=False,
    axis=2**31-1,
    dtype=tf.bfloat16)
  return y

test()
``` 

The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes `axis + 1`, an attacker can trigger an integer overflow:

```cc
  int axis = -1; 
  Status s = c->GetAttr("axis", &axis);
  // ...
  if (axis < -1) {
    return errors::InvalidArgument("axis should be at least -1, got ",
                                   axis);
  }
  // ...
  if (axis != -1) {
    ShapeHandle input;
    TF_RETURN_IF_ERROR(c->WithRankAtLeast(c->input(0), axis + 1, &input));
    // ...
  }
```
  
### Patches
We have patched the issue in GitHub commit [b64638ec5ccaa77b7c1eb90958e3d85ce381f91b](https://github.com/tensorflow/tensorflow/commit/b64638ec5ccaa77b7c1eb90958e3d85ce381f91b).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
      
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Vulnerability: GHSA-grh7-935j-hg6w
Summary: Cross-site Scripting in Sidekiq
Aliases: CVE-2021-30151
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-06T17:47:17Z

Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Vulnerability: GHSA-rc4q-9m69-gqp8
Summary: Lack of protection against cookie tossing attacks in fastify-csrf
Aliases: CVE-2021-29624
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352, CWE-565
Published: 2021-05-17T20:53:30Z

### Impact

Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. 

### Patches

Version 3.1.0 of the fastify-csrf fixes it. 
See https://github.com/fastify/fastify-csrf/pull/51 and https://github.com/fastify/csrf/pull/2.

The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.

### Workarounds

None available.

### References

1. https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
2. https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf

### Credits

This vulnerability was found by Xhelal Likaj <xhelallikaj20@gmail.com>.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-csrf](https://github.com/fastify/fastify-csrf)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-29gp-2c3m-3j6m
Summary: Sandbox Escape by math function in smarty
Aliases: CVE-2021-29454
Severity: HIGH
CVSS score: 8.1
CWE: CWE-74
Published: 2022-01-12T22:43:00Z

### Impact
Template authors could run arbitrary PHP code by crafting a malicious math string.
If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.

### Patches
Please upgrade to 4.0.2 or 3.1.42 or higher.

### References
See [documentation on Math function](https://www.smarty.net/docs/en/language.function.math.tpl).

### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Vulnerability: GHSA-f7ph-p5rv-phw2
Summary: Cross-Site Scripting in nunjucks
Aliases: CVE-2016-10547
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-06T23:13:37Z

Affected versions of `nunjucks` do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability.

## Proof of Concept

By using an array for the keys in a template var, escaping is bypassed.
```javascript
name[]=<script>alert(1)</script>
```

A full PoC is available in the references section.


## Recommendation

Update to version 2.4.3 or later.
Vulnerability: GHSA-6vwx-mwp8-fh44
Summary: Cross-site Scripting in reveal.js
Aliases: CVE-2020-8127
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-05-10T18:47:10Z

Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.
Vulnerability: GHSA-p9w3-gwc2-cr49
Summary: HTTP Request Smuggling in Undertow
Aliases: CVE-2020-10687
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-444
Published: 2021-04-30T17:28:52Z

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
Vulnerability: GHSA-qg8p-v9q4-gh34
Summary: Potential Command Injection in shell-quote
Aliases: CVE-2016-10541
Severity: CRITICAL
CVSS score: 0
CWE: CWE-78
Published: 2019-02-18T23:58:29Z

Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.



## Proof of Concept:

The following characters are not escaped properly: `>`,`;`,`{`,`}`

Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible. 

```
   const quote = require('shell-quote').quote;
   console.log(quote(['a;{echo,test,123,234}']));
   // Actual                    "a;{echo,test,123,234}"
   // Expected                  "a\;\{echo,test,123,234\}"
   // Functional Equivalent     "a; echo 'test' '123' '1234'"
```



## Recommendation

Update to version 1.6.1 or later.
Vulnerability: GHSA-9jjr-qqfp-ppwx
Summary: remote code execution via git repo provider
Aliases: CVE-2021-39159
Severity: CRITICAL
CVSS score: 9.6
CWE: CWE-94
Published: 2021-08-30T16:16:58Z

### Impact

A remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration.

### Patches

Patch below, or [on GitHub](https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182.patch)

```diff
From 9f4043d9dddc1174920e687773f27b7933f48ab6 Mon Sep 17 00:00:00 2001
From: Riccardo Castellotti <rcastell@cern.ch>
Date: Thu, 19 Aug 2021 15:49:43 +0200
Subject: [PATCH] Explicitly separate git-ls-remote options from positional
 arguments

