TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-g74r-ffvr-5q9f
Summary: Memory Exposure in concat-stream
Severity: MODERATE
CVSS score: 0
CWE: CWE-200
Published: 2019-06-03T17:26:44Z

Versions of `concat-stream` before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into `write()`

Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.



## Recommendation

Update to version 1.5.2, 1.4.11, 1.3.2 or later.

If you are unable to update make sure user provided input into the `write()` function is not a number.
Vulnerability: GHSA-2gwj-7jmv-h26r
Summary: SQL Injection in Django
Aliases: CVE-2022-28346
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-04-13T00:00:33Z

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Vulnerability: GHSA-8rcj-c8pj-v3m3
Summary: Reachable Assertion in Tensorflow
Aliases: CVE-2022-23564
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-09T23:55:28Z

### Impact
When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes.

### Patches
We have patched the issue in GitHub commit [14fea662350e7c26eb5fe1be2ac31704e5682ee6](https://github.com/tensorflow/tensorflow/commit/14fea662350e7c26eb5fe1be2ac31704e5682ee6).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-qw96-mm2g-c8m7
Summary: Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
Aliases: CVE-2018-18282
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-10-15T21:43:12Z

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.
Vulnerability: GHSA-5fg8-2547-mr8q
Summary: Misinterpretation of malicious XML input
Aliases: CVE-2021-32796
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-116
Published: 2021-08-03T16:57:05Z

### Impact
xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications.

### Patches
Update to one of the fixed versions of `@xmldom/xmldom` (`>=0.7.0`)

See issue #271 for the status of publishing `xmldom` to npm or join #270 for Q&A/discussion until it's resolved.

### Workarounds

Downstream applications can validate the input and reject the maliciously crafted documents.

### References

Similar to this one reported on the Go standard library:

- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://mattermost.com/blog/securing-xml-implementations-across-the-web/

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`xmldom/xmldom`](https://github.com/xmldom/xmldom)
* Email us: send an email to **all** addresses that are shown by `npm owner ls @xmldom/xmldom`
Vulnerability: GHSA-f9cm-p3w6-xvr3
Summary: Denial-of-Service Extended Event Loop Blocking in qs
Aliases: CVE-2014-10064
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-10-09T00:38:48Z

Versions prior to 1.0.0 of `qs` are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested JSON string.




## Recommendation

Update to version 1.0.0 or later
Vulnerability: GHSA-9xcj-c8cr-8c3c
Summary: In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack
Aliases: CVE-2019-17563
Severity: HIGH
CVSS score: 7.5
CWE: CWE-384
Published: 2019-12-26T18:22:26Z

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Vulnerability: GHSA-fq6p-x6j3-cmmq
Summary: Denial of service in three
Aliases: CVE-2020-28496
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-03-01T19:57:16Z

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")
Vulnerability: GHSA-8948-ffc6-jg52
Summary: Insecure Default Configuration in redbird
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-20
Published: 2019-06-06T15:32:21Z

Versions of `redbird` prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on `lib/proxy.js`. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable.


## Recommendation

Upgrade to version 0.9.1 or later.
Vulnerability: GHSA-qmqc-x3r4-6v39
Summary: Polymorphic deserialization of malicious object in jackson-databind
Aliases: CVE-2019-14893
Severity: HIGH
CVSS score: 0
CWE: CWE-502
Published: 2020-05-15T18:59:07Z

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
Vulnerability: GHSA-84j7-475p-hp8v
Summary: HTTP Response Splitting in Puma
Aliases: CVE-2020-5247
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-113
Published: 2020-02-28T16:53:55Z

In Puma (RubyGem) before 4.3.2 and 3.12.3, if an application using Puma allows untrusted input in a response header,
an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, 
such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server.

