TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-9jf3-f2pg-7868
Summary: Downloads Resources over HTTP in nw-with-arm
Aliases: CVE-2016-10629
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:57:01Z

Affected versions of `nw-with-arm` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nw-with-arm`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5gjm-fj42-x983
Summary: Cross-site Request Forgery (CSRF)
Aliases: CVE-2018-1098
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-02-15T01:57:18Z

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.
Vulnerability: GHSA-3872-f48p-pxqj
Summary: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate
Aliases: CVE-2022-23915
Severity: HIGH
CVSS score: 8.8
CWE: CWE-88, CWE-77
Published: 2022-03-04T21:15:31Z

### Impact
Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

### Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

* 35d59f1f040541c358cece0a8d4a63183ca919b8
* d83672a3e7415da1490334e2c9431e5da1966842

### Workarounds

Instances in which untrusted users cannot create new components are not affected.

### References
* [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088)

### For more information
If you have any questions or comments about this advisory:
* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)
* Email us at [care@weblate.org](mailto:care@weblate.org)
Vulnerability: GHSA-699m-mcjm-9cw8
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2013-4491
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
Vulnerability: GHSA-grgm-pph5-j5h7
Summary: Exposure of Sensitive Information to an Unauthorized Actor in ansible
Aliases: CVE-2019-10156
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-200
Published: 2019-07-31T04:22:49Z

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
Vulnerability: GHSA-hwv5-w8gm-fq9f
Summary: Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request
Aliases: CVE-2020-15239
Severity: LOW
CVSS score: 3.5
CWE: CWE-22
Published: 2020-10-06T18:21:02Z

### Impact

#### Information Disclosure

When the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic.

For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access.

If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances.

#### File Write

If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload.

### Patches

PR #12 fixes the issue. The PR has been merged into version 0.4.0 and 0.4.0 has been released and pushed to PyPI. Users are advised to upgrade immediately.

### Workarounds

- Apache can apparently be configured to filter such malicious paths when reverse-proxying. 
- There are no other workarounds known.

### References

- [Pull Request #12](https://github.com/horazont/xmpp-http-upload/pull/12)
Vulnerability: GHSA-w428-f65r-h4q2
Summary: Deserialization of Untrusted Data in rust-cpuid
Aliases: CVE-2021-45687
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2022-01-06T22:13:12Z

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
Vulnerability: GHSA-8hcm-jj4x-4gmr
Summary: Cross-site scripting in tribalsystems/zenario
Aliases: CVE-2021-27673
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-06-08T20:11:40Z

Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.
Vulnerability: GHSA-4328-8hgf-7wjr
Summary: Global node_modules Binary Overwrite in npm
Aliases: CVE-2019-16777
Severity: LOW
CVSS score: 7.7
CWE: CWE-22
Published: 2019-12-13T15:39:32Z

Versions of  the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. 

For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory.

This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.4 or later.
Vulnerability: GHSA-gh88-3pxp-6fm8
Summary: Infinite Loop in colors.js
Aliases: CVE-2021-23567
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2022-01-21T23:39:50Z

The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
Vulnerability: GHSA-2479-qvv7-47qq
Summary: Denial of Service in parse-server
Aliases: CVE-2019-1020012
Severity: HIGH
CVSS score: 7.5
CWE: CWE-444
Published: 2019-06-13T16:22:13Z

Versions of `parse-server` prior to 3.4.1 are vulnerable to Denial of Service (DoS). POST requests to `/parse/classes/_Audience` (or other volatile classes) cause the server to respond with a `500 Internal Server Error` for any subsequent POST requests.