---
 binderhub/repoproviders.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/binderhub/repoproviders.py b/binderhub/repoproviders.py
index f33347b..5d4b87c 100755
--- a/binderhub/repoproviders.py
+++ b/binderhub/repoproviders.py
@@ -484,7 +484,7 @@ class GitRepoProvider(RepoProvider):
             self.sha1_validate(self.unresolved_ref)
         except ValueError:
             # The ref is a head/tag and we resolve it using `git ls-remote`
-            command = ["git", "ls-remote", self.repo, self.unresolved_ref]
+            command = ["git", "ls-remote", "--", self.repo, self.unresolved_ref]
             result = subprocess.run(command, universal_newlines=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
             if result.returncode:
                 raise RuntimeError("Unable to run git ls-remote to get the `resolved_ref`: {}".format(result.stderr))
-- 
2.25.1

```

### Workarounds

Disable the git repo provider by specifying the `BinderHub.repo_providers` config, e.g.:

```python
from binderhub.repoproviders import (GitHubRepoProvider,
                            GitLabRepoProvider, GistRepoProvider,
                            ZenodoProvider, FigshareProvider, HydroshareProvider,
                            DataverseProvider)

c.BinderHub.repo_providers =  {
            'gh': GitHubRepoProvider,
            'gist': GistRepoProvider,
            'gl': GitLabRepoProvider,
            'zenodo': ZenodoProvider,
            'figshare': FigshareProvider,
            'hydroshare': HydroshareProvider,
            'dataverse': DataverseProvider,
        }
```

### References

Credit: Jose Carlos Luna Duran (CERN) and Riccardo Castellotti (CERN).

### For more information

If you have any questions or comments about this advisory:

* Email us at [security@ipython.org](mailto:security@ipython.org)
Vulnerability: GHSA-wqxc-qrq4-w5v4
Summary: Update unsound DrainFilter and RString::retain
Aliases: CVE-2020-36213
Severity: HIGH
CVSS score: 0
CWE: CWE-172
Published: 2021-08-25T21:01:33Z

An issue was discovered in the abi_stable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness.
Vulnerability: GHSA-grj5-8x6q-hc9q
Summary: Path traversal in Grafana Loki
Aliases: CVE-2021-36156
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2021-09-02T22:00:40Z

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.
Vulnerability: GHSA-8gmx-cpcg-f8h5
Summary: Double-free in id-map
Aliases: CVE-2021-30455
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:55:11Z

An issue was discovered in the id-map crate through 2021-02-26 for Rust. A double free can occur in IdMap::clone_from upon a .clone panic.
Vulnerability: GHSA-9jq9-c2cv-pcrj
Summary: Cross-site Scripting by SVG upload in xwiki-platform
Aliases: CVE-2021-43841
Severity: MODERATE
CVSS score: 4.1
CWE: CWE-79
Published: 2022-02-10T22:42:48Z

### Impact
When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. 

### Patches
This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser.

### Workarounds
This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload

### References
https://jira.xwiki.org/browse/XWIKI-18368

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-9mgm-gcq8-86wq
Summary: Improper Authentication in Apache ActiveMQ and Apache Artemis
Aliases: CVE-2021-26117
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2021-06-16T17:39:35Z

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Vulnerability: GHSA-qqc5-rgcc-cjqh
Summary: Information Disclosure in go.elastic.co/apm
Aliases: CVE-2021-22133
Severity: LOW
CVSS score: 2.4
CWE: CWE-532
Published: 2021-05-18T18:34:18Z

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.
Vulnerability: GHSA-9hx2-hgq2-2g4f
Summary: Regular Expression Denial of Service (ReDoS) in Pillow
Aliases: CVE-2021-25292
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2021-03-29T16:35:46Z

An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
Vulnerability: GHSA-5327-gfq5-8f4m
Summary: Malicious Package in buffer-xmr
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:56:23Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-4p6w-m9wc-c9c9
Summary: Sensitive Data Exposure in Apache Ant
Aliases: CVE-2020-1945
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-200, CWE-668
Published: 2020-09-14T18:13:29Z

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
Vulnerability: GHSA-qh9q-34h6-hcv9
Summary: Directory traversal in mkdocs
Aliases: CVE-2021-40978
Severity: HIGH
CVSS score: 7.5
CWE: CWE-12, CWE-22
Published: 2021-10-12T18:48:24Z

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information.
Vulnerability: GHSA-55w9-c3g2-4rrh
Summary: Man-in-the-middle attack in Apache Axis
Aliases: CVE-2012-5784
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2020-10-07T17:51:02Z

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Vulnerability: GHSA-27gm-ghr9-4v95
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-01-30T21:22:15Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in: the core parser, `paste` and `visualchars` plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.6 or lower and TinyMCE 5.1.3 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.7 and 5.1.4 by improved parser logic and HTML sanitization.

### Workarounds
The workarounds available are:
- disable the impacted plugins
- manually sanitize the content using the `BeforeSetContent` event (see below)
- upgrade to either TinyMCE 4.9.7 or TinyMCE 5.1.4

#### Example: Manually sanitize content
```js
editor.on('BeforeSetContent', function(e) {
  var sanitizedContent = ...; // Manually sanitize content here
  e.content = sanitizedContent;
});
```

### Acknowledgements
Tiny Technologies would like to thank Michał Bentkowski for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)