This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.
Vulnerability: GHSA-gc94-6w89-hpqr
Summary: Command Injection in fs-path
Severity: HIGH
CVSS score: 0
CWE: CWE-62, CWE-77
Published: 2019-06-12T16:37:07Z

All versions of `fs-path` are vulnerable to command injection is unsanitized user input is passed in.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Vulnerability: GHSA-p5w7-qmq6-pmjr
Summary: Users able to query database metadata in Apache Superset
Aliases: CVE-2019-12413
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2020-02-26T19:55:32Z

In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.
Vulnerability: GHSA-jp4j-47f9-2vc3
Summary: Integer Overflow or Wraparound in NATS Server
Aliases: CVE-2019-13126
Severity: HIGH
CVSS score: 7.1
CWE: CWE-190
Published: 2021-05-18T18:14:55Z

An integer overflow in NATS Server 2.0.0 allows a remote attacker to crash the server by sending a crafted request.
Vulnerability: GHSA-w7wg-24g3-2c78
Summary: Malicious Package in requset
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:14:17Z

All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-gxmc-5wj3-jx64
Summary: Cross-site scripting in application/controllers/dropbox.php in JustWriting
Aliases: CVE-2021-41467
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-04T20:13:25Z

Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
Vulnerability: GHSA-gp82-xr77-88f4
Summary: Moderate severity vulnerability that affects radiant
Aliases: CVE-2018-7261
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2018-07-27T17:08:29Z

There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title, Dev Site Domain, Page Parts, and Page Fields).
Vulnerability: GHSA-mpgr-2cx9-327h
Summary: Information disclosure in SSB-DB
Aliases: CVE-2020-4045
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2020-06-11T21:09:04Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Servers running SSB-DB 20.0.0 (which is packaged with SSB-Server 16.0.0) must upgrade immediately.

**There is no evidence that other SSB apps are vulnerable or that this problem has been exploited in the wild.**

The `get()` method is supposed to only decrypt messages when you explicitly ask it to, but there's a bug where it's decrypting any message that it can. This means that it's returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around `get()` to anonymous peers.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, please upgrade to SSB-DB 20.0.1 (or SSB-Server 16.0.1) immediately.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You may be able to disable the most obvious attack vector, SSB-OOO, by disabling the plugin, but you should upgrade immediately anyway.

### For more information

If you have any questions or comments about this advisory, open an issue in [SSB-DB](https://github.com/ssbc/ssb-db/)
Vulnerability: GHSA-v76m-f5cx-8rg4
Summary: Moderate severity vulnerability that affects DotNetNuke.Core
Aliases: CVE-2015-1566
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-10-16T19:33:25Z

Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Vulnerability: GHSA-p8p6-rcp6-4mrm
Summary: Uncontrolled Recursion in Play Framework
Aliases: CVE-2020-26883
Severity: HIGH
CVSS score: 7.5
CWE: CWE-674
Published: 2022-02-10T20:23:01Z

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.
Vulnerability: GHSA-vx5w-cxch-wwc9
Summary: Path Traversal in f-serv
Severity: CRITICAL
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T19:02:27Z

All versions of `f-serv` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-p48w-vf3c-rqjx
Summary: Cross-Site Scripting in Bootstrap Package
Aliases: CVE-2021-21365
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-04-29T21:51:21Z

### Problem
It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

The following templates are affected by the vulnerability:

* `Resources/Private/Partials/ContentElements/Carousel/Item/CallToAction.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/Header.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/Text.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/TextAndImage.html`
* `Resources/Private/Partials/ContentElements/Header/SubHeader.html`

Users of the extension, who have overwritten  the affected templates with custom code must manually apply the security fix as shown in [this Git commit](https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b).

### Solution
Update to version 7.1.2, 8.0.8, 9.0.4, 9.1.3, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described.

Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.
Vulnerability: GHSA-qpw2-xchm-655q
Summary: Out-of-Bounds read in stringstream
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-125
Published: 2022-01-06T20:31:01Z

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

# WITHDRAWN

This is a duplicate of GHSA-mf6x-7mm4-x2g7
Vulnerability: GHSA-93g4-3phc-g4xw
Summary: SQL injection in Apache DolphinScheduler 
Aliases: CVE-2021-27644
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2021-11-03T17:30:18Z

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
Vulnerability: GHSA-f5fj-7265-jxhj
Summary: Information Exposure
Aliases: CVE-2018-1000803
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2022-02-15T01:57:18Z

Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be exploitable via Watch a repository to receive email notifications. Emails received contain the other recipients even if they have the email set as private. This vulnerability appears to have been fixed in 1.5.1.
Vulnerability: GHSA-w89r-qch4-8jv5
Summary: Out-of-bounds write
Aliases: CVE-2019-0912
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:59Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-mhfv-8rc9-w38c
Summary: Arbitrary shell execution
Severity: HIGH
CVSS score: 0
Published: 2022-03-26T00:06:00Z

Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
Vulnerability: GHSA-c99r-67x4-whj6
Summary: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
Aliases: CVE-2021-33604
Severity: LOW
CVSS score: 2.5
CWE: CWE-172
Published: 2021-06-28T16:56:07Z

URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

- https://vaadin.com/security/cve-2021-33604
Vulnerability: GHSA-3933-wvjf-pcvc
Summary: Out of bounds access in lucet-runtime-internals
Aliases: CVE-2020-35859
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-787, CWE-125
Published: 2021-08-25T20:46:16Z

An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be able to obtain sensitive information, or guest programs can experience memory corruption.
Vulnerability: GHSA-jmx8-355m-8vwh
Summary: Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Aliases: CVE-2018-25007
Severity: LOW
CVSS score: 2.6
CWE: CWE-754
Published: 2021-04-19T14:53:09Z

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

- https://vaadin.com/security/cve-2018-25007
Vulnerability: GHSA-wmg4-8cp2-hpg9
Summary: Denial of service attack via memory exhaustion
Aliases: CVE-2021-29430
Severity: LOW
CVSS score: 0
CWE: CWE-20, CWE-400
Published: 2021-04-19T14:54:04Z

### Impact

Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to disk space exhaustion and denial of service.

Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service.

This affects any server which accepts registration requests from untrusted clients.

### Patches

Patched by 89071a1, 0523511, f56eee3.

### Workarounds

Request sizes can be limited in an HTTP reverse-proxy.

There are no known workarounds for the problem with overlarge responses.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: GHSA-mxhp-79qh-mcx6
Summary: taffy can allow access to any data items in the DB
Aliases: CVE-2019-10790
Severity: HIGH
CVSS score: 7.5
CWE: CWE-668, CWE-20
Published: 2020-02-19T16:43:42Z

taffy through 2.6.2 allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, taffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format (e.g., T000002R000001). As such, attackers can use this vulnerability to access any data items in the DB.
Vulnerability: GHSA-mmc9-pwm7-qj5w
Summary: Unaligned memory access in rand_core
Aliases: CVE-2020-25576
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-704
Published: 2021-08-25T20:56:50Z

### Impact
Affected versions of this crate violated alignment when casting byte slices to integer slices, resulting in undefined behavior. `rand_core::BlockRng::next_u64` and `rand_core::BlockRng::fill_bytes` are affected.

### Patches
The flaw was corrected by Ralf Jung and Diggory Hardy for `rand_core >= 0.4.2`.

### Workarounds
None.

### References
See [Rand's changelog](https://github.com/rust-random/rand/blob/master/rand_core/CHANGELOG.md#050---2019-06-06).

### For more information
If you have any questions or comments about this advisory, [open an issue in the Rand repository](https://github.com/rust-random/rand/issues/new/choose).
Vulnerability: GHSA-536p-4pcj-5mr9
Summary: raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
Aliases: CVE-2021-38557
Severity: HIGH
CVSS score: 8.8
CWE: CWE-732, CWE-276
Published: 2021-09-02T17:10:52Z

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.
Vulnerability: GHSA-4q53-fqhc-cr46
Summary: Low severity vulnerability that affects ember-source
Aliases: CVE-2014-0046
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2018-08-28T22:33:42Z

Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
Vulnerability: GHSA-p5w8-wqhj-9hhf
Summary: StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)
Aliases: CVE-2021-32839
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-09-10T17:56:06Z

### Impact
The formatter function that strips comments from a SQL contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service). The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments.

### Patches
The issues has been fixed in sqlparse 0.4.2.

### Workarounds
Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the `sqlformat.format` function with keyword `strip_comments=True` or the `--strip-comments` command line flag when using the `sqlformat` command line tool.