## Recommendation

Upgrade to version 3.4.1 or later.
Vulnerability: GHSA-f97h-2pfx-f59f
Summary: HTTP response splitting in uvicorn
Aliases: CVE-2020-7695
Severity: HIGH
CVSS score: 7.5
CWE: CWE-74
Published: 2020-07-29T18:07:20Z

This affects all versions of package uvicorn. Uvicorn's implementation of the HTTP protocol for the httptools parser is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.
Vulnerability: GHSA-7prf-vw4p-qr59
Summary: Prototype pollution in supermixer
Aliases: CVE-2020-24939
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321, CWE-915
Published: 2021-12-10T19:03:07Z

Prototype pollution in Stampit supermixer allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation.
Vulnerability: GHSA-54g4-5cf6-hjp3
Summary: Exposure of Sensitive Information to an Unauthorized Actor and Observable Timing Discrepancy in Apache Hive
Aliases: CVE-2020-1926
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200, CWE-208
Published: 2022-02-09T00:48:54Z

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
Vulnerability: GHSA-2cqg-q7jm-j35c
Summary: snipe-it is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3938
Severity: LOW
CVSS score: 3.9
CWE: CWE-79
Published: 2021-11-15T23:19:42Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-5v34-g2px-j4fw
Summary: Improper Handling of Length Parameter Inconsistency in Apache Ant
Aliases: CVE-2021-36374
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-130
Published: 2021-08-02T16:56:31Z

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Vulnerability: GHSA-24x4-6qmh-88qg
Summary: Use after free in `DecodePng` kernel
Aliases: CVE-2022-23584
Severity: HIGH
CVSS score: 7.6
CWE: CWE-416
Published: 2022-02-09T23:57:42Z

### Impact
A malicious user can cause a use after free behavior when [decoding PNG images](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/image/decode_image_op.cc#L339-L346):
```cc
if (/* ... error conditions ... */) {
  png::CommonFreeDecode(&decode);
  OP_REQUIRES(context, false,
              errors::InvalidArgument("PNG size too large for int: ",
                                      decode.width, " by ", decode.height));
}   
```
After `png::CommonFreeDecode(&decode)` gets called, the values of `decode.width` and `decode.height` are in an unspecified state.

### Patches
We have patched the issue in GitHub commit [e746adbfcfee15e9cfdb391ff746c765b99bdf9b](https://github.com/tensorflow/tensorflow/commit/e746adbfcfee15e9cfdb391ff746c765b99bdf9b).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-5325-xw5m-phm3
Summary: Cross-site Scripting in ammonia
Aliases: CVE-2021-38193
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-25T20:55:56Z

An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
Vulnerability: GHSA-765h-qjxv-5f44
Summary: Prototype Pollution in handlebars
Aliases: CVE-2021-23383
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-02-10T23:51:42Z

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Vulnerability: GHSA-m2jh-fxw4-gphm
Summary: HTTP Host Header Injection
Aliases: CVE-2021-41114
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-20, CWE-644
Published: 2021-10-05T20:23:35Z

### Meta
* CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C` (3.5)

### Problem
It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP _Host_ header. TYPO3 uses the HTTP _Host_ header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment.

This vulnerability is the same as described in [TYPO3-CORE-SA-2014-001 (CVE-2014-3941)](https://typo3.org/security/advisory/typo3-core-sa-2014-001/). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting _$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']_ (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.

### Solution
Update your instance to TYPO3 version 11.5.0 which addresses the problem described.

### Credits
Thanks to TYPO3 framework merger Benjamin Franzke who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-015](https://typo3.org/security/advisory/typo3-core-sa-2021-015)
* [CVE-2014-3941](https://nvd.nist.gov/vuln/detail/CVE-2014-3941) reintroduced in TYPO3 v11.0.0
Vulnerability: GHSA-vvg4-vgrv-xfr7
Summary: Incomplete validation in `tf.raw_ops.CTCLoss`
Aliases: CVE-2021-29613
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-665
Published: 2021-05-21T14:28:39Z

### Impact 
Incomplete validation in `tf.raw_ops.CTCLoss` allows an attacker to trigger an OOB read from heap:

```python
import tensorflow as tf

inputs = tf.constant([], shape=[10, 16, 0], dtype=tf.float32)
labels_indices = tf.constant([], shape=[8, 0], dtype=tf.int64)
labels_values = tf.constant([-100] * 8, shape=[8], dtype=tf.int32)
sequence_length = tf.constant([-100] * 16, shape=[16], dtype=tf.int32)
  
tf.raw_ops.CTCLoss(inputs=inputs, labels_indices=labels_indices,
                   labels_values=labels_values, sequence_length=sequence_length,
                   preprocess_collapse_repeated=True, ctc_merge_repeated=False,
                   ignore_longer_outputs_than_inputs=True)
```   
      
