TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-vqqx-jw6p-q3rf
Summary: Cross-Site Scripting in Fluid view helpers
Aliases: CVE-2020-26227
Severity: MODERATE
CWE: CWE-79
Published: 2020-12-21T16:28:11Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7)
> * CWE-79

### Problem
It has been discovered that system extension Fluid (`typo3/cms-fluid`) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.

```
<f:form ... fieldNamePrefix="{payload}" />
<f:be.labels.csh ... label="{payload}" />
<f:be.menus.actionMenu ... label="{payload}" />
```

### Solution
Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2020-010](https://typo3.org/security/advisory/typo3-core-sa-2020-010)
Vulnerability: GHSA-6xj3-fhrf-rjgc
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-1504
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-28T00:00:34Z

XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
Vulnerability: GHSA-9f46-5r25-5wfm
Summary: Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
Aliases: CVE-2021-32708
Severity: CRITICAL
CWE: CWE-367
Published: 2021-06-29T03:13:28Z

### Impact

The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.

The conditions: 

- A user is allowed to supply the path or filename of an uploaded file.
- The supplied path or filename is not checked against unicode chars.
- The supplied pathname checked against an extension deny-list, not an allow-list.
- The supplied path or filename contains a unicode whitespace char in the extension.
- The uploaded file is stored in a directory that allows PHP code to be executed.

Given these conditions are met a user can upload and execute arbitrary code on the system under attack.

### Patches

The unicode whitespace removal has been replaced with a rejection (exception).

The library has been patched in:
- 1.x: https://github.com/thephpleague/flysystem/commit/f3ad69181b8afed2c9edf7be5a2918144ff4ea32
- 2.x: https://github.com/thephpleague/flysystem/commit/a3c694de9f7e844b76f9d1b61296ebf6e8d89d74

### Workarounds

For 1.x users, upgrade to 1.1.4. For 2.x users, upgrade to 2.1.1.
Vulnerability: GHSA-wwvv-x5mq-h3jj
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev
Aliases: CVE-2021-3692
Severity: MODERATE
CWE: CWE-338, CWE-330
Published: 2021-09-01T18:35:26Z

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Vulnerability: GHSA-fvrf-9428-527m
Summary: Backport for CVE-2021-21024 Blind SQLi from Magento 2
Aliases: CVE-2021-21427
Severity: CRITICAL
CWE: CWE-89
Published: 2021-04-22T16:11:01Z

### Impact
This vulnerability allows an administrator unauthorized access to restricted resources. 

We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. 


### Patches
_Has the problem been patched? What versions should users upgrade to?_
> v20.0.9 v19.4.13
Vulnerability: GHSA-3pg8-c473-w6rr
Summary: Stored Cross-site Scripting in showdoc
Aliases: CVE-2022-0967
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:46Z

ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.
Vulnerability: GHSA-v2f3-f8x4-m3w8
Summary: Cross Site Scripting in LavaLite CMS
Aliases: CVE-2020-23234
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-09T20:38:54Z

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
Vulnerability: GHSA-r6g8-jmj9-g945
Summary: Improper Restriction of Rendered UI Layers or Frames in yourls
Aliases: CVE-2021-3734
Severity: MODERATE
CWE: CWE-352, CWE-1021
Published: 2021-08-30T16:22:16Z

yourls is vulnerable to Improper Restriction of Rendered UI Layers or Frames
Vulnerability: GHSA-8jmh-c6vr-pmvm
Summary: SQL Injection in pimcore
Aliases: CVE-2020-7759
Severity: HIGH
CWE: CWE-89
Published: 2021-05-06T18:53:55Z

"The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}]"
Vulnerability: GHSA-p696-gf58-9w97
Summary: Missing Authentication for Critical Function
Aliases: CVE-2021-32709
Severity: MODERATE
CWE: CWE-306
Published: 2021-06-29T17:23:10Z

Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-qvhr-55hg-3qwv
Summary: Non-persistent XSS in the Storefront in Shopware
Severity: LOW
CWE: CWE-79
Published: 2020-09-23T17:20:39Z

### Impact
Non-persistent XSS in the Storefront

### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. 

