TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-5wjf-62hw-q78r
Summary: Excessive CPU usage
Aliases: CVE-2021-39204
Severity: HIGH
CVSS score: 7.5
CWE: CWE-834
Published: 2021-09-10T17:54:13Z

Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity.  This can lead to high CPU utilization when a large number of streams are reset.  

### Impact

This can result in a DoS condition.

### Patches
Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

### Workarounds
N/A

### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32778)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-rmj8-8hhh-gv5h
Summary: Information Exposure when using Puma with Rails
Aliases: CVE-2022-23634
Severity: HIGH
CVSS score: 8
CWE: CWE-200
Published: 2022-02-11T21:33:23Z

### Impact
Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly.

From Rails:

> Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.

### Patches
This problem is fixed in Puma versions 5.6.2 and 4.3.11.

This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

See: 
https://github.com/advisories/GHSA-wh98-p28r-vrc9 
for details about the rails vulnerability

Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

### Workarounds

Upgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

The [Rails CVE](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1) includes a middleware that can be used instead.

### References

* Rails CVE: [CVE-2022-23633](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability: GHSA-gcx5-3p5f-f8vp
Summary: Prototype Pollution in jquery.cookie
Aliases: CVE-2022-23395
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-1321
Published: 2022-03-03T00:00:51Z

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
Vulnerability: GHSA-gh78-48h3-frjq
Summary: Improper exception handling in Aedes
Aliases: CVE-2020-13410
Severity: HIGH
CVSS score: 7.5
CWE: CWE-755
Published: 2021-05-06T18:10:46Z

An issue was discovered in MoscaJS Aedes 0.42.0 and fixed in 0.42.1. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream.
Vulnerability: GHSA-2r6j-862c-m2v2
Summary: Unrestricted File Upload in Form Framework
Aliases: CVE-2021-21355
Severity: HIGH
CVSS score: 8
CWE: CWE-552, CWE-434
Published: 2021-03-23T01:53:52Z


### Problem
Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_.

TYPO3 Extbase extensions, which implement a file upload and do not implement a custom _TypeConverter_ to transform uploaded files into _FileReference_ domain model objects are affected by the vulnerability as well, since the _UploadedFileReferenceConverter_ of _ext:form_ handles the file upload and will accept files of any mime-type which are persisted to the default location.

In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information.

No authentication is required to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

Type converter _UploadedFileReferenceConverter_ is not registered globally anymore and just handles uploaded files within the scope of the Form Framework. Guessable storage location has changed from _/fileadmin/user_upload/form\_\<random-hash\>/_ to _/fileadmin/form_uploads/<random-40-bit>_. Allowed mime-types must match expected file extensions (e.g. _application/pdf_ must be _.pdf_, and cannot be _.html_).

Extbase extensions, who rely on the global availability of the _UploadedFileReferenceConverter_ must now implement a custom _TypeConverter_ to handle file uploads or explicitly implement the ext:form _UploadedFileReferenceConverter_ with appropriate setting for accepted mime-types.

### Credits
Thanks to Sebastian Michaelsen, Marc Lindemann, Oliver Eglseder, Markus Volkmer, Jakob Kunzmann, Johannes Regner, Richie Lee who reported this issue, and to TYPO3 core & security team members Oliver Hader & Benni Mack, as well as TYPO3 contributor Ralf Zimmermann who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-002](https://typo3.org/security/advisory/typo3-core-sa-2021-002)
Vulnerability: GHSA-vhgr-gfx3-fg37
Summary: Unrestricted Upload of File with Dangerous Type in WPanel 4
Aliases: CVE-2021-34257
Severity: HIGH
CVSS score: 8.8
CWE: CWE-434
Published: 2022-04-01T00:00:41Z

Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
Vulnerability: GHSA-4v9q-hm2p-68c4
Summary: Spoofing attack due to unvalidated KDC in node-krb5
Aliases: CVE-2016-1000238
Severity: MODERATE
CVSS score: 0
Published: 2020-09-01T15:57:01Z

Affected versions of `node-krb5` do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials.


## Recommendation

It appears that this will remain unfixed indefinitely, as the Github issue for this vulnerability has been open since 2015, with no work on it since then.

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=kerberos).
Vulnerability: GHSA-8j8c-7jfh-h6hx
Summary: Code Injection in js-yaml
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2019-06-04T20:14:07Z

Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.