An attacker can also trigger a heap buffer overflow:

```python
import tensorflow as tf

inputs = tf.constant([], shape=[7, 2, 0], dtype=tf.float32)
labels_indices = tf.constant([-100, -100], shape=[2, 1], dtype=tf.int64)
labels_values = tf.constant([-100, -100], shape=[2], dtype=tf.int32)
sequence_length = tf.constant([-100, -100], shape=[2], dtype=tf.int32)

tf.raw_ops.CTCLoss(inputs=inputs, labels_indices=labels_indices,
                   labels_values=labels_values, sequence_length=sequence_length,
                   preprocess_collapse_repeated=False, ctc_merge_repeated=False,
                   ignore_longer_outputs_than_inputs=False)
```

Finally, an attacker can trigger a null pointer dereference:

```python 
import tensorflow as tf

inputs = tf.constant([], shape=[0, 2, 11], dtype=tf.float32)
labels_indices = tf.constant([], shape=[0, 2], dtype=tf.int64)
labels_values = tf.constant([], shape=[0], dtype=tf.int32)
sequence_length = tf.constant([-100, -100], shape=[2], dtype=tf.int32)

tf.raw_ops.CTCLoss(inputs=inputs, labels_indices=labels_indices,
                   labels_values=labels_values, sequence_length=sequence_length,
                   preprocess_collapse_repeated=False, ctc_merge_repeated=False,
                   ignore_longer_outputs_than_inputs=False)
```

### Patches
We have patched the issue in GitHub commit[14607c0707040d775e06b6817325640cb4b5864c](https://github.com/tensorflow/tensorflow/commit/14607c0707040d775e06b6817325640cb4b5864c) followed by GitHub commit [4504a081af71514bb1828048363e6540f797005b](https://github.com/tensorflow/tensorflow/commit/4504a081af71514bb1828048363e6540f797005b).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-9w87-4j72-gcv7
Summary: Insecure Default Configuration in graphql-code-generator
Severity: HIGH
CVSS score: 0
Published: 2020-09-02T18:27:54Z

Versions of `graphql-code-generator` prior to 0.18.2 have an Insecure Default Configuration. The packages sets `NODE_TLS_REJECT_UNAUTHORIZED` to 0, disabling certificate verification for the entire project. This results in Insecure Communication for the process.


## Recommendation

Upgrade to version 0.18.2 or later.
Vulnerability: GHSA-3374-7h99-xr85
Summary: Cross-site scripting in forkcms
Aliases: CVE-2020-23049
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-10-25T19:43:05Z

Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.
Vulnerability: GHSA-r7j3-vvh2-xrpj
Summary: OS Command Injection in MiniMagick
Aliases: CVE-2019-13574
Severity: HIGH
CVSS score: 7.8
CWE: CWE-78
Published: 2019-07-18T13:19:22Z

In lib/mini_magick/image.rb in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because Image.open input is directly passed to Kernel#open, which accepts a '|' character followed by a command.
Vulnerability: GHSA-rvh4-g2rj-hr9c
Summary: Path Traversal in Jenkins Warnings Next Generation Plugin
Aliases: CVE-2022-23107
Severity: HIGH
CVSS score: 8.1
CWE: CWE-22
Published: 2022-01-21T23:38:05Z

Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.
Vulnerability: GHSA-2fmp-7xwf-wvwr
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7650
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2020-06-03T22:02:16Z

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
Vulnerability: GHSA-5ggx-g294-qj3q
Summary: Malicious Package in buffeb-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:47:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-534w-937m-v7x3
Summary: High severity vulnerability that affects restforce
Aliases: CVE-2018-3777
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2018-08-03T21:04:02Z

A flaw in how restforce constructs URLs may allow an attacker to inject additional parameters into Salesforce API requests.   

Impact
------
This flaw is only exploitable in applications that pass user input directly to restforce's select, find, describe, update, upsert, and destroy methods.