### References
This issue was discovered by GitHub team members @erik-krogh and @yoff. It was found using a [CodeQL](https://codeql.github.com/) query which identifies inefficient regular expressions. You can see the results of the query on python-sqlparse by following [this link](https://lgtm.com/query/2223658096471222354/). 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [sqlparse issue tracker](https://github.com/andialbrecht/sqlparse/issues)
* Email us at [albrecht.andi@gmail.com](mailto:albrecht.andi@gmail.com)
Vulnerability: GHSA-6m6m-j2hm-pxrg
Summary: Malicious Package in cicada-render
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:37:05Z

All versions of `cicada-render` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7j36-gc4r-9x3r
Summary: Out of bounds access in compact_arena
Aliases: CVE-2019-16139
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787, CWE-125
Published: 2021-08-25T20:44:48Z

An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-of-bounds write or read.
Vulnerability: GHSA-vx57-7f4q-fpc7
Summary: Arbitrary redirects under /new endpoint
Aliases: CVE-2021-29622
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-02-15T01:57:18Z

### Impact

In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /.
Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.

If a user visits a prometheus server with a specially crafted address (e.g.: `http://127.0.0.1:9090/new/new<url>`), they can be redirected to an arbitrary URL.

e.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com.

### Patches

The issue will be patched in 2.26.1 and 2.27.1 releases.
In 2.28.0, the /new endpoint will be removed completely.

### Workarounds

The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Note: Users who use a `--web.external-url=` flag _with a path_ (e.g.  `--web.external-url=http://example.com/prometheus`) are not affected.

### For more information

If you have any questions or comments about this advisory, please use our community channels (https://prometheus.io/community).
Our security policy is available at https://prometheus.io/docs/operating/security/
Vulnerability: GHSA-qfjv-998w-q48f
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-17186
Severity: HIGH
CVSS score: 7.2
CWE: CWE-611
Published: 2018-11-06T23:15:46Z

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
Vulnerability: GHSA-qm4q-f956-fg64
Summary: Malicious Package in luna-mock
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:39:13Z

All versions of `luna-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-686h-j8r8-wmfm
Summary: Data races in rcu_cell
Aliases: CVE-2020-36451
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:57:14Z

Affected versions of this crate unconditionally implement Send/Sync for `RcuCell<T>`.
This allows users to send `T: !Send` to other threads (while `T` enclosed within `RcuCell<T>`), and allows users to concurrently access `T: !Sync` by using the APIs of `RcuCell<T>` that provide access to `&T`.

This can result in memory corruption caused by data races.
Vulnerability: GHSA-cqff-fx2x-p86v
Summary: Improper Authentication
Severity: HIGH
CVSS score: 0
CWE: CWE-287
Published: 2021-03-08T15:50:10Z

### Impact
A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot.

### Patches
The problem has been patched in all affected versions. Please see the list of patched versions for the most appropiate one for your individual case.

### Workarounds
Users who do not wish or are not able to upgrade can add an authentication configuration containing ClaimsValidator, which throws an exception if Claims are Skill Claims. 

For detailed instructions, see the link in the References section.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Microsoft Bot Builder SDK](https://github.com/microsoft/botframework-sdk)
* Email us at [bf-reports@microsoft.com](mailto:bf-reports@microsoft.com)
Vulnerability: GHSA-93wh-35r4-6qmw
Summary: Exposure of Sensitive Information to an Unauthorized Actor in moodle
Aliases: CVE-2021-20281
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-03-29T20:43:23Z

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Vulnerability: GHSA-2x75-mf24-588m
Summary: Out-of-bounds write
Aliases: CVE-2019-1092
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:11Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1103, CVE-2019-1106, CVE-2019-1107.
Vulnerability: GHSA-3rpr-mg43-xhq4
Summary: High severity vulnerability that affects auth0-js
Aliases: CVE-2017-17068
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2017-12-21T00:47:20Z

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions &lt; 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().
Vulnerability: GHSA-j667-c2hm-f2wp
Summary: Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible
Aliases: CVE-2020-14332
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-117, CWE-532
Published: 2022-02-09T21:59:39Z

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.
Vulnerability: GHSA-6mx3-3vqg-hpp2
Summary: Django allows unprivileged users can read the password hashes of arbitrary accounts
Aliases: CVE-2018-16984
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-522
Published: 2018-10-03T20:07:39Z

An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the "view" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.
Vulnerability: GHSA-g6v7-vqhx-6v6c
Summary: XML External Entity Reference in org.opencms:opencms-core
Aliases: CVE-2021-3312
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-611
Published: 2021-10-12T17:23:40Z

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Vulnerability: GHSA-87vv-r9j6-g5qv
Summary: Regular Expression Denial of Service in moment
Aliases: CVE-2016-4055
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2017-10-24T18:33:35Z

Versions of `moment` prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into `moment.duration()`.