An example payload is 
`{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1` 
which returns the object 
{
  "1553107949161": 1
}


## Recommendation

Upgrade to version 3.13.1.
Vulnerability: GHSA-36vm-xw34-x4pj
Summary: CHECK-fail in `tf.raw_ops.IRFFT`
Aliases: CVE-2021-29562
Severity: LOW
CVSS score: 2.5
CWE: CWE-617
Published: 2021-05-21T14:25:02Z

### Impact
An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.IRFFT`:
    
```python
import tensorflow as tf

values = [-10.0] * 130
values[0] = -9.999999999999995
inputs = tf.constant(values, shape=[10, 13], dtype=tf.float32)
inputs = tf.cast(inputs, dtype=tf.complex64)
fft_length = tf.constant([0], shape=[1], dtype=tf.int32)

tf.raw_ops.IRFFT(input=inputs, fft_length=fft_length)
``` 
    
The above example causes Eigen code to operate on an empty matrix. This triggers on an assertion and causes program termination.

### Patches
We have patched the issue in GitHub commit [1c56f53be0b722ca657cbc7df461ed676c8642a2](https://github.com/tensorflow/tensorflow/commit/1c56f53be0b722ca657cbc7df461ed676c8642a2).
  
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-g4m3-rpxr-h7vg
Summary: Malicious Package in mogodb-core
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:52:25Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-3j5x-7ccf-ppgm
Summary: Cross-site scripting in recommender-xblock
Aliases: CVE-2018-20858
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-21T16:15:33Z

Recommender before 1.3.1 allows XSS.
Vulnerability: GHSA-4rmr-c2jx-vx27
Summary: Remote code injection in mustache/mustache
Aliases: CVE-2022-0323
Severity: HIGH
CVSS score: 8.8
CWE: CWE-1336
Published: 2022-01-27T14:51:00Z

In Mustache.php v2.0.0 through v2.14.0, Sections tag can lead to arbitrary php code execution even if strict_callables is true when section value is controllable.
Vulnerability: GHSA-jpcm-4485-69p7
Summary: Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
Aliases: CVE-2021-21361
Severity: HIGH
CVSS score: 7.4
CWE: CWE-532
Published: 2021-03-09T00:38:41Z

### Impact

The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.

When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.

### Patches
Fixed in version 3.0.0

### References

 - https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44
 - https://github.com/bmuschko/gradle-vagrant-plugin/issues/19
 - https://github.com/bmuschko/gradle-vagrant-plugin/pull/20

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [bmuschko/gradle-vagrant-plugin](https://github.com/bmuschko/gradle-vagrant-plugin)
Vulnerability: GHSA-rvgg-f8qm-6h7j
Summary: High severity vulnerability that affects io.vertx:vertx-web
Aliases: CVE-2018-12540
Severity: HIGH
CVSS score: 0
CWE: CWE-352
Published: 2018-10-17T16:19:43Z

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet.
Vulnerability: GHSA-f9fq-vjvh-779p
Summary: Improper Input Validation in vault-ssh-helper
Aliases: CVE-2020-24359
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2022-02-15T01:57:18Z

HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.
Vulnerability: GHSA-h2fg-54x9-5qhq
Summary: Nil dereference in NATS JWT, DoS of nats-server
Aliases: CVE-2020-26521
Severity: LOW
CVSS score: 7.5
CWE: CWE-476
Published: 2022-02-11T23:43:13Z

## Problem Description

The NATS account system has an Operator trusted by the servers, which signs Accounts, and each Account can then create and sign Users within their account.  The Operator should be able to safely issue Accounts to other entities which it does not fully trust.

A malicious Account could create and sign a User JWT with a state not created by the normal tooling, such that decoding by the NATS JWT library (written in Go) would attempt a nil dereference, aborting execution.

The NATS Server is known to be impacted by this.


## Affected versions

#### JWT library

 * all versions prior to 1.1.0

#### NATS Server

 * Version 2 prior to 2.1.9


## Impact

#### JWT library

 * Programs would nil dereference and panic, aborting execution by default.

#### NATS server

 * Denial of Service caused by process termination


## Workaround

If your NATS servers do not trust any accounts which are managed by untrusted entities, then malformed User credentials are unlikely to be encountered.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.
Vulnerability: GHSA-7r87-cj48-wj45
Summary: Potential Captcha Validate Bypass in flask-session-captcha
Aliases: CVE-2022-24880
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-754, CWE-394, CWE-253
Published: 2022-04-26T21:19:52Z

### Impact
flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.

The `captcha.validate()` function would return `None` if passed no value (e.g. by submitting a request with an empty form).