For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
Vulnerability: GHSA-28fw-88hq-6jmm
Summary: Persistent XSS in shopping worlds
Severity: LOW
CWE: CWE-79
Published: 2020-11-13T18:26:03Z

### Impact
Persistent XSS in shopping worlds

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Vulnerability: GHSA-3rpf-5rqv-689q
Summary: PHP Code Injection by malicious function name in smarty
Aliases: CVE-2021-26120
Severity: CRITICAL
CWE: CWE-94
Published: 2021-02-26T19:53:24Z

Template authors could inject php code by choosing a malicous {function} name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher.
Vulnerability: GHSA-c676-mcw3-qg55
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3730
Severity: MODERATE
CWE: CWE-352
Published: 2021-08-25T14:50:08Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-6w4v-qr4m-97gg
Summary: Multi-Factor Authentication issue in Laravel Fortify
Aliases: CVE-2022-25838
Severity: HIGH
CWE: CWE-294
Published: 2022-02-25T00:01:01Z

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
Vulnerability: GHSA-m298-fh5c-jc66
Summary: Object injection in PHPMailer/PHPMailer
Aliases: CVE-2020-36326
Severity: CRITICAL
CWE: CWE-502, CWE-641
Published: 2021-05-04T17:42:13Z

### Impact
This is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8.  An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP's support for `.phar` files`. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info.

### Patches
This issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like *any* kind of URL are rejected.

### Workarounds
Validate paths to loaded files using the same pattern as used in [`isPermittedPath()`](https://github.com/PHPMailer/PHPMailer/blob/master/src/PHPMailer.php#L1815) before using them in *any* PHP file function, such as `file_exists`. This method can't be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to *all* user-supplied paths passed into such functions; it's not a problem specific to PHPMailer.

### Credit
This issue was found by Fariskhi Vidyan, reported and managed via Tidelift.
Vulnerability: GHSA-62m3-fc7f-jpp8
Summary: Class-Name Injection
Aliases: CVE-2019-10905
Severity: HIGH
CWE: CWE-79
Published: 2022-03-26T00:09:58Z

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.
Vulnerability: GHSA-ch3r-vp46-8g22
Summary: Code injection in topthink/think
Aliases: CVE-2020-17952
Severity: CRITICAL
CWE: CWE-74
Published: 2021-08-09T20:39:52Z

A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
Vulnerability: GHSA-hhw9-35p2-q2c5
Summary: Steam Socialite Provider v1 does not correctly validate openid server
Severity: CRITICAL
CWE: CWE-346
Published: 2021-01-29T20:51:30Z

### Impact
The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.

### Patches
This vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)
* Email us at [socialite@atymic.dev](mailto:socialite@atymic.dev)
Vulnerability: GHSA-4jp3-q2qm-9fmw
Summary: Improper Restriction of Rendered UI Layers or Frames in Sylius
Aliases: CVE-2022-24733
Severity: MODERATE
CWE: CWE-1021
Published: 2022-03-14T21:55:33Z

### Impact

It is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker

### Patches

The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2, and above.

### Workarounds

Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that you just need to add a new **subscriber** in your app. 

```php
<?php

// src/EventListener/XFrameOptionsSubscriber.php

namespace App\EventListener

final class XFrameOptionsSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::RESPONSE => 'onKernelResponse',
        ];
    }

    public function onKernelResponse(ResponseEvent $event): void
    {
        if (!$this->isMainRequest($event)) {
            return;
        }

        $response = $event->getResponse();

        $response->headers->set('X-Frame-Options', 'sameorigin');
    }

    private function isMainRequest(ResponseEvent $event): bool
    {
        if (\method_exists($event, 'isMainRequest')) {
            return $event->isMainRequest();
        }

        return $event->isMasterRequest();
    }
}