## Proof of concept
```
var moment = require('moment');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=20000;i<=10000000;i=i+10000) {
    console.log("COUNT: " + i);
    var str = '-' + genstr(i, '1')
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    moment.duration(str)

    var end = process.hrtime(start);
    console.log(end);
}
```

### Results
```
$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]
```


## Recommendation

Please update to version 2.11.2 or later.
Vulnerability: GHSA-j257-jfvv-h3x5
Summary: Privilege Escalation in Channelmgnt plug-in for Sopel
Aliases: CVE-2020-15251
Severity: HIGH
CVSS score: 7.7
CWE: CWE-862, CWE-863
Published: 2020-10-13T17:30:30Z

### Impact
Malicious users are able to op/voice and take over a channel

### Patches
On version 1.0.3

### Workarounds
Disable channelmgnt

### References
https://phab.bots.miraheze.wiki/T117

### For more information
If you have any questions or comments about this advisory:
* Email us at [staff(at)mirahezebots(dot)org](mailto:staff@mirahezebots.org)
Vulnerability: GHSA-cgfm-62j4-v4rf
Summary: Heap out of bounds access in sparse reduction operations
Aliases: CVE-2021-37635
Severity: HIGH
CVSS score: 7.3
CWE: CWE-125
Published: 2021-08-25T14:44:17Z