If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed.

Sample vulnerable code:
```python
if captcha.validate() == False:
    ... # abort
else:
   ... # do stuff
```

### Patches
A new version (1.2.1) is available that fixes the issue.

### Workarounds
Users can workaround the issue by not explicitly checking that the value is False. 

Checking the return value less explicitly should still work. 

```python
if not captcha.validate():
    ... # abort
else:
   ... # do stuff
```

```python
if captcha.validate():
    ... # do stuff
else:
   ... # abort
```

### References
https://github.com/Tethik/flask-session-captcha/pull/27

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the github repo](https://github.com/Tethik/flask-session-captcha)
Vulnerability: GHSA-8jhx-9gf4-hhf5
Summary: Improper Access Control in consul
Aliases: CVE-2019-16377
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-284
Published: 2019-09-27T20:01:00Z

The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control.
Vulnerability: GHSA-vw47-mr44-3jf9
Summary: Confused Deputy in Kubernetes
Aliases: CVE-2021-25740
Severity: LOW
CVSS score: 3.1
CWE: CWE-610, CWE-441
Published: 2021-09-21T18:28:30Z

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
Vulnerability: GHSA-3xv8-3j54-hgrp
Summary: Out-of-bounds read in Pillow
Aliases: CVE-2020-10378
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2021-11-03T18:04:53Z

In libImaging/PcxDecode.c in Pillow before 6.2.3 and 7.x before 7.0.1, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
Vulnerability: GHSA-94g7-hpv8-h9qm
Summary: Remote code injection in Log4j
Severity: CRITICAL
CVSS score: 0
Published: 2021-12-14T21:46:35Z

### Impact
Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.

More Details:
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### Patches
Version 1.11.1 of the Splunk Logging for Java library.

There is also a backport to version 1.6.2 released as a patch: 1.6.2-0-0.

### Workarounds
If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/splunk/splunk-library-javalogging/issues
* Email us at [devinfo@splunk.com](mailto:devinfo@splunk.com)
Vulnerability: GHSA-qxf4-chvg-4r8r
Summary: Potential HTTP request smuggling in Apache Tomcat
Aliases: CVE-2020-1935
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-444
Published: 2020-02-28T01:10:48Z

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Vulnerability: GHSA-5q7q-qqw2-hjq7
Summary: Cross-Site Scripting in AjaxNetProfessional
Aliases: CVE-2021-43853
Severity: HIGH
CVSS score: 8.7
CWE: CWE-79
Published: 2022-01-06T18:32:24Z

### Overview

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects.

### Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

XSS effects vary in range from petty nuisance to significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner network.

### Releases

Releases before version 21.12.22.1 are affected. Please be careful to download any binary DLL from other web sites, especially we found NuGet packages not owned by us that contain vulnerable versions.

### Workarounds

A workaround exists that replaces one of the core JavaScript files embedded in the library. Using a XML configuration allows to replace the default JavaScript code to be replaced with the version on GitHub.

```xml
<configuration>
	<configSections>
		<sectionGroup name="ajaxNet">
			<section name="ajaxSettings" type="AjaxPro.AjaxSettingsSectionHandler,AjaxPro.2" requirePermission="false" restartOnExternalChanges="true"/>
		</sectionGroup>
	</configSections>
	<ajaxNet>
		<ajaxSettings>
			<coreScript>~/ajaxpro-core-fixed.js</coreScript>
		</ajaxSettings>
	</ajaxNet>
</configuration>
```

Copy the file core.js from the main project folder to your web server root folder and rename that ajaxpro-core-fixed.js.

Clients need to refresh the web page to download the changed JavaScript code.