```

And register it in the container:

```yaml
# config/services.yaml
services:
    # ...
    App\EventListener\XFrameOptionsSubscriber:
        tags: ['kernel.event_subscriber']
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-w68r-5p45-5rqp
Summary: Improper Input Validation in Laravel
Aliases: CVE-2020-24941
Severity: HIGH
CWE: CWE-863
Published: 2021-05-06T18:54:20Z

An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions.
Vulnerability: GHSA-r67m-m8c7-jp83
Summary: Forced reinstall
Aliases: CVE-2021-39173
Severity: HIGH
CWE: CWE-704
Published: 2021-08-30T16:11:33Z

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can trick Cachet and install the instance again, leading to arbitrary code execution on the server.

### Patches

This issue was addressed by improving the middleware `ReadyForUse`, which now performs a stricter validation of the instance name. 

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-5vf7-q87h-pg6w
Summary: Cross-Site Scripting in BookStack
Aliases: CVE-2020-11055
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-07T21:10:26Z

### Impact

A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines.

This most impacts scenarios where not-trusted users are given permission to create comments.

### Patches

The issue was addressed in BookStack v0.29.2.

After upgrading, The command `php artisan bookstack:regenerate-comment-content` should be ran to remove any pre-existing dangerous content. 

### Workarounds

Comments can be disabled in the system settings to prevent them being shown to users. Alternatively, comment creation permissions can be altered as required to only those who are trusted but this will not address existing exploitation of this vulnerability. 

### References

* [BookStack Beta v0.29.2](https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2)
* JVN#41035278
* [BookStack Blog Post](https://bookstackapp.com/blog/beta-release-v0-29-2/)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the BookStack GitHub repository](BookStackApp/BookStack/issues).
* Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).
* Follow the [BookStack Security Advice](https://github.com/BookStackApp/BookStack#-security) to contact someone privately.
Vulnerability: GHSA-36m2-8rhx-f36j
Summary: Sandbox bypass in Latte templates
Aliases: CVE-2022-21648
Severity: HIGH
CWE: CWE-79
Published: 2022-01-06T23:17:07Z

### Impact
The problem affects users who use the sandbox in Latte and templates from untrusted sources.

### Patches
Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. 

### References
The issues were discovered by
- JinYiTong (https://github.com/JinYiTong)
- 赵钰迪 <20212010122@fudan.edu.cn>
Vulnerability: GHSA-3r8j-pmch-5j2h
Summary: Internal exception message exposure for login action in Sylius
Aliases: CVE-2019-16768
Severity: LOW
CWE: CWE-209
Published: 2019-12-05T19:57:04Z

## Internal exception message exposure for login action

### Impact
Exception messages from internal exceptions (like database exception) are wrapped by `\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. 

A validation message with the exception details will be presented to the user when one will try to log into the shop. 

### Patches
_Has the problem been patched? What versions should users upgrade to?_

### Workarounds
The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` file should be overridden and lines https://github.com/Sylius/Sylius/blob/1.4/src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig#L13-L17 should be replaced with
```twig
        {% if last_error %}
            <div class="ui left aligned basic segment">
                {{ messages.error(last_error.messageKey) }}
            </div>
        {% endif %}
``` 

The `messageKey` field should be used instead of the `message`.
Vulnerability: GHSA-jc4v-vvg6-xg78
Summary: SQL Injection in ImpressCMS
Aliases: CVE-2021-26599
Severity: CRITICAL
CWE: CWE-89
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
Vulnerability: GHSA-x8wj-cqmp-3wmm
Summary: Cross-site Scripting in Zenario CMS
Aliases: CVE-2021-41952
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:00:59Z

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.
Vulnerability: GHSA-fpff-384j-vxq7
Summary: Data leakage via SQL Injection in Pimcore
Aliases: CVE-2019-10763
Severity: MODERATE
CWE: CWE-89
Published: 2019-12-02T18:05:13Z

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.
Vulnerability: GHSA-mcxr-fx5f-96qq
Summary: Server-Side Request Forgery in Concrete CMS
Aliases: CVE-2021-22969
Severity: MODERATE
CWE: CWE-918
Published: 2021-11-23T18:18:35Z

Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer.
Vulnerability: GHSA-hwqc-pgjw-vjqp
Summary: Cross-Site Request Forgery in GilaCMS
Aliases: CVE-2020-20693
Severity: HIGH
CWE: CWE-352
Published: 2021-09-30T17:13:11Z

A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.