Vulnerable code might look like:
```ruby
  client.select('SomeSalesForceObject', params[:some-id],
     ...)
```

In such an application, attackers could pass `0016000000MRatd/describe`  as a request parameter, causing the server to make a request to a different endpoint than the server is designed to handle. Since the Salesforce REST API supports overriding HTTP methods via a request parameter, an attacker could also cause the client's `select()` method to modify data, by passing `0016000000MRatd/?_HttpMethod=PATCH&other-query-params=...`.

Workarounds
------
If possible, applications should track salesforce IDs internally, rather than passing user-supplied IDs to salesforce. Such practice mitigates this vulnerability, and in general is desirable for ensuring strong access control.
Vulnerability: GHSA-fphq-gw9m-ghrv
Summary: CHECK-fail in `CTCGreedyDecoder`
Aliases: CVE-2021-29543
Severity: LOW
CVSS score: 2.5
CWE: CWE-617
Published: 2021-05-21T14:23:18Z

### Impact
An attacker can trigger a denial of service via a `CHECK`-fail in `tf.raw_ops.CTCGreedyDecoder`:

```python
import tensorflow as tf

inputs = tf.constant([], shape=[18, 2, 0], dtype=tf.float32)
sequence_length = tf.constant([-100, 17], shape=[2], dtype=tf.int32)
merge_repeated = False

tf.raw_ops.CTCGreedyDecoder(inputs=inputs, sequence_length=sequence_length, merge_repeated=merge_repeated)
```
  
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/1615440b17b364b875eb06f43d087381f1460a65/tensorflow/core/kernels/ctc_decoder_ops.cc#L37-L50) has a `CHECK_LT` inserted to validate some invariants. When this condition is false, the program aborts, instead of returning a valid error to the user. This abnormal termination can be weaponized in denial of service attacks.

### Patches 
We have patched the issue in GitHub commit [ea3b43e98c32c97b35d52b4c66f9107452ca8fb2](https://github.com/tensorflow/tensorflow/commit/ea3b43e98c32c97b35d52b4c66f9107452ca8fb2).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
                      
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.        
                      
### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-7qx4-pp76-vrqh
Summary: Remote code execution in Apache Commons Configuration
Aliases: CVE-2020-1953
Severity: CRITICAL
CVSS score: 10
CWE: CWE-20
Published: 2020-05-21T19:08:08Z

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Vulnerability: GHSA-xmvg-w4f9-99r7
Summary: Moderate severity vulnerability that affects org.bedework.caleng:bw-calendar-engine
Aliases: CVE-2018-1000836
Severity: CRITICAL
CVSS score: 9
CWE: CWE-611
Published: 2018-12-20T22:02:51Z

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.
Vulnerability: GHSA-x68c-4gmm-5g43
Summary: kimai2 is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3985
Severity: HIGH
CVSS score: 8
CWE: CWE-79
Published: 2021-12-03T20:40:38Z

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-5rcr-q3rx-j7vr
Summary: Out-of-bounds write
Aliases: CVE-2019-1107
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:35Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1092, CVE-2019-1103, CVE-2019-1106.
Vulnerability: GHSA-ff7x-qrg7-qggm
Summary: Prototype Pollution in dot-prop
Aliases: CVE-2020-8116
Severity: HIGH
CVSS score: 7.3
CWE: CWE-425, CWE-471
Published: 2020-07-29T20:56:59Z

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Vulnerability: GHSA-qh73-qc3p-rjv2
Summary: Uncaught Exception in fastify-multipart
Aliases: CVE-2021-23597
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-11T18:57:53Z

### Impact

This is a bypass of CVE-2020-8136 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8136).
By providing a `name=constructor` property it is still possible to crash the application.
The original fix only checks for the key `__proto__` (https://github.com/fastify/fastify-multipart/pull/116).

All users are recommended to upgrade

### Patches

v5.3.1 includes a patch
 
### Workarounds

No workarounds are possible.