### References

Commit fixing the issue: c89e39b9679fcb8ab6644fe21cc7e652cb615e2b

Note: the official Ajax.NET Professional (AjaxPro) NuGet package is available here: https://www.nuget.org/packages/AjaxNetProfessional/

### For more information

If you have any questions or comments about this advisory:
* Open an issue on this GitHub repository
Vulnerability: GHSA-4j59-hfw6-6w7h
Summary: Downloads Resources over HTTP in cmake
Aliases: CVE-2016-10642
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2018-08-15T19:30:48Z

Affected versions of `cmake` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cmake`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available, or installing the cmake binaries via a system package manager, such as `apt-get`.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3vv3-frrq-6486
Summary: Use of Uninitialized Resource in alg_ds
Aliases: CVE-2020-36432
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-665, CWE-908
Published: 2021-08-25T20:59:20Z

An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. `Matrix::new()` internally calls `Matrix::fill_with()` which uses `*ptr = value` pattern to initialize the buffer. This pattern assumes that there is an initialized struct at the address and drops it, which results in dropping of uninitialized struct.
Vulnerability: GHSA-89r3-rcpj-h7w6
Summary: Path traversal attack on Windows platforms
Aliases: CVE-2019-0207
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-11-18T17:19:03Z

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.
Vulnerability: GHSA-jpv3-g4cc-6vfx
Summary: Moderate severity vulnerability that affects org.apache.activemq:activemq-client
Aliases: CVE-2019-0222
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94
Published: 2019-04-02T15:46:42Z

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
Vulnerability: GHSA-pmpr-55fj-r229
Summary: Division by zero in TFLite's implementation of `SVDF`
Aliases: CVE-2021-29598
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:27:58Z

### Impact
The implementation of the `SVDF` TFLite operator is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/7f283ff806b2031f407db64c4d3edcda8fb9f9f5/tensorflow/lite/kernels/svdf.cc#L99-L102):

```cc
const int rank = params->rank;
...
TF_LITE_ENSURE_EQ(context, num_filters % rank, 0);
```

An attacker can craft a model such that `params->rank` would be 0.

### Patches
We have patched the issue in GitHub commit [6841e522a3e7d48706a02e8819836e809f738682](https://github.com/tensorflow/tensorflow/commit/6841e522a3e7d48706a02e8819836e809f738682).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-4fc7-hc63-7fjg
Summary: Exposure of repository credentials to external third-party sources in Rancher
Aliases: CVE-2021-36778
Severity: HIGH
CVSS score: 8.3
CWE: CWE-200
Published: 2022-05-02T19:33:34Z

### Impact
This issue only happens when the user configures access credentials to a private repository in Rancher inside `Apps & Marketplace > Repositories`. It affects Rancher versions 2.5.0 up to and including 2.5.11 and from 2.6.0 up to and including 2.6.2.

An insufficient check of the same-origin policy when downloading Helm charts from a configured private repository can lead to exposure of the repository credentials to a third-party provider. This exposure happens when the private repository:

1. Does an HTTP redirect to a third-party repository or external storage provider.
2. Downloads an icon resource for the chart hosted on a third-party provider.

The address of the private repository is not leaked, only the credentials are leaked in the HTTP `Authorization` header in base64 format.

With the patched versions, the default behavior now is to only send the private repository credentials when subdomain or domain hostname match when following the redirect or downloading external resources.

### Patches
Patched versions include releases 2.5.12, 2.6.3 and later versions.

### Workarounds
1. Update Rancher to a patched version.
2. Check the Helm charts in your configured private repository for possible redirects to third-party storage, and for Helm chart icons from third-party sources.
3. Evaluate any Helm chart that might lead to the mentioned scenario and change affected credentials if deemed necessary.

### References
Information about the same-origin check and how to disable it is available in Rancher [documentation](https://rancher.com/docs/rancher/v2.6/en/helm-charts/#repositories).

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Vulnerability: GHSA-q4h8-7qff-gh6c
Summary: Server-side request forgery in Ghost CMS
Aliases: CVE-2020-8134
Severity: MODERATE
CVSS score: 8.1
CWE: CWE-918
Published: 2021-05-06T18:28:08Z

Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.
Vulnerability: GHSA-c9c5-9fpr-m882
Summary: Moderate severity vulnerability that affects sentry-raven
Aliases: CVE-2014-9490
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number.
Vulnerability: GHSA-5q58-x5h2-v5rx
Summary: Authenticated Privilege Escalation
Severity: LOW
CVSS score: 0
CWE: CWE-863
Published: 2020-12-21T18:01:08Z

### Impact
Authenticated Privilege Escalation

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020
Vulnerability: GHSA-4rgj-8mq3-hggj
Summary: Denial of Service in @hapi/subtext
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T20:32:11Z

