TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-c5f8-35qr-q4fm
Summary: HTML injection in email and account expiry notifications
Aliases: CVE-2021-21333
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-74
Published: 2021-03-26T19:53:04Z

### Impact
The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email.

The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.

### Patches
This issue is fixed in #9200.

### Workarounds
For the missed messages notifications:

The `notif.html`, `notif_mail.html`, and `room.html` templates can be overridden with custom templates that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.

For the account expiry notifications:

1. Account expiry can be disabled via the `account_validity.enabled` setting.

2. The `notice_expiry.html` template can be overridden with a custom template that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.
Vulnerability: GHSA-3hjg-vc7r-rcrw
Summary: Denial of Service vulnerability in @podium/layout and @podium/proxy
Aliases: CVE-2022-24822
Severity: HIGH
CVSS score: 7.5
CWE: CWE-248
Published: 2022-04-07T15:20:23Z

### Impact
An attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server.
All Podium layouts that include podlets with proxy endpoints are affected.

### Patches
`@podium/layout` which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.
`@podium/proxy` which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable.

### Workarounds
It is not easily possible to work around this issue without upgrading. We recommend upgrading `@podium/layout` and/or `@podium/proxy` as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [podium-lib/issues](https://github.com/podium-lib/issues)

### Credits
The vulnerability was reported by [krynos](https://hackerone.com/krynos) from [Ercoli Consulting](https://www.ercoliconsulting.eu/) via FINN.no's private bug bounty program
Vulnerability: GHSA-6cpc-mj5c-m9rq
Summary: Arbitrary File Write in cli
Aliases: CVE-2016-10538
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2019-02-18T23:40:03Z

Affected versions of `cli` use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the `cli` process has permission to write to.


## Proof of Concept

By creating Symbolic Links at the following locations, the target of the link can be written to.
```
lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';
```


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-crpm-fm48-chj7
Summary: SQL Injection in resquel
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2020-09-11T21:13:44Z

All versions of `resquel` are vulnerable to SQL Injection. Query parameters are not properly sanitized, allowing attackers to inject SQL statements and execute arbitrary SQL queries


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-fwvq-x4j9-hr5f
Summary: Malicious Package in bs58chekc
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:43:09Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-x67x-98x7-wv26
Summary: OS Command Injection in gulp-tape
Aliases: CVE-2020-7605
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-07T16:14:56Z

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of &#39;gulp-tape&#39; options.
Vulnerability: GHSA-cx2r-mf6x-55rx
Summary: Stored XSS with custom URLs in PrestaShop module ps_linklist
Aliases: CVE-2020-5273
Severity: MODERATE
CVSS score: 4.1
CWE: CWE-79
Published: 2021-10-12T16:01:36Z

### Impact
Stored XSS when using custom URLs.

### Patches
The problem is fixed in 3.1.0

### References
[Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)
Vulnerability: GHSA-934w-hvj4-7fr6
Summary: Path Traversal in jsreport-chrome-pdf
Aliases: CVE-2020-7762
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2021-04-13T15:25:15Z

This affects the package jsreport-chrome-pdf before 1.10.0.
Vulnerability: GHSA-f8mr-jv2c-v8mg
Summary: Invalid root may become trusted root in The Update Framework (TUF)
Aliases: CVE-2020-15163
Severity: HIGH
CVSS score: 8.7
CWE: CWE-863, CWE-345
Published: 2020-09-09T17:29:27Z

### Impact
The Python TUF reference implementation `tuf<0.12` will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a man-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates.

While investigating the reported vulnerability, we discovered that the detailed client workflow was not fully implemented. Specifically, for step 1.3 the newly downloaded root metadata was not being verified with a threshold of keys specified in the new root metadata file.
This missing step of the client workflow has been implemented in [PR #1101](https://github.com/theupdateframework/tuf/pull/1101), which is included in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0) of tuf.

### Patches
A [fix](https://github.com/theupdateframework/tuf/pull/885), is available in version [0.12](https://github.com/theupdateframework/tuf/releases/tag/v0.12.0) and newer.

