TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-m298-fh5c-jc66
Summary: Object injection in PHPMailer/PHPMailer
Aliases: CVE-2020-36326
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502, CWE-641
Published: 2021-05-04T17:42:13Z

### Impact
This is a reintroduction of an earlier issue (CVE-2018-19296) by an unrelated bug fix in PHPMailer 6.1.8.  An external file may be unexpectedly executable if it is used as a path to an attachment file via PHP's support for `.phar` files`. Exploitation requires that an attacker is able to provide an unfiltered path to a file to attach, or to trick calling code into generating one. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info.

### Patches
This issue was patched in the PHPMailer 6.4.1 release. This release also implements stricter filtering for attachment paths; paths that look like *any* kind of URL are rejected.

### Workarounds
Validate paths to loaded files using the same pattern as used in [`isPermittedPath()`](https://github.com/PHPMailer/PHPMailer/blob/master/src/PHPMailer.php#L1815) before using them in *any* PHP file function, such as `file_exists`. This method can't be used directly because it is protected, but you can implement the same thing in calling code. Note that this should be applied to *all* user-supplied paths passed into such functions; it's not a problem specific to PHPMailer.

### Credit
This issue was found by Fariskhi Vidyan, reported and managed via Tidelift.
Vulnerability: GHSA-h6gg-fvf5-qgwf
Summary: Data races in generator
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T20:55:41Z

The `Generator` type is an iterable which uses a generator function that yields
values. In affected versions of the crate, the provided function yielding values
had no `Send` bounds despite the `Generator` itself implementing `Send`.

The generator function lacking a `Send` bound means that types that are
dangerous to send across threads such as `Rc` could be sent as part of a
generator, potentially leading to data races.

This flaw was fixed in commit [`f7d120a3b`](https://github.com/Xudong-Huang/generator-rs/commit/f7d120a3b724d06a7b623d0a4306acf8f78cb4f0)
by enforcing that the generator function be bound by `Send`.
Vulnerability: GHSA-6663-c963-2gqg
Summary: DoS due to excessively large websocket message in ws
Aliases: CVE-2016-10542
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2019-02-18T23:58:35Z

Affected versions of `ws` do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.



## Recommendation

Update to version 1.1.1 or later. 
Alternatively, set the `maxpayload` option for the `ws` server to a value smaller than 256MB.
Vulnerability: GHSA-ppj4-34rq-v8j9
Summary: regular expression denial of service in gjson
Aliases: CVE-2021-42836
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-697, CWE-1333
Published: 2021-10-25T19:43:15Z

GJSON is a Go package that provides a fast and simple way to get values from a json document. GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
Vulnerability: GHSA-v756-4whv-48vc
Summary: Code Injection in cd-messenger
Aliases: CVE-2020-7675
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-17T21:00:24Z

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution.
Vulnerability: GHSA-v7q8-wvvh-c97p
Summary: Moderate severity vulnerability that affects Zope2
Aliases: CVE-2010-1104
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-23T19:51:28Z

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
Vulnerability: GHSA-hxp5-8pgq-mgv9
Summary: Missing Authentication for Critical Function in Apache Calcite
Aliases: CVE-2020-13955
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2021-04-22T16:14:14Z

"HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses this method internally to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore."
Vulnerability: GHSA-x4jg-mjrx-434g
Summary: Improper Verification of Cryptographic Signature in node-forge
Aliases: CVE-2022-24772
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2022-03-18T23:10:28Z

### Impact

RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### References

For more information, please see
["Bleichenbacher's RSA signature forgery based on implementation error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
by Hal Finney.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
Vulnerability: GHSA-rf7q-xqm3-6923
Summary: Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML
Aliases: CVE-2016-5395
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2018-10-17T17:21:37Z

Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.
Vulnerability: GHSA-rrc9-gqf8-8rwg
Summary: Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader
Aliases: CVE-2020-28472
Severity: HIGH
CVSS score: 7.3
CWE: CWE-400
Published: 2021-11-16T21:26:43Z

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
Vulnerability: GHSA-22j5-38qv-pxx7
Summary: Hijacked Environment Variables in sqliter
Aliases: CVE-2017-16051
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T20:50:04Z

The `sqliter` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-5h26-c766-g93v
Summary: Cross-Site Scripting
Aliases: CVE-2021-20293
Severity: HIGH
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-15T15:59:27Z

A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
Vulnerability: GHSA-rr3c-f55v-qhv5
Summary: Denial of service vulnerability exists when .NET and .NET Core improperly process XML documents
Aliases: CVE-2018-0764
Severity: HIGH
CVSS score: 7.5
Published: 2018-10-16T17:34:00Z

Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.
Vulnerability: GHSA-884w-698f-927f
Summary: Arbitrary File Write via Archive Extraction in unzipper
Aliases: CVE-2018-1002203
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-27T17:06:50Z

Versions of `unzipper` before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example).