Versions of `@hapi/subtext` prior to 6.1.2 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 6.1.2 or later.
Vulnerability: GHSA-m7rg-8wvq-846v
Summary: Prototype pollution
Aliases: CVE-2021-25947
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-06-07T21:49:14Z

Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-fmr4-w67p-vh8x
Summary: Moderate severity vulnerability that affects org.wildfly:wildfly-undertow
Aliases: CVE-2018-1047
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2018-10-19T16:55:35Z

A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
Vulnerability: GHSA-657m-v5vm-f6rw
Summary: Cross-Site-Request-Forgery in Backend
Aliases: CVE-2021-41113
Severity: MODERATE
CVSS score: 8.8
CWE: CWE-352, CWE-309
Published: 2021-10-05T20:23:47Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2)

### Problem
It has been discovered that the new TYPO3 v11 feature that allows users to create and share [deep links in the backend user interface](https://typo3.org/article/typo3-version-112-escape-the-orbit#c12178) is vulnerable to cross-site-request-forgery.

The impact is the same as described in [TYPO3-CORE-SA-2020-006 (CVE-2020-11069)](https://typo3.org/security/advisory/typo3-core-sa-2020-006). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system.

To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time.

The following [Same-Site cookie settings](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/8.7.x/Feature-90351-ConfigureTYPO3-shippedCookiesWithSameSiteFlag.html) in _$GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite]_ are required for an attack to be successful:

* _SameSite=_***strict***: malicious evil.**example.org** invoking TYPO3 application at good.**example.org**
* _SameSite=_***lax*** or ***none***: malicious **evil.com** invoking TYPO3 application at **example.org**

### Solution
Update your instance to TYPO3 version 11.5.0 which addresses the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 core & security team members Benni Mack and Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-014](https://typo3.org/security/advisory/typo3-core-sa-2021-014)
* [CVE-2020-11069](https://nvd.nist.gov/vuln/detail/CVE-2020-11069) reintroduced in TYPO3 v11.2.0
Vulnerability: GHSA-q76j-58cx-wp5v
Summary: Vulnerability in RPKI manifest validation
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2020-11-13T17:28:49Z


A vulnerability in RPKI manifest validation exists when objects on the manifest are hidden, or expired objects are replayed. An attacker successfully exploiting this vulnerability could prevent new ROAs from being received or selectively hide ROAs, causing routes to become INVALID.

To exploit this vulnerability, an attacker would need to perform a man in the middle attack on the TLS connection between the validator and an RRDP repository or perform a man in the middle attack against a rsync-only repository.

The update addresses the vulnerability by implementing validation methods from [RFC 6486bis](https://datatracker.ietf.org/doc/draft-ietf-sidrops-6486bis/00/) and enabling strict validation by default.
Vulnerability: GHSA-6jqj-f58p-mrw3
Summary: Denial of Service in TenderMint
Aliases: CVE-2020-15091
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-347
Published: 2021-12-20T18:17:33Z

### Description

**Denial of Service**

Tendermint 0.33.0 and above allow block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it without changing the chainID. (It is a [misconfiguration](https://docs.tendermint.com/master/tendermint-core/using-tendermint.html) to reuse chainIDs.) Correct block proposers will accidentally include signatures for the wrong block if they see these signatures, and then commits won't validate, making all proposed blocks invalid. A malicious validator (even with a minimal amount of stake) can use this vulnerability to completely halt the network.

Tendermint 0.33.6 checks all the signatures are for the block with +2/3 majority before creating a commit.

**False Witness**

Tendermint 0.33.1 and above are no longer fully verifying commit signatures during block execution - they stop after +2/3. This means proposers can propose blocks that contain valid +2/3 signatures and then the rest of the signatures can be whatever they want. They can claim that all the other validators signed just by including a CommitSig with arbitrary signature data. While this doesn't seem to impact safety of Tendermint per se, it means that Commits may contain a lot of invalid data **.

_** This was already true of blocks, since they could include invalid txs filled with garbage, but in that case the application knew that they are invalid and could punish the proposer. But since applications didn't--and don't-- verify commit signatures directly (they trust Tendermint to do that), they won't be able to detect it._

This can impact incentivization logic in the application that depends on the LastCommitInfo sent in BeginBlock, which includes which validators signed. For instance, Gaia incentivizes proposers with a bonus for including more than +2/3 of the signatures. But a proposer can now claim that bonus just by including arbitrary data for the final -1/3 of validators without actually waiting for their signatures. There may be other tricks that can be played because of this.