### References

Read up https://www.fastify.io/docs/latest/Guides/Prototype-Poisoning/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/fastify/fastify-multipart](https://github.com/fastify/fastify-multipart)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-wv2f-3rxv-jqhp
Summary: Path Traversal in general-file-server
Aliases: CVE-2018-3724
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-26T15:21:04Z

All versions of `general-file-server` are vulnerable to path traversal.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not use this module until a fix has been provided.
Vulnerability: GHSA-x67x-vg9m-65c3
Summary: Integer overflow in base64
Aliases: CVE-2017-1000430
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2021-08-25T20:55:27Z

Affected versions of this crate suffered from an integer overflow bug when
calculating the size of a buffer to use when encoding base64 using the
`encode_config_buf` and `encode_config` functions.  If the input string
was large, this would cause a buffer to be allocated that was too small.
Since this function writes to the buffer using unsafe code, it would
allow an attacker to write beyond the buffer, causing memory corruption
and possibly the execution of arbitrary code.

This flaw was corrected by using checked arithmetic to calculate
the size of the buffer.
Vulnerability: GHSA-8fgg-5v78-6g76
Summary: Deserializing an array can free uninitialized memory in byte_struct
Aliases: CVE-2021-28033
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119, CWE-908
Published: 2021-08-25T20:52:03Z

Byte_struct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the byte_struct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics.
Vulnerability: GHSA-3h68-wvv6-8r5h
Summary: Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak
Aliases: CVE-2020-1940
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-212
Published: 2021-12-10T17:20:11Z

The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.
Vulnerability: GHSA-g86p-hgx5-2pfh
Summary: Improper Authentication in Buildbot
Aliases: CVE-2019-12300
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2019-05-29T18:48:11Z

Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.
Vulnerability: GHSA-f3vw-587g-r29g
Summary: Path Traversal in sapper
Severity: CRITICAL
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T15:50:38Z

Versions of `sapper` prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded `../`.  

You may test a `sapper` application running in prod mode with `curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd`.


## Recommendation

Upgrade to version 0.27.11 or later.
Vulnerability: GHSA-984p-xq9m-4rjw
Summary: Rate Limiting Bypass in express-brute
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-77
Published: 2019-06-07T21:01:53Z

All versions of `express-brute` are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-hg79-j56m-fxgv
Summary: Cross-Site Scripting in react
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-04T15:26:04Z

Versions of `react` prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's `createElement` function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.14.0 or later.
Vulnerability: GHSA-9mp7-45qh-r8j8
Summary: Use of Uninitialized Resource in columnar.
Aliases: CVE-2021-45685
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:13:46Z

An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
Vulnerability: GHSA-27wq-qx3q-fxm9
Summary: Improper Handling of Unexpected Data Type in ced
Aliases: CVE-2021-39131
Severity: HIGH
CVSS score: 7.5
CWE: CWE-241
Published: 2021-08-23T19:42:28Z

### Impact

In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash.

### Patches

The problem has been patched in [ced v1.0.0](https://github.com/sonicdoe/ced/releases/tag/v1.0.0). You can upgrade from v0.1.0 without any breaking changes.

### Workarounds

Before passing an argument to ced, verify it’s a `Buffer` using [`Buffer.isBuffer(obj)`](https://nodejs.org/api/buffer.html#buffer_static_method_buffer_isbuffer_obj).

### CVSS score

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)

Base Score: 7.5 (High)
Temporal Score: 7.2 (High)

Since ced is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, accepting data from untrusted sources over a network and passing it directly to ced. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

### Proof of concept

```js
const express = require("express");
const bodyParser = require("body-parser");
const ced = require("ced");

const app = express();

app.use(bodyParser.raw());

app.post("/", (req, res) => {
  const encoding = ced(req.body);

  res.end(encoding);
});

app.listen(3000);
```

`curl --request POST --header "Content-Type: text/plain" --data foo http://localhost:3000` crashes the server.