Vulnerability: GHSA-g2qj-pmxm-9f8f
Summary: User enumeration in authentication mechanisms
Severity: LOW
CWE: CWE-200
Published: 2021-05-17T20:52:32Z

Description
-----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.

Resolution
----------

We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011) for branch 3.4.

Credits
-------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Vulnerability: GHSA-68q3-7wjp-7q3j
Summary: The filename of uploaded files vulnerable to stored XSS
Aliases: CVE-2020-4041
Severity: MODERATE
CWE: CWE-79
Published: 2020-06-09T00:25:34Z

### Impact

The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. 

Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.

### Patches

This is fixed in Bolt 3.7.1.

### References

Related issue: https://github.com/bolt/bolt/pull/7853
Vulnerability: GHSA-58mj-pw57-4vm2
Summary: Cross-site scripting in PHPMailer
Aliases: CVE-2017-11503
Severity: MODERATE
CWE: CWE-79
Published: 2020-03-05T22:09:13Z

PHPMailer versions prior to 5.2.24 (released July 26th 2017) have an XSS vulnerability in one of the code examples, CVE-2017-11503. The code_generator.phps example did not filter user input prior to output. This file is distributed with a `.phps` extension, so it it not normally executable unless it is explicitly renamed, and the file is not included when PHPMailer is loaded through composer, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.

### Impact
PHPMailer 5.2.23 has XSS in the &quot;From Email Address&quot; and &quot;To Email Address&quot; fields of code_generator.php.

### Patches
Fixed in 5.2.24

### Workarounds
None.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-11503

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-4w23-c97g-fq5v
Summary: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4130
Severity: HIGH
CWE: CWE-352
Published: 2022-01-05T20:33:16Z

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-2r2w-jrh2-p4gr
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-31274
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-09T17:08:55Z

In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.
Vulnerability: GHSA-5h7w-hmxc-99g5
Summary: Cross site scripting in safe-svg
Aliases: CVE-2022-1091
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-19T00:00:45Z

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
Vulnerability: GHSA-gqpw-9q54-9x28
Summary: Server-Side Request Forgery in Concrete CMS
Aliases: CVE-2021-22970
Severity: MODERATE
CWE: CWE-918
Published: 2021-11-23T18:18:43Z

Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.
Vulnerability: GHSA-m496-x567-f98c
Summary: Fixes a bug in Zend Framework's Stream HTTP Wrapper
Aliases: CVE-2021-21426
Severity: CRITICAL
CWE: CWE-502
Published: 2021-04-22T16:10:49Z

### Impact
CVE-2021-3007: Backport of Zend_Http_Response_Stream, added certain type checking as a way to prevent exploitation. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3007

This vulnerability is caused by the unsecured deserialization of an object. In versions higher than Zend Framework 3.0.0, the attacker abuses the Zend3 feature that loads classes from objects in order to upload and execute malicious code in the server. The code can be uploaded using the “callback” parameter, which in this case inserts a malicious code instead of the “callbackOptions” array.


### Patches
_Has the problem been patched? What versions should users upgrade to?_
v20.0.9 v19.4.13
Vulnerability: GHSA-7v7w-f7c6-f829
Summary: yetiforcecrm is vulnerable to Business Logic Errors
Aliases: CVE-2021-4111
Severity: HIGH
Published: 2021-12-16T21:01:15Z

yetiforcecrm is vulnerable to Business Logic Errors.
Vulnerability: GHSA-952p-fqcp-g8pc
Summary: HTML injection possibility in voucher code form in Shopware
Aliases: CVE-2022-24746
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-10T17:49:26Z

### Impact
HTML injection possibility in voucher code form

## Patches
Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-v3f6-f29f-rgvp
Summary: Missing Authorization in Drupal
Aliases: CVE-2017-6923
Severity: MODERATE
CWE: CWE-862
Published: 2019-10-10T19:31:31Z

In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.
Vulnerability: GHSA-gpmh-g94g-qrhr
Summary: Internal hidden fields are visible on to many associations in admin api
Severity: MODERATE
Published: 2021-06-28T18:20:53Z

### Impact
The admin api has exposed some internal hidden fields when an association has been loaded with a to many reference

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-699q-wcff-g9mj
Summary: Unsafe deserialization in Yii 2
Aliases: CVE-2020-15148
Severity: HIGH
CWE: CWE-502
Published: 2020-09-15T18:19:56Z

### Impact

Remote code execution in case application calls `unserialize()` on user input containing specially crafted string.

### Patches

2.0.38

### Workarounds

Add the following to BatchQueryResult.php:

```php
public function __sleep()
{
    throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
}

public function __wakeup()
{
    throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
```

### For more information

If you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).
Vulnerability: GHSA-5jxc-hmqf-3f73
Summary: Cross-Site Scripting in grav
Aliases: CVE-2021-3904
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-01T19:17:31Z

grav prior to version 1.7.24 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-fp63-499m-hq6m
Summary: Files or Directories Accessible to External Parties in ether/logs
Aliases: CVE-2021-32752
Severity: HIGH
CWE: CWE-552
Published: 2021-07-12T16:53:00Z

### Impact
A vulnerability was found that allowed authenticated admin users to access any file on the server.

### Patches
The vulnerability has been fixed in 3.0.4.

### Workarounds
We recommend disabling the plugin if untrustworthy sources have admin access.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [ether/logs](https://github.com/ethercreative/logs/issues)
Vulnerability: GHSA-53m6-44rc-h2q5
Summary: Missing server signature validation in OctoberCMS
Aliases: CVE-2022-23655
Severity: MODERATE
CWE: CWE-347
Published: 2022-02-24T13:09:30Z

### Impact

This advisory affects authors of plugins and themes listed on the October CMS marketplace where an end-user will inadvertently expose authors to potential financial loss by entering their private license key into a compromised server.

It has been disclosed that a project fork of October CMS v1.0 is using a compromised gateway to access the October CMS marketplace service. The compromised gateway captures the personal/business information of users and authors, including private source code files. It was also disclosed that captured plugin files are freely redistributed to other users without authorization.

1. End-users are provided with a forked version of October CMS v1.0. The provided software is modified to use a compromised gateway server.

2. The user is instructed to enter their October CMS license key into the administration panel to access the October CMS marketplace. The key is sent to the compromised server while appearing to access the genuine October CMS gateway server.

3. The compromised gateway server uses a "man in the middle" mechanism that captures information while forwarding the request to the genuine October CMS gateway and relaying the response back to the client.

4. The compromised gateway server stores the license key and other information about the user account including client name, email address and contents of purchased plugins and privately uploaded plugin files. 

5. The stored plugin files are made available to other users of the compromised gateway server.

### Patches

The issue has been patched in Build 475 (v1.0.475) and v1.1.11.

### Workarounds

Apply https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a to your installation manually if unable to upgrade to Build 475 or v1.1.11.

### Recommendations

We recommend the following steps to make sure your account information stays secure:

- Do not share your license key with anyone except October CMS.
- Check to make sure that your gateway update server has not been modified.
- Be aware of phishing websites, including other platforms that use the same appearance.
- For authors, you may contact us for help requesting the removal of affected plugins.
- Before providing plugin support, verify that the user holds a legitimate copy of the plugin.

### References

Credits for research on this exploit:
• Nikita Khaetsky

### For more information

If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-qwpp-fgrj-h78q
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32712