### Workarounds
No workarounds are known for this issue.

### References
* Pull request resolving the invalid root becoming trusted issue [PR 885](https://github.com/theupdateframework/tuf/pull/885)
* Pull request implementing self verification of newly downloaded root metadata [PR 1101](https://github.com/theupdateframework/tuf/pull/1101)
Vulnerability: GHSA-vxfp-qmpq-6826
Summary: Malicious Package in hpmm
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:38:09Z

All versions of `hpmm` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m489-xr35-fjxr
Summary: Regular Expression Denial of Service in millisecond
Severity: MODERATE
CVSS score: 0
CWE: CWE-400, CWE-1333
Published: 2021-09-22T20:35:08Z

Versions of `millisecond` prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.


## Proof of concept
```
var ms = require('millisecond');
var genstr = function (len, chr) {
   var result = "";
   for (i=0; i<=len; i++) {
       result = result + chr;
   }

   return result;
}

ms(genstr(process.argv[2], "5") + " minutea");
```


## Recommendation

Update to version 0.1.2 or later.
Vulnerability: GHSA-h563-xh25-x54q
Summary: Workflow re-write vulnerability using input parameter
Aliases: CVE-2021-37914
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2021-08-09T20:37:50Z

### Impact

* Allow end-users to set input parameters, but otherwise expect workflows to be secure.

### Patches

Not yet.

### Workarounds

* Set `EXPRESSION_TEMPLATES=false` for the workflow controller


### References

* https://github.com/argoproj/argo-workflows/issues/6441

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Vulnerability: GHSA-rwv7-3v45-hg29
Summary: Out-of-bounds Read
Aliases: CVE-2021-25288
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-125
Published: 2021-06-08T18:49:28Z

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. This dates to Pillow 2.4.0.
Vulnerability: GHSA-wp77-4gmm-7cq8
Summary: Incorrect validation of `SaveV2` inputs
Aliases: CVE-2021-37648
Severity: HIGH
CVSS score: 7.8
CWE: CWE-476
Published: 2021-08-25T14:43:29Z