Tendermint 0.33.6 verifies all the signatures during block execution ***.

_*** Please note that the light client does not check nil votes and exits as soon as 2/3+ of the signatures are checked._

### Impact

- All nodes
- The network stops due to having a commit with a wrong signature.

### Patches

- v0.33.6

### Workarounds

No workarounds.

### References

- https://github.com/tendermint/tendermint/issues/4926

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [tendermint/tendermint](https://github.com/tendermint/tendermint)
* Email us at [security@tendermint.com](mailto:security@tendermint.com)

More information can be found [here](https://tendermint.com/security/).
Vulnerability: GHSA-whc7-5p35-4ww2
Summary: Use after free in actix-service
Aliases: CVE-2020-35899
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-416
Published: 2021-08-25T20:49:06Z

An issue was discovered in the actix-service crate before 1.0.6 for Rust. The Cell implementation allows obtaining more than one mutable reference to the same data.
Vulnerability: GHSA-fqpx-cq8x-9wp4
Summary: Unaligned references in sized-chunks
Aliases: CVE-2020-25796
Severity: HIGH
CVSS score: 7.5
CWE: CWE-129
Published: 2021-08-25T20:46:03Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the InlineArray implementation, an unaligned reference may be generated for a type that has a large alignment requirement.
Vulnerability: GHSA-w4rc-rx25-8m86
Summary: Improper Input Validation in Symfony
Aliases: CVE-2019-11325
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-116
Published: 2020-02-12T18:44:16Z

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
Vulnerability: GHSA-4p3x-8qw9-24w9
Summary: Authenticated Stored XSS in shopware/shopware
Aliases: CVE-2021-41188
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-79
Published: 2021-10-27T18:53:18Z

### Impact
Authenticated Stored XSS in Administration

### Patches
Use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### Workarounds
If you cannot use the security plugin, add the following config to your `.htaccess` file

```
<IfModule mod_headers.c>
    <FilesMatch "\.(?i:svg)$">
        Header set Content-Security-Policy "script-src 'none'"
    </FilesMatch>
</IfModule>
```

If you are using nginx as server config, you can add the following to your configuration:
```
server {
    # ...

    location ~* ^.+\.svg$ {
        add_header Content-Security-Policy "script-src 'none'";
    }
}
```

### References
https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021
Vulnerability: GHSA-7wv8-g97r-432h
Summary: Exposure of Sensitive Information to an Unauthorized Actor in microweber
Aliases: CVE-2022-0281
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2022-01-21T18:06:47Z

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-wrxc-mr2w-cjpv
Summary: Open Redirect in Grav
Aliases: CVE-2020-11529
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2022-01-07T00:20:50Z

Common/Grav.php in Grav before 1.6.23 has an Open Redirect.
Vulnerability: GHSA-6h3m-36w8-hv68
Summary: Arbitrary file write in nats-server
Aliases: CVE-2022-26652
Severity: HIGH
CVSS score: 6.5
CWE: CWE-22
Published: 2022-03-10T22:07:30Z

(This document is canonically: <https://advisories.nats.io/CVE/CVE-2022-26652.txt>)

## Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

JetStream is the optional RAFT-based resilient persistent feature of NATS.


## Problem Description

The JetStream streams can be backed up and restored via NATS. The backup format is a tar archive file.  Inadequate checks on the filenames within the archive file permit a so-called "Zip Slip" attack in the stream restore.

NATS nats-server through 2022-03-09 (fixed in release 2.7.4) did not correctly sanitize elements of the archive file, thus a user of NATS
could cause the NATS server to write arbitrary content to an attacker-controlled filename.


## Affected versions

NATS Server:
 * 2.2.0 up to and including 2.7.3.
   + Introduced with JetStream Restore functionality
 * Fixed with nats-io/nats-server: 2.7.4
 * Docker image:  nats <https://hub.docker.com/_/nats>
 * NB users of OS package files from our releases: a change in goreleaser defaults, discovered late in the release process, moved the install directory from /usr/local/bin to /usr/bin; we are evaluating the correct solution for subsequent releases, but not recutting this release.