Severity: MODERATE
CWE: CWE-200
Published: 2021-09-08T17:59:46Z

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
Vulnerability: GHSA-g4m9-5hpf-hx72
Summary: Firewall configured with unanimous strategy was not actually unanimous in Symfony
Aliases: CVE-2020-5275
Severity: HIGH
CWE: CWE-285
Published: 2020-03-30T20:09:44Z

Description
-----------

On Symfony before 4.4.0, when a `Firewall` checks an access control rule (using the unanimous strategy), it iterates over all rule attributes and grant access only if *all* calls to the `accessDecisionManager` decide to grant access.

As of Symfony 4.4.0, a bug was introduced that prevents the check of attributes as soon as `accessDecisionManager` decide to grant access on one attribute.

Resolution
----------

The `accessDecisionManager` is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. 

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf) for the 4.4 branch.

Credits
-------

I would like to thank Antonio J. García Lagar for reporting & Robin Chalas for fixing the issue.
Vulnerability: GHSA-59qh-g7m4-j9m9
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0374
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T23:06:12Z

Stored XSS attacks exist in new the form creation flow. New forms can be given a title which will render javascript.
Vulnerability: GHSA-m5vr-3m74-jwxp
Summary: Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
Aliases: CVE-2020-15098
Severity: HIGH
CWE: CWE-327, CWE-200, CWE-325, CWE-20, CWE-502
Published: 2020-07-29T16:15:19Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2)
> * CWE-325, CWE-20, CWE-200, CWE-502

### Problem
It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below.

* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007), [CVE-2020-15099](https://nvd.nist.gov/vuln/detail/CVE-2020-15099): Potential Privilege Escalation
  + the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network)
  + `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5, high)
* [TYPO3-CORE-SA-2016-013](https://typo3.org/security/advisory/typo3-core-sa-2016-013), [CVE-2016-5091](https://nvd.nist.gov/vuln/detail/CVE-2016-5091): Insecure Deserialization & Remote Code Execution
  + an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation
  + `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1, critical)

The overall severity of this vulnerability is **high (8.2)** based on mentioned attack chains and the requirement of having a valid backend user session (authenticated).

### Solution
Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2020-008](https://typo3.org/security/advisory/typo3-core-sa-2020-008)
Vulnerability: GHSA-2v82-5746-vwqc
Summary: XSS in doc_link
Aliases: CVE-2021-29625
Severity: HIGH
CWE: CWE-79
Published: 2022-03-18T17:49:28Z

### Impact
Users of MySQL, MariaDB, PgSQL and SQLite are affected. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected.

### Patches
Patched by 4043092, included in version [4.8.1](https://github.com/vrana/adminer/releases/tag/v4.8.1).

### Workarounds
Do both:
* Use browser supporting strict CSP.
* Enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).

### References
https://sourceforge.net/p/adminer/bugs-and-features/797/

### For more information
If you have any questions or comments about this advisory:
* Comment at 4043092.
Vulnerability: GHSA-3pc2-fm7p-q2vg
Summary: Cross-site Scripting in October
Aliases: CVE-2020-4061
Severity: LOW
CWE: CWE-79
Published: 2020-07-02T16:55:11Z

### Impact
Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack.

### Patches
Issue has been patched in Build 467 (v1.0.467).

### Workarounds
Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually if unable to upgrade to Build 467.

### References
- https://research.securitum.com/the-curious-case-of-copy-paste/