### References

- https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3
Vulnerability: GHSA-hwqm-x785-qh8p
Summary: Incorrect Permission Assignment for Critical Resource	in Hashicorp Consul
Aliases: CVE-2020-12797
Severity: MODERATE
CVSS score: 3.7
CWE: CWE-732
Published: 2021-06-23T17:52:33Z

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.
Vulnerability: GHSA-m738-3rc4-5xv3
Summary: A user without PR can reset user authentication failures information
Aliases: CVE-2021-32729
Severity: LOW
CVSS score: 2
CWE: CWE-287, CWE-693
Published: 2021-07-02T19:19:31Z

### Impact
The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights as it should have.
Note that being able to reset the authentication failure record mean that an attacker with script right might use it to try performing a bruteforce attack since she'd been able to virtually deactivate the mechanism introduced to mitigate those attacks.

### Patches
The problem has been patched in version 12.6.8, 12.10.4 and 13.0.

### Workarounds
There's no workaround besides upgrading and being careful on which user should have Script right access. Note that any bruteforce attack on the authentication should be visible in the logs since the authentication failures are logged.

### References
https://jira.xwiki.org/browse/XWIKI-18276

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [the security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-x7p2-x2j6-mwhr
Summary: Moderate severity vulnerability that affects gemirro
Aliases: CVE-2017-16833
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-11-29T23:19:51Z

Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javascript: URL in the "homepage" value of a ".gemspec" file.
Vulnerability: GHSA-76wq-xw4h-f8wj
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2012-2695
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
Vulnerability: GHSA-88f9-7xxh-c688
Summary: Configuration leak
Aliases: CVE-2021-39174
Severity: HIGH
CVSS score: 8.8
CWE: CWE-75
Published: 2021-08-30T16:11:43Z

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). 

### Patches

This issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file.

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-rwxp-hwwf-653v
Summary: Insecure template handling in express-hbs
Aliases: CVE-2021-32817
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-200
Published: 2021-05-17T20:58:51Z

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .hbs appended to them. For complete details refer to the referenced GHSL-2021-019 report. Notes in documentation have been added to help users of express-hbs avoid this potential information exposure vulnerability.
Vulnerability: GHSA-8v9x-9xqg-r8mr
Summary: Prototype pollution in json8-merge-patch
Aliases: CVE-2020-8268
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-471, CWE-1321
Published: 2021-05-10T19:17:15Z

Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
Vulnerability: GHSA-3w8g-xr3f-2mp8
Summary: Out of bounds write in nalgebra
Aliases: CVE-2021-38190
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119, CWE-787
Published: 2021-08-25T20:55:49Z

The `Deserialize` implementation for `VecStorage` did not maintain the invariant that the number of elements must equal `nrows * ncols`. Deserialization of specially crafted inputs could allow memory access beyond allocation of the vector.

This flaw was introduced in v0.11.0 ([`086e6e`](https://github.com/dimforge/nalgebra/commit/086e6e719f53fecba6dadad2e953a487976387f5)) due to the addition of an automatically derived implementation of `Deserialize` for `MatrixVec`. `MatrixVec` was later renamed to `VecStorage` in v0.16.13 ([`0f66403`](https://github.com/dimforge/nalgebra/commit/0f66403cbbe9eeac15cedd8a906c0d6a3d8841f2)) and continued to use the automatically derived implementation of `Deserialize`.
Vulnerability: GHSA-2j5v-fc74-j9q2
Summary: Cross-Site Scripting in editor.md
Aliases: CVE-2019-9737
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-03-14T15:38:56Z

All versions of `editor.md` are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing  base64-encoded content.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-c3px-v9c7-m734
Summary: Prototype Pollution in mithril
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T19:04:39Z

Affected versions of `mithril`are vulnerable to prototype pollution. The function `parseQueryString` may allow a malicious user to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. A payload such as `__proto__%5BtoString%5D=123` in the query string would change the `toString()` function to `123`.



## Recommendation

If you are using mithril 2.x, upgrade to version 2.0.2 or later.
If you are using mithril 1.x, upgrade to version 1.1.7 or later.
Vulnerability: GHSA-4ph2-8337-hm62
Summary: Key Caching behavior in the DynamoDB Encryption Client.
Severity: LOW
CVSS score: 0
CWE: CWE-862
Published: 2021-02-08T17:43:49Z

### Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.