NATS Streaming Server
 * 0.15.0 up to and including 0.24.2
 * Fixed with nats-io/nats-streaming-server: 0.24.3
 * Embeds a nats-server, but this server is the old approach which JetStream replaces, so unlikely (but not impossible) to be
   configured with JS support


## Workarounds

 * Disable JetStream for untrusted users.
 * If only one NATS account uses JetStream, such that cross-user attacks are not an issue, and any user in that account with access to the JetStream API is fully trusted anyway, then appropriate sandboxing techniques will prevent exploit.
   + Eg, with systemd, the supplied util/nats-server-hardened.service example configuration demonstrates that NATS runs fine as an unprivileged user under ProtectSystem=strict and PrivateTmp=true restrictions; by only opening a ReadWritePaths hole for the JetStream storage area, the impact of this vulnerability is limited.


## Solution

Upgrade the NATS server to at least 2.7.4.

We fully support the util/nats-server-hardened.service configuration for running a NATS server and encourage this approach.


## Credits

This issue was reported (on 2022-03-07) to the NATS Maintainers by
Yiming Xiang, TIANJI LAB of NSFOCUS.  
Thank you / 谢谢你！
Vulnerability: GHSA-3pqg-4rqg-pg9g
Summary: Cross-site Scripting in OWASP AntiSamy
Aliases: CVE-2022-28367
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-23T00:03:04Z

OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Vulnerability: GHSA-hj9h-wrgg-hgmx
Summary: Data races in lock_api
Aliases: CVE-2020-35913
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362
Published: 2021-08-25T20:50:02Z

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
Vulnerability: GHSA-chh2-rvhg-wqwr
Summary: Malicious Package in json-serializer
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T21:02:10Z

Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-c6c4-7x48-4cqp
Summary: Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Severity: MODERATE
CVSS score: 4
CWE: CWE-208
Published: 2021-04-19T14:47:47Z

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

- https://vaadin.com/security/cve-2021-31404
Vulnerability: GHSA-qf76-pr7x-h7r4
Summary: Incorrect Access Control in Nacos
Aliases: CVE-2020-19676
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-08-02T16:38:01Z

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)
Vulnerability: GHSA-8gvg-8vhf-h26g
Summary: Out-of-bounds write
Aliases: CVE-2019-0937
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:03Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933.
Vulnerability: GHSA-93j5-g845-9wqp
Summary: Unsafe HTTP Redirect in Puppet Agent and Puppet Server
Aliases: CVE-2021-27023
Severity: MODERATE
CVSS score: 6.5
Published: 2021-12-02T17:52:45Z

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Vulnerability: GHSA-7qfm-6m33-rgg9
Summary: XML External Entity Reference
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2021-08-13T15:21:59Z

An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
Vulnerability: GHSA-8rh6-h94m-vj54
Summary: Incorrect Comparison in cvxopt
Aliases: CVE-2021-41500
Severity: HIGH
CVSS score: 7.5
CWE: CWE-697
Published: 2022-01-07T00:01:11Z

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.
Vulnerability: GHSA-x823-j7c4-vpc5
Summary: Cross-site scripting in sickrage
Aliases: CVE-2021-25926
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-04-20T16:31:43Z

In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
Vulnerability: GHSA-j9q7-3rhf-4ppv
Summary: Downloads Resources over HTTP in windows-selenium-chromedriver
Aliases: CVE-2016-10687
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:11:08Z

Affected versions of `windows-selenium-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-selenium-chromedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5x32-c9mf-49cc
Summary: Directory traversal in RubyGems
Aliases: CVE-2019-8320
Severity: HIGH
CVSS score: 7.4
CWE: CWE-22
Published: 2019-06-20T16:06:15Z

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
Vulnerability: GHSA-m8p2-495h-ccmh
Summary: The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
Aliases: CVE-2019-10219
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2020-01-08T17:01:52Z

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
Vulnerability: GHSA-8vj2-vxx3-667w
Summary: Arbitrary expression injection in Pillow
Aliases: CVE-2022-22817
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2022-01-12T20:07:33Z

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method `ImageMath.eval("exec(exit())")`.

While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.
Vulnerability: GHSA-9wjh-jr2j-6r4x
Summary: Remote Code Execution in pi_video_recording
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2020-09-02T15:55:58Z

All versions of `pi_video_recording` are vulnerable to Remote Code Execution. Due to insufficient input validation the server executes arbitrary code through the /api/record/start endpoint.  After running the server, `curl -POST -H "Content-Type: application/json" -d '{"filename": " || touch /tmp/worked;"}' http://localhost:5000/api/record/start`creates a file in the /tmp/ directory


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.