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Low given that by the nature of the attack it can only impact users that do it to themselves by copying and pasting from malicious websites.

### Acknowledgements

Thanks to [Michał Bentkowski of Securitum](https://research.securitum.com/authors/michal-bentkowski/) for finding the original issue in Froala and @tomaszstrojny for reporting the issue to the October CMS team.
Vulnerability: GHSA-hf9p-9r39-r2h3
Summary: Unrestricted Uploads in Concrete5
Aliases: CVE-2020-11476
Severity: HIGH
CWE: CWE-434
Published: 2021-11-03T17:29:29Z

Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.
Vulnerability: GHSA-f7xw-46vh-5jw2
Summary: livehelperchat is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4132
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-05T20:33:47Z

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-rgcg-28xm-8mmw
Summary: Cross-Site Scripting in Backend Grid View
Aliases: CVE-2021-32669
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-22T19:37:41Z

### Problem
Failing to properly encode settings for _backend layouts_, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.
Vulnerability: GHSA-8c5p-4362-9333
Summary: Path traversal in grav
Aliases: CVE-2021-3924
Severity: HIGH
CWE: CWE-22
Published: 2021-11-10T16:48:15Z

grav is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerability: GHSA-2v88-qq7x-xq5f
Summary: Improper Encoding or Escaping of Output in Asset Metadata Component
Aliases: CVE-2021-39170
Severity: HIGH
CWE: CWE-79, CWE-116
Published: 2021-09-01T18:21:55Z

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually.
Vulnerability: GHSA-6gw4-x63h-5499
Summary: Ability to switch customer email address on account detail page and stay verified
Aliases: CVE-2020-15245
Severity: MODERATE
CWE: CWE-79, CWE-862
Published: 2020-10-19T20:40:59Z

### Impact
The user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one).

### Patches
Patch has been provided for Sylius 1.6.x and newer - 1.6.9, 1.7.9, 1.8.3. Versions older than 1.6 are not covered by our security support anymore.

### Workarounds
If for whatever reason you are not able to upgrade your application version, you may resolve this issue on your own by creating a custom event listener, which will listen to the `sylius.customer.pre_update` event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain `/admin` prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here.

### Acknowledgements

This security issue has been reported by Mircea Silviu (@decemvre), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-m72g-42q6-gvc2
Summary: Cross-site Scripting in LaraCMS
Aliases: CVE-2020-20129
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-04T20:13:11Z

LaraCMS contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content editor.
Vulnerability: GHSA-f4hh-xxqh-wgpq
Summary: Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS
Aliases: CVE-2019-10667
Severity: MODERATE
CWE: CWE-200
Published: 2019-10-11T18:43:20Z

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths.
Vulnerability: GHSA-q8hg-pf8v-cxrv
Summary: Non-constant time comparison in UriSigner
Aliases: CVE-2019-18887
Severity: HIGH
Published: 2022-03-26T00:22:49Z

When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
Vulnerability: GHSA-xhr8-mpwq-2rr2
Summary: Automatic named constructor discovery in Valinor
Severity: HIGH
Published: 2022-04-01T13:39:45Z

## Design issue - automatic constructor discovery

The issue arises when upgrading from `cuyz/valinor:0.3.0` to a newer system on an existing application, which broke due to the wrong constructor being picked.

Still, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228.

## Example exploit

Take following DTO example:

```php
final class UserDTO
{
    public function __construct(
        public int $id,
        public string $name
    ) {}
    public static function fromDb(
        PDO $connection,
        int $id
    ): self { /* ... code to fetch the DTO here ... */ }
}
```

There is nothing inherently unsafe about the above `UserDTO`, but when mixed with `cuyz/valinor:^0.5.0` ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix:

```php
// this could be coming from user input:
$maliciousPayload = [
    'connection' => [
      'dsn' => 'mysql:host=some-host;database=some-database',
      'username' => 'root',
      'password' => 'root',
      'options' => [
        // PDO::MYSQL_ATTR_INIT_COMMAND === 1002
        1002 => 'DROP DATABASE all-the-moneys'
      ]
    ],
    'id' => 123,
];

$treeMapper->map(
  UserDTO::class,
  $maliciousPayload
); // your DB is gone :D
```

The above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded.

## Mitigation

Version 0.7.0 contains a patch for this issue.

Automatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.
Vulnerability: GHSA-xcf7-cj8q-pcjm
Summary: XSS vulnerability in Author URL of themes in Mautic
Aliases: CVE-2018-11198
Severity: LOW
CWE: CWE-79
Published: 2021-01-19T21:16:14Z

### Impact
An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

### Patches
Update to 2.14 or later

### Workarounds
None

### References
https://github.com/mautic/mautic/releases/tag/2.14.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-5jfw-35xp-5m42
Summary: Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
Severity: HIGH
CWE: CWE-124
Published: 2022-04-05T17:53:22Z

### Impact
`LoginPacket` uses `BinaryStream->getLInt()` to read the lengths of JSON payloads it wants to decode. Unfortunately, `BinaryStream->getLInt()` returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing `BinaryStream->get()` to throw an exception.

In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.

### Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac

### Workarounds
This can be worked around by registering a custom `LoginPacket` implementation into `PacketPool` which overrides [this code](https://github.com/pmmp/BedrockProtocol/blob/47532c95ea37d5f0365b23f734d70d943ff95295/src/LoginPacket.php#L54) to patch it.

### For more information
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-57qf-82hh-2hmc
Summary: Cross-site Scripting in LiveHelperChat
Aliases: CVE-2022-0502
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-07T00:00:30Z

LiveHelperChat prior to version 3.93 is vulnerable to cross-site scripting.
Vulnerability: GHSA-8c9x-wfgj-v78w
Summary: Open Redirect in showdoc
Aliases: CVE-2021-4000
Severity: MODERATE
CWE: CWE-601
Published: 2021-12-16T15:31:58Z

showdoc is vulnerable to URL Redirection to Untrusted Site
Vulnerability: GHSA-h9vc-2p9g-63gp
Summary: Exposure of Sensitive Information to an Unauthorized Actor in pimcore
Aliases: CVE-2022-0565
Severity: HIGH
CWE: CWE-200
Published: 2022-02-15T00:02:47Z

Exposure of Sensitive Information to an Unauthorized Actor in Packagist pimcore/pimcore prior to 10.3.1.
Vulnerability: GHSA-7vxc-chqj-h83g
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4168
Severity: MODERATE
CWE: CWE-352
Published: 2022-01-06T22:02:18Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-xhfx-hgmf-v6vp
Summary: Potential Host Header Poisoning on misconfigured servers
Aliases: CVE-2021-21265
Severity: LOW
CWE: CWE-644
Published: 2021-03-10T21:07:25Z

### Impact
When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning:
- https://portswigger.net/web-security/host-header
- https://dzone.com/articles/what-is-a-host-header-attack

### Patches

A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application.

### Workarounds

- Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation manually if unable to upgrade to v1.1.2.

- Check that the configuration setting `cms.linkPolicy` is set to `force`.

### Alternative Workaround

Check to make sure that your web server does not accept any hostname when serving your web application.

1. Add an entry called `testing.tld` to your computer's host file and direct it to your server's IP address
2. Open the address `testing.tld` in your web browser
3. Make sure an October CMS website is not available at this address

If an October CMS website is returned, configure your webserver to only allow known hostnames. If you require assistance with this, please contact your server administrator.

### References

Reported by [Abdullah Hussam](https://github.com/ahussam)

### For More Information

If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
<img width="1108" alt="Screen Shot 2021-01-15 at 4 12 57 PM" src="https://user-images.githubusercontent.com/7253840/104783859-92fb3600-574c-11eb-9e21-c0dc05d230a9.png">