### Impact
The implementation of sparse reduction operations in TensorFlow can trigger accesses outside of bounds of heap allocated data:

```python
import tensorflow as tf

x = tf.SparseTensor(
      indices=[[773, 773, 773], [773, 773, 773]],
      values=[1, 1],
      dense_shape=[337, 337, 337])
tf.sparse.reduce_sum(x, 1)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_reduce_op.cc#L217-L228) fails to validate that each reduction group does not overflow and that each corresponding index does not point to outside the bounds of the input tensor.

### Patches
We have patched the issue in GitHub commit [87158f43f05f2720a374f3e6d22a7aaa3a33f750](https://github.com/tensorflow/tensorflow/commit/87158f43f05f2720a374f3e6d22a7aaa3a33f750). 

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-g475-pch5-6wvv
Summary: Authentication bypass in MAGMI
Aliases: CVE-2020-5777
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-05-06T18:54:35Z

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication.
Vulnerability: GHSA-4g9f-63rx-5cw4
Summary: Segfault in Tensorflow
Aliases: CVE-2020-15190
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20, CWE-476
Published: 2020-09-25T18:28:14Z

### Impact
The [`tf.raw_ops.Switch`](https://www.tensorflow.org/api_docs/python/tf/raw_ops/Switch) operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor.

However, the eager runtime traverses all tensors in the output:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/common_runtime/eager/kernel_and_device.cc#L308-L313

Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault

### Patches
We have patched the issue in da8558533d925694483d2c136a9220d6d49d843c and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-f6p7-8xfw-fjqq
Summary: Authenticated Stored XSS in Administration
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-05-21T14:29:26Z

### Impact
Authenticated Stored XSS in Administration

### Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
Vulnerability: GHSA-6cc6-66f5-mxjj
Summary: Out-of-bounds write in ChakraCore
Aliases: CVE-2020-0826
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:58:03Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-8cvr-4rrf-f244
Summary: Infinite open connection causes OctoRPKI to hang forever
Aliases: CVE-2021-3909
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-400
Published: 2021-11-10T20:15:44Z

OctoRPKI does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a response is returned, but does keep drip feeding new bytes to keep the connection alive.

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-5rm3-qhxf-rh3r
Summary: Downloads Resources over HTTP in co-cli-installer
Aliases: CVE-2016-10657
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:45:10Z

Affected versions of `co-cli-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `co-cli-installer`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-w24h-v9qh-8gxj
Summary: SQL Injection in Django
Aliases: CVE-2022-28347
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-04-13T00:00:33Z

A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
Vulnerability: GHSA-gwcr-j4wh-j3cq
Summary: Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability
Aliases: CVE-2021-28169
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-06-10T15:43:22Z

Requests to the `ConcatServlet` and `WelcomeFilter` are able to access protected resources within the `WEB-INF` directory. For example a request to the `ConcatServlet` with a URI of `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

This occurs because both `ConcatServlet` and `WelcomeFilter` decode the supplied path to verify it is not within the `WEB-INF` or `META-INF` directories. It then uses this decoded path to call `RequestDispatcher` which will also do decoding of the path. This double decoding allows paths with a doubly encoded `WEB-INF` to bypass this security check.

### Impact
This affects all versions of `ConcatServlet` and `WelcomeFilter` in versions before 9.4.41, 10.0.3 and 11.0.3.

### Workarounds

If you cannot update to the latest version of Jetty, you can instead deploy your own version of the [`ConcatServlet`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/ConcatServlet.java) and/or the [`WelcomeFilter`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java) by using the code from the latest version of Jetty.
Vulnerability: GHSA-277v-gwfr-hmpj
Summary: Missing Authentication for Critical Function in LibreNMS
Aliases: CVE-2019-10668
Severity: MODERATE
CVSS score: 9.1
CWE: CWE-306
Published: 2019-10-11T18:43:06Z

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.
Vulnerability: GHSA-4hjq-422q-4vpx
Summary: Secret data exfiltration via symfony parameters
Aliases: CVE-2021-27908
Severity: MODERATE
CVSS score: 5.8
CWE: CWE-732
Published: 2021-04-06T17:20:58Z

### Impact
Symfony parameters (which is what Mautic transforms configuration parameters into) can be used within other Symfony parameters by design. However, this also means that an admin who is normally not privy to certain parameters, such as database credentials, could expose them by leveraging any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.

For example,

1. Go to Configuration page -> Landing Page Settings -> Analytics script and enter this: <`script> console.log("db password is: %mautic.db_password%"); </script>`
2. Visit any landing page and open the JS dev console. You will see the following message with real instance db password: `db password is: <real password>`

Risk rating: ModerateCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

### Patches
Upgrade to 3.3.2

### Workarounds
No

### References
No

### For more information
If you have any questions or comments about this advisory:

* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-8c3f-x5f9-6h62
Summary: Command injection in @diez/generation
Aliases: CVE-2021-32830
Severity: LOW
CVSS score: 3.9
CWE: CWE-77, CWE-78
Published: 2021-09-02T17:08:20Z

The `@diez/generation` npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. All versions of this package are vulnerable as of the writing of this CVE.
Vulnerability: GHSA-vg35-vc9f-q7x2
Summary: Improper Restriction of XML External Entity Reference in ladon
Aliases: CVE-2019-1010268
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2019-07-26T16:09:54Z

Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.
Vulnerability: GHSA-jwgx-9mmh-684w
Summary: Credential exposure through log files in Undertow
Aliases: CVE-2019-3888
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-532
Published: 2019-06-13T20:02:56Z

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
Vulnerability: GHSA-mr95-9rr4-668f
Summary: High severity vulnerability that affects com.typesafe.akka:akka-actor_2.11 and com.typesafe.akka:akka-actor_2.12
Aliases: CVE-2018-16115
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-338
Published: 2018-10-22T20:44:26Z

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster.
Vulnerability: GHSA-rfmp-jvr7-hx78
Summary: Inadequate Encryption Strength in Apache NiFi
Aliases: CVE-2020-9491
Severity: HIGH
CVSS score: 7.5
CWE: CWE-327
Published: 2022-01-06T20:41:06Z

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.
Vulnerability: GHSA-wg4r-q74r-p7c8
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0941
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-15T00:01:03Z

ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-5hv6-mh8q-q9v8
Summary: RCE in XWiki
Aliases: CVE-2020-15252
Severity: HIGH
CVSS score: 8.5
CWE: CWE-94, CWE-74
Published: 2020-10-16T16:55:49Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

### Patches

It has been patched in both version XWiki 12.5 and XWiki 11.10.6.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-17423

It's been reported by the GitHub Security Lab under https://jira.xwiki.org/browse/XWIKI-17141.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-64j8-7gp2-xjx5
Summary: Data races in try-mutex
Aliases: CVE-2020-35924
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-787
Published: 2021-08-25T20:50:28Z

An issue was discovered in the try-mutex crate before 0.3.0 for Rust. TryMutex<T> allows cross-thread sending of a non-Send type.
Vulnerability: GHSA-j3jw-j2j8-2wv9
Summary: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Aliases: CVE-2021-43569
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2021-11-10T20:58:03Z

The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.