### Impact
The code for `tf.raw_ops.SaveV2` does not properly validate the inputs and an attacker can trigger a null pointer dereference:

```python
import tensorflow as tf

tf.raw_ops.SaveV2(
  prefix=['tensorflow'],
  tensor_name=['v'],
  shape_and_slices=[],
  tensors=[1,2,3])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/save_restore_v2_ops.cc) uses `ValidateInputs` to  check that the input arguments are valid. This validation would have caught the illegal state represented by the reproducer  above.

However, the validation uses `OP_REQUIRES` which translates to setting the `Status` object of the current `OpKernelContext` to an error status, followed by an empty `return` statement which just terminates the execution of the function it is present in. However, this does not mean that the kernel execution is finalized: instead, execution continues from the next line in `Compute` that follows the call to `ValidateInputs`. This is equivalent to lacking the validation.
      
### Patches
We have patched the issue in GitHub commit [9728c60e136912a12d99ca56e106b7cce7af5986](https://github.com/tensorflow/tensorflow/commit/9728c60e136912a12d99ca56e106b7cce7af5986).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.                                                                                                                                                                                                                                               

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-h6fg-mjxg-hqq4
Summary: Integer truncation in Shard API usage
Aliases: CVE-2020-15202
Severity: CRITICAL
CVSS score: 9
CWE: CWE-754, CWE-197
Published: 2020-09-25T18:28:35Z

### Impact
The `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/util/work_sharder.h#L59-L60

However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/random_op.cc#L204-L205
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/random_op.cc#L317-L318

In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption.

### Patches
We have patched the issue in 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575. We will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-3v7g-4pg3-7r6j
Summary: OS Command injection in Apache Airflow
Aliases: CVE-2022-24288
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2022-02-26T00:00:44Z

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Vulnerability: GHSA-pm3v-qxf6-fgxv
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0285
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-21T18:08:43Z

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
Vulnerability: GHSA-4vvg-x86p-mvqc
Summary: Leaking of user information on Cross-Domain communication in sysend
Aliases: CVE-2022-24762
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2022-03-14T22:43:23Z

### Impact
Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted.
This is not a big impact because it happens only on the same browser.

### Patches
It has been patched in version 1.10.0

### Workarounds
The only workaround is to not send sensitive information with sysend messages.
Vulnerability: GHSA-h8q5-g2cj-qr5h
Summary: Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
Aliases: CVE-2018-11796
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-17T15:43:25Z

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Vulnerability: GHSA-3f95-w5h5-fq86
Summary: Prototype Pollution in mergify
Severity: MODERATE
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-11T21:22:24Z

All versions of `mergify` are vulnerable to Prototype Pollution. The `mergify()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative module as the package is deprecated.
Vulnerability: GHSA-926x-m6m5-3mmp
Summary: OS Command Injection
Aliases: CVE-2019-10803
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-09T22:50:06Z

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable &quot;opt.branch&quot; is not validated before being provided to the &quot;git&quot; command within &quot;index.js#L139&quot;. This could be abused by an attacker to inject arbitrary commands.
Vulnerability: GHSA-w37c-q653-qg95
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-6416
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.
Vulnerability: GHSA-c497-v8pv-ch6x
Summary: Prototype pollution in nested-object-assign
Aliases: CVE-2021-23329
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-02-01T15:01:14Z

The package nested-object-assign before 1.0.4 is vulnerable to Prototype Pollution via the default function.
Vulnerability: GHSA-6hv3-7c34-4hx8
Summary: Information Exposure Through Environmental Variables
Aliases: CVE-2019-14802
Severity: HIGH
CVSS score: 3.1
CWE: CWE-526
Published: 2022-02-15T01:57:18Z

In Nomad before version 0.9.5, when rendering a task template, all environment variables were available to the rendering task.  As a fix, only task environment variables are used.
Vulnerability: GHSA-74hv-qjjq-h7g5
Summary: datasette-graphql leaks details of the schema of private database files
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2020-11-24T22:59:08Z

### Impact

When running against a Datasette instance with private databases, `datasette-graphql` would expose the schema of those database tables - but not the table contents.

### Patches

Patched in version 1.2.

### Workarounds

This issue is only present if a Datasette instance that includes private databases and has the `datasette-graphql` plugin installed is available on the public internet. Uninstalling the `datasette-graphql` plugin or preventing public access to the instance can workaround this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [datasette-graphql](https://github.com/simonw/datasette-graphql)
* Contact [@simonw](https://twitter.com/simonw) by Twitter direct message
Vulnerability: GHSA-5g4r-87v2-jqvx
Summary: Downloads Resources over HTTP in apk-parser
Aliases: CVE-2016-10564
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:05:44Z

apk-parser is a tool to extract Android Manifest info from an APK file.

apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

Update to version 0.1.6 or later.
Vulnerability: GHSA-3w6p-8f82-gw8r
Summary: Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-17T20:42:38Z

### Impact

ClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.

### Patches

The patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`.

### Workarounds

1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker
2. Alternatively, you can issue below command to remove `JMSAppender.class`:

```(bash)
# install zip command if you don't have
apt-get update && apt-get install -y zip
# remove the class
zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class
```

### References

Please refer to [CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) to read more.

### For more information

If you have any questions or comments about this advisory, please feel free to open an issue in the repository.
Vulnerability: GHSA-vp8g-53fw-r9f2
Summary: Malicious Package in dynamo-schema
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:54:44Z

Version 0.0.3 of `dynamo-schema` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.3 of this module is found installed you will want to replace it with a version before or after 0.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8vq6-5f66-hp3r
Summary: Logic error in dolibarr/dolibarr
Aliases: CVE-2022-0746
Severity: MODERATE
CVSS score: 4.3
Published: 2022-02-26T00:00:44Z

In dolibarr/dolibarr prior to 16.0 any low privileged users could update their login name which should only be updated by admin.
Vulnerability: GHSA-xp4x-j9vh-c3wf
Summary: OS Command Injection and Command Injection in kill-port-process
Aliases: CVE-2019-15609
Severity: HIGH
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2022-02-10T20:20:31Z

The kill-port-process package version &lt; 2.2.0 is vulnerable to a Command Injection vulnerability.
Vulnerability: GHSA-w96g-3p64-63wr
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV 
Aliases: CVE-2017-12601
Severity: HIGH
CVSS score: 8.8
CWE: CWE-119, CWE-120
Published: 2021-10-12T22:01:23Z

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case.
Vulnerability: GHSA-xg2h-wx96-xgxr
Summary: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be
Severity: LOW
CVSS score: 0
Published: 2021-05-21T16:26:06Z

### Impact

A security-sensitive bug was discovered by Open Source Developer *Erik Sundell of Sundell Open Source Consulting AB*.

The functions `RandomAlphaNumeric(int)` and `CryptoRandomAlphaNumeric(int)` are not as random as they should be. Small values of `int` in the functions above will return a smaller subset of results than they should. For example, `RandomAlphaNumeric(1)` will always return a digit in the 0-9 range, while `RandomAlphaNumeric(4)` will return around ~7 million of the ~13M possible permutations.

This is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision.

The problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from `[0-9]`. That restriction has been removed.

### Patches

This issue has been corrected in v1.0.2.

### Workarounds

If you cannot upgrade to v1.0.2, you can work around the issue by calling `RandomAlphaNumericCustom(N, true, true)`|`CryptoRandomAlphaNumericCustom(N, true, true)`  instead. (Where `N` is the desired length, and `true` is the literal boolean `true`.)
Vulnerability: GHSA-wc4g-r73w-x8mm
Summary: Insecure temporary file in Tensorflow
Aliases: CVE-2022-23563
Severity: HIGH
CVSS score: 7.1
CWE: CWE-668, CWE-367
Published: 2022-02-09T23:54:51Z

### Impact
In multiple places, TensorFlow uses `tempfile.mktemp` to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in `mktemp` and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness).

In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the `mktemp` function usage.

### Patches
We have patched the issue in several commits, replacing `mktemp` with the safer `mkstemp`/`mkdtemp` functions, according to the usage pattern.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported on huntr.dev for one scenario and discovered via variant analysis on other instances.
Vulnerability: GHSA-9gj3-hwp5-pmwc
Summary: XSS in the `altField` option of the Datepicker widget in jquery-ui
Aliases: CVE-2021-41182
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2021-10-26T14:55:02Z

### Impact
Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
```js
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
```
will call the `doEvilThing` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `altField` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-36xw-fx78-c5r4
Summary: containerd-shim API Exposed to Host Network Containers
Aliases: CVE-2020-15257
Severity: MODERATE
CVSS score: 5.2
CWE: CWE-669
Published: 2021-05-24T17:00:22Z

## Impact

Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges.

## Patches

This vulnerability has been fixed in containerd 1.3.9 and 1.4.3.  Users should update to these versions as soon as they are released.  It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade.

## Workarounds

If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with `docker run --net=host` or `hostNetwork: true` in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue.

If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to `deny unix addr=@**,` to your policy.

It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces.  The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.

## Credits

The containerd maintainers would like to thank Jeff Dileo of NCC Group for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/master/SECURITY.md) and for reviewing the patch.

## For more information

If you have any questions or comments about this advisory:


* [Open an issue](https://github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io if you think you’ve found a security bug.
Vulnerability: GHSA-r2qc-w64x-6j54
Summary: XSS in Vega
Aliases: CVE-2020-26296
Severity: LOW
CVSS score: 8.7
CWE: CWE-79
Published: 2020-12-30T23:09:21Z

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package.
In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could
execute arbitrary javascript on a victim's machine.

This is fixed in version 5.17.3
Vulnerability: GHSA-wwgf-3xp7-cxj4
Summary: Potentially sensitive data exposure in Symfony Web Socket Bundle
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2020-07-07T16:33:45Z

### Impact
Inside `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\Bundle\WebSocketBundle\Topic\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.

### Patches
In 1.10.4, 2.6.1, and 3.3.0, `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` fails.

### Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0

Note, the 1.x branch is considered end of support as of July 1, 2020.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)
Vulnerability: GHSA-9qj9-36jm-prpv
Summary: Regular Expression Denial of Service in fresh
Aliases: CVE-2017-16119
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:16:57Z

Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.


## Recommendation

Update to version 0.5.2 or later.
Vulnerability: GHSA-cc2p-4jhr-xhhx
Summary: False-positive validity for NFT1 genesis transactions in SLPJS
Aliases: CVE-2020-15130
Severity: CRITICAL
CVSS score: 7.5
CWE: CWE-697
Published: 2020-07-30T14:58:42Z

### Impact
In the npm package named "slpjs", versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

### Patches
npm package "slpjs" has been patched and is published and tagged as version 0.27.4.

### Workarounds
Upgrade to slpjs 0.27.4.

### References
* Package location: https://www.npmjs.com/package/slpjs
* SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
* Git commit hash fixing this issue: https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
* Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7

### For more information
If you have any questions or comments about this advisory please open an issue in the [slp-validate](https://github.com/simpleledger/slpjs/issues) repository.
Vulnerability: GHSA-24ww-mc5x-xc43
Summary: Man-in-the-middle attack in Apache Cassandra
Aliases: CVE-2020-13946
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-668
Published: 2021-05-07T15:54:46Z

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.
Vulnerability: GHSA-767j-jfh2-jvrc
Summary: Potential HTTP request smuggling in Apache Tomcat
Aliases: CVE-2019-17569
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-444
Published: 2020-02-28T01:10:58Z

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Vulnerability: GHSA-v9j2-q4q5-cxh4
Summary: No CSRF protection on the password change form
Aliases: CVE-2021-32730
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-352
Published: 2021-07-02T19:19:13Z

### Impact
It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki.

### Patches
The problem has been patched in XWiki 12.10.5, 13.2RC1.

### Workarounds
It's possible to apply the patch manually by modifying the `register_macros.vm` template like in https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257.

### References
https://jira.xwiki.org/browse/XWIKI-18315

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-2rqw-v265-jf8c
Summary: Open Redirect in ActionPack
Aliases: CVE-2021-22942
Severity: HIGH
CVSS score: 0
CWE: CWE-601
Published: 2021-08-26T20:36:51Z

# Overview

There is a possible open redirect vulnerability in the Host Authorization
middleware in Action Pack. This vulnerability has been assigned the CVE
identifier CVE-2021-22942.

Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1

# Impact

Specially crafted “X-Forwarded-Host” headers in combination with certain
“allowed host” formats can cause the Host Authorization middleware in
Action Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot.
For example, configuration files that look like this:

```ruby
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted
Host header can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not
take in to account domain name case sensitivity.

# Releases

The fixed releases are available at the normal locations.

# Workarounds

In the case a patch can’t be applied, the following monkey patch can be
used in an initializer:

```ruby
module ActionDispatch
  class HostAuthorization
    HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
    VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
    VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/

    private
      def authorized?(request)
        origin_host =
          request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
        forwarded_host =
          request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
        @permissions.allows?(origin_host) &&
          (forwarded_host.blank? || @permissions.allows?(forwarded_host))
      end
  end
end
```
Vulnerability: GHSA-7r2x-3qcm-8vfw
Summary: Downloads Resources over HTTP in herbivore
Aliases: CVE-2016-10665
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:36Z

Affected versions of `herbivore` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `herbivore`.


## Recommendation

The module author has rewritten much of the package, and in that process, patched the vulnerability, but has not published any of the new code to npm.  

In order to get an updated version, it is necessary to install the package from github. This can be done using the following command:
```
npm i samatt/herbivore
```
Vulnerability: GHSA-cph5-m8f7-6c5x
Summary: Incorrect Comparison in axios
Aliases: CVE-2021-3749
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-697
Published: 2021-09-01T18:23:02Z

axios is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-3756-hwhv-qw58
Summary: Cross site scripting in francoisjacquet/rosariosis
Aliases: CVE-2021-44566
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-25T00:01:08Z

A Cross Site Scripting vulnerability exists RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
Vulnerability: GHSA-q9wr-gcjc-hq52
Summary: Prototype Pollution in reggae
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:12:13Z

All versions of `reggae` are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object's prototype, which may allow a malicious to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6jv7-28mv-qp9c
Summary: Missing permission check in Jenkins autonomiq Plugin
Aliases: CVE-2022-25195
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2022-02-16T00:01:23Z