When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.

### Patches
Fixed as of 1.3.0.  We recommend users to modify their code and adopt `CachingMostRecentProvider`.


### Workarounds
Users who cannot upgrade to use the `CachingMostRecentProvider` can call `clear()` on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
Vulnerability: GHSA-h7vq-5qgw-jwwq
Summary: CSV Injection Vulnerability
Aliases: CVE-2021-41824
Severity: HIGH
CVSS score: 8.8
CWE: CWE-1236
Published: 2021-10-18T19:04:16Z

### Impact
In some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.

If you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.

### Patches
This has been patched in Craft 3.7.14.

### References
* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28
* https://twitter.com/craftcmsupdates/status/1442928690145366018

### For more information

If you have any questions or comments about this advisory, email us at support@craftcms.com

----------

Credits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli
Vulnerability: GHSA-v6c5-hwqg-3x5q
Summary: Improper Authorization in passport-cognito
Aliases: CVE-2019-19723
Severity: CRITICAL
CVSS score: 0
CWE: CWE-285
Published: 2020-09-04T17:23:03Z

All versions of `passport-cognito` are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may receive authorization tokens for a different user. This would allow a user to take actions on another user's behalf.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-44g9-w23c-5rw7
Summary: Directory Traversal in nhouston
Aliases: CVE-2014-8883
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-23
Published: 2020-08-31T22:53:54Z

All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.


## Recommendation

It is recommended that a different module be used, as we have been unable to reacher the maintainer of this module. We will continue to reach out to them, and if an update becomes available that fixes the issue, we will update this advisory accordingly.
Vulnerability: GHSA-9mqp-7v2h-2382
Summary: Denial of Service in Tensorflow
Aliases: CVE-2020-15194
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20, CWE-617
Published: 2020-09-25T18:28:19Z

### Impact
The `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L235-L241

Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations.

### Patches
We have patched the issue in 390611e0d45c5793c7066110af37c8514e6a6c54 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-63xm-rx5p-xvqr](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-63xm-rx5p-xvqr)
Vulnerability: GHSA-55x5-fj6c-h6m8
Summary: HTML Cleaner allows crafted and SVG embedded scripts to pass through
Aliases: CVE-2021-43818
Severity: HIGH
CVSS score: 8.2
CWE: CWE-74, CWE-79
Published: 2021-12-13T18:14:36Z

### Impact
The HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.

Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5.

### Patches
The issue has been resolved in lxml 4.6.5.

### Workarounds
None.

### References
The issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.
Vulnerability: GHSA-cpq8-x35g-m439
Summary: Cross-site Scripting in yourls
Aliases: CVE-2021-3783
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-79
Published: 2021-09-20T20:43:15Z

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in arbitrary path handling.
Vulnerability: GHSA-rrgw-3hg3-9x8c
Summary: XSS vulnerability in translations
Severity: MODERATE
CVSS score: 6.9
Published: 2022-01-12T21:49:49Z

### Summary

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: 
 - Translation management UI.
 - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
 - Translations uploaded via Upload translation file on the All Languages grid

### Workarounds

There are no workarounds that address this vulnerability.
Vulnerability: GHSA-8wg9-92fr-6j7v
Summary: Downloads Resources over HTTP in marionette-socket-host
Aliases: CVE-2016-10648
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2018-08-15T18:50:31Z

Affected versions of `marionette-socket-host` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `marionette-socket-host`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has removed the package from their Github account.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-w3wf-cfx3-6gcx
Summary: SAML authentication vulnerability due to stdlib XML parsing
Aliases: CVE-2020-26276
Severity: HIGH
CVSS score: 0
CWE: CWE-290
Published: 2022-02-11T23:59:14Z

### Impact
Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP.

Users that configure Fleet with SSO login may be vulnerable to this issue.

### Patches
This issue is patched in 3.5.1 using https://github.com/mattermost/xml-roundtrip-validator.

### Workarounds
If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

### References
See https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ for more information about the underlying vulnerabilities.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@fleetdm.com](mailto:security@fleetdm.com)
* Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)