A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Vulnerability: GHSA-c3gv-9cxf-6f57
Summary: Cross-site Scripting in Loofah
Aliases: CVE-2019-15587
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2019-11-05T23:58:25Z

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Vulnerability: GHSA-fr28-569j-53c4
Summary: Incorrect Default Permissions
Aliases: CVE-2020-24584
Severity: HIGH
CVSS score: 7.5
CWE: CWE-276
Published: 2021-03-18T20:30:01Z

An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used). The intermediate-level directories of the filesystem cache had the system's standard umask rather than 0o077.
Vulnerability: GHSA-2pwh-52h7-7j84
Summary: JavaScript execution via malicious molfiles (XSS)
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-04-16T19:52:49Z

### Impact
The viewer plugin implementation of `<mol:molecule>` renders molfile data directly inside a `<script>` tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.

### Patches
Patched in v0.3.0: Molfile data is now rendered as value of a hidden `<input>` tag and escaped via JSF's mechanisms.

### Workarounds
No workaround available.
Vulnerability: GHSA-fx7m-j728-mjw3
Summary: Moderate severity vulnerability that affects uap-core
Aliases: CVE-2018-20164
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-185
Published: 2019-03-06T17:35:47Z

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
Vulnerability: GHSA-jqjg-v355-hr9q
Summary: Malicious Package in buffer-xop
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:11:02Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-cv3v-7846-6pxm
Summary: Unauthorized File Access in node-git-server
Severity: HIGH
CVSS score: 7.5
CWE: CWE-552
Published: 2020-09-03T21:15:19Z

Versions of `node-git-server` prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories.


## Recommendation

Upgrade to version 0.6.1 or later.
Vulnerability: GHSA-q324-q795-2q5p
Summary: Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
Severity: LOW
CVSS score: 0
Published: 2021-10-12T16:05:11Z

### Impact
`preview-docs` command allows path traversal if current working dir contains files with question mark `?` in name and attacker knows the name.

### Patches
It was patched starting from 1.0.0-beta.59

### Workarounds
Do not run openapi-cli preview-docs command in the folder which contains files with question mark `?` in name.

### References
https://github.com/Redocly/openapi-cli/pull/347

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [@redocly/openapi-cli](https://github.com/Redocly/openapi-cli)
* Email us at [security@redocly.com](mailto:security@redocly.com)
Vulnerability: GHSA-j636-crp3-m584
Summary: Cross-site Scripting in tableexport.jquery.plugin
Aliases: CVE-2022-1291
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-11T00:00:22Z

There is a cross-site scripting vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party servers and/or sending data from secure sessions to third-party servers.
Vulnerability: GHSA-m6wg-2mwg-4rfq
Summary: Use After Free
Aliases: CVE-2020-8945
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2021-05-18T15:29:42Z

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
Vulnerability: GHSA-cgpw-2gph-2r9g
Summary: Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.App, and Microsoft.AspNetCore.Server.Kestrel.Core
Severity: MODERATE
CVSS score: 0
Published: 2018-10-16T19:59:59Z

Microsoft is aware of a denial of service vulnerability in ASP.NET Core when a malformed request is terminated. An attacker who successfully exploited this vulnerability could cause a denial of service attack.

The update addresses the vulnerability by correcting how ASP.NET Core handles such requests.
Vulnerability: GHSA-243q-g9j3-qf6r
Summary: non-admin users can create integration role with administrator role
Severity: MODERATE
CVSS score: 0
Published: 2021-06-28T18:21:01Z

### Impact
non-admin users can create integration role with administrator role

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-j3wh-5m26-2pf7
Summary: Downloads Resources over HTTP in mystem-fix
Aliases: CVE-2016-10698
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-07-27T14:34:11Z

Affected versions of `mystem-fix` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem-fix`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-whw7-h25v-9qvx
Summary: Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2
Aliases: CVE-2017-7661
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2018-10-18T16:56:38Z

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.
Vulnerability: GHSA-2xpp-75vr-22vq
Summary: Low severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17192
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1021
Published: 2018-12-20T22:02:24Z

The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-q39c-5vh5-vw2p
Summary: Improper Authentication in Apereo CAS
Aliases: CVE-2020-27178
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2021-08-02T16:47:10Z

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.