## Recommendation

Update to version 0.3.18 or later.
Vulnerability: GHSA-28r6-jm5h-mrgg
Summary: Access control bypass in Beego
Aliases: CVE-2021-30080
Severity: HIGH
CVSS score: 0
Published: 2022-04-06T00:01:30Z

An issue was discovered in the route lookup process in beego through 2.0.1, allows attackers to bypass access control.
Vulnerability: GHSA-9jcx-pr2f-qvq5
Summary: Denial of Service (DoS)
Aliases: CVE-2018-17419
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-18T18:34:25Z

An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a segmentation violation, leading to denial of service.
Vulnerability: GHSA-j7c3-96rf-jrrp
Summary: Critical vulnerability in log4j may affect generated PEAR projects
Severity: CRITICAL
CVSS score: 0
Published: 2021-12-16T21:01:51Z

### Impact
UIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.

### Patches
- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version >= `2.0.1` for generating new PEAR projects.

- Existing maven PEAR projects can be patched by manually upgrading to `log4j` >= `2.16.0` in `pom.xml`.


### References
https://www.lunasec.io/docs/blog/log4j-zero-day/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/averbis/pear-archetype/issues
Vulnerability: GHSA-hhxm-4f85-rgr8
Summary: High severity vulnerability that affects many_versioned_gem
Severity: HIGH
CVSS score: 0
Published: 2019-02-05T16:25:34Z

### Logs password in plaintext

### Impact

Logs the password used in plaintext.  The password should masked in logs to prevent it leaking.

### Patches
Has the problem been patched? What versions should users upgrade to?

### Workarounds
none

### See also
Are there any links users can visit to find out more information?


#### Package Ecosystem
RubyGems

#### Package Name
many_versioned_gem

#### Affected Versions
< 0.2.2

#### Patches
0.2.3
Vulnerability: GHSA-c2fx-8r76-gh36
Summary: High severity vulnerability that affects python-gnupg
Aliases: CVE-2013-7323
Severity: HIGH
CVSS score: 0
Published: 2018-11-06T23:14:22Z

python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Vulnerability: GHSA-9cq4-mhmr-84gm
Summary: Malicious Package in jasmin
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:26:49Z

Version 0.0.3 of `jasmin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.3 of this module is found installed you will want to replace it with a version before or after 0.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-7jr6-prv4-5wf5
Summary: Credential leak in Helm
Aliases: CVE-2021-32690
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-200
Published: 2021-06-23T18:14:31Z

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.
Vulnerability: GHSA-2wc6-2rcj-8v76
Summary: scalarmult() vulnerable to degenerate public keys
Aliases: CVE-2017-1000168
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1240
Published: 2021-08-25T21:00:41Z

The `scalarmult()` function included in previous versions of this crate
accepted all-zero public keys, for which the resulting Diffie-Hellman shared
secret will always be zero regardless of the private key used.

This issue was fixed by checking for this class of keys and rejecting them
if they are used.
Vulnerability: GHSA-hgch-jjmr-gp7w
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Aliases: CVE-2019-10760
Severity: CRITICAL
CVSS score: 9.9
CWE: CWE-94
Published: 2019-10-17T18:27:30Z

Versions of `safer-eval` before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.


## Recommendation

Upgrade to version 1.3.2.
Vulnerability: GHSA-84mw-34w6-2q43
Summary: Null pointer dereference via invalid Ragged Tensors
Aliases: CVE-2021-29516
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:20:58Z

### Impact
Calling `tf.raw_ops.RaggedTensorToVariant` with arguments specifying an invalid ragged tensor results in a null pointer dereference:

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
filter_tensor = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)

tf.raw_ops.Conv3D(input=input_tensor, filter=filter_tensor, strides=[1, 56, 56, 56, 1], padding='VALID', data_format='NDHWC', dilations=[1, 1, 1, 23, 1])
```

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[2, 2, 2, 2, 0], dtype=tf.float32)
filter_tensor = tf.constant([], shape=[0, 0, 2, 6, 2], dtype=tf.float32)

tf.raw_ops.Conv3D(input=input_tensor, filter=filter_tensor, strides=[1, 56, 39, 34, 1], padding='VALID', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```

The implementation of [`RaggedTensorToVariant` operations](https://github.com/tensorflow/tensorflow/blob/904b3926ed1c6c70380d5313d282d248a776baa1/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L39-L40) does not validate that the ragged tensor argument is non-empty:

```cc
  int ragged_rank = batched_ragged.ragged_rank();
  auto batched_splits_top_vec = batched_ragged.splits(0).vec<SPLIT_TYPE>();
```

Since `batched_ragged` contains no elements, `batched_ragged.splits` is a null vector, thus `batched_ragged.splits(0)` will result in  dereferencing `nullptr`.

### Patches
We have patched the issue in GitHub commit [b055b9c474cd376259dde8779908f9eeaf097d93](https://github.com/tensorflow/tensorflow/commit/b055b9c474cd376259dde8779908f9eeaf097d93).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-v26w-gcxh-v4r7
Summary: Prototype polluation in just-safe-set
Aliases: CVE-2021-25952
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321, CWE-915
Published: 2021-12-10T18:50:40Z

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-62m3-fc7f-jpp8
Summary: Class-Name Injection
Aliases: CVE-2019-10905
Severity: HIGH
CVSS score: 8.1
CWE: CWE-79
Published: 2022-03-26T00:09:58Z

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.
Vulnerability: GHSA-5cv7-r488-wc5x
Summary: Hijacked Environment Variables in noderequest
Aliases: CVE-2017-16073
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-09-17T20:39:17Z

The `noderequest` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-4qhx-g9wp-g9m6
Summary: Failure to sanitize quotes which can lead to sql injection in squel
Severity: CRITICAL
CVSS score: 0
CWE: CWE-89, CWE-74
Published: 2019-06-14T16:09:01Z

All versions of `squel` are vulnerable to sql injection.

The `squel` package does not properly escape user provided input when provided using the `setFields` method. This could lead to sql injection if the query was then executed.

Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.
```
> console.log(squel.insert().into('buh').setFields({foo: "bar'baz"}).toString());
INSERT INTO buh (foo) VALUES ('bar'baz')
```


## Recommendation

There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.
Vulnerability: GHSA-x44x-r84w-8v67
Summary: Lack of URL normalization may lead to authorization bypass when URL access rules are used
Aliases: CVE-2020-24660
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-287
Published: 2020-09-09T18:45:55Z

### Impact
When access rules are used inside a protected host, some URL encodings may bypass filtering system.

### Patches
Version 0.5.2 includes a patch that fixes the vulnerability

### Workarounds
No way for users to fix or remediate the vulnerability without upgrading

### References
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [this repository](https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/issues) or [LemonLDAP::NG GitLab](https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues)
* Email us at [lemonldap-ng-users@ow2.org](mailto:lemonldap-ng-users@ow2.org)
Vulnerability: GHSA-rwmv-c7v8-v9vf
Summary: Malicious Package in bitcoimd-rpc
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:36:45Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-j6p2-cx3w-6jcp
Summary: Cross-Site Scripting in backbone
Aliases: CVE-2016-10537
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-02-18T23:39:55Z

Affected versions of `backbone` are vulnerable to cross-site scripting when users are allowed to supply input to the `Model#Escape` function, and the output is then written to the DOM. 

The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as `&#60;` into account.


## Recommendation

Update to version 0.5.0 or later.
Vulnerability: GHSA-8cv5-p934-3hwp
Summary: Denial of service in fast-csv
Aliases: CVE-2020-26256
Severity: LOW
CVSS score: 5.7
CWE: CWE-400
Published: 2020-12-08T21:42:53Z

### Impact
Possible ReDoS (Regular Expression Denial of Service) when using `ignoreEmpty` option when parsing.

### Patches
This has been patched in `v4.3.6`

### Workarounds
You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6`

### References

This vulnerability was found using a [CodeQL](https://securitylab.github.com/tools/codeql) query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.
[Link to query run](https://lgtm.com/query/8609731774537641779/). 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fast-csv](https://github.com/C2FO/fast-csv)
Vulnerability: GHSA-8pwx-j4r6-5v38
Summary: Malicious Package in hdkye
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:05:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4vj3-f849-5r48
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7653
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-59
Published: 2020-06-03T22:02:21Z

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.
Vulnerability: GHSA-4v2w-h9jm-mqjg
Summary: Prototype Pollution in systeminformation
Aliases: CVE-2020-26245
Severity: MODERATE
CVSS score: 8.1
CWE: CWE-471, CWE-78
Published: 2020-11-27T16:07:15Z

### Impact
command injection vulnerability by prototype pollution

### Patches
Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
Vulnerability: GHSA-c3h5-qchh-46hh
Summary: Directory Traversal in yyooopack
Aliases: CVE-2017-16167
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:30:17Z

Affected versions of `yyooopack` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-68w8-qjq3-2gfm
Summary: Path Traversal in Django
Aliases: CVE-2021-33203
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-22
Published: 2021-06-10T17:21:00Z

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.
Vulnerability: GHSA-593v-wcqx-hq2w
Summary: Incorrect version tags linked to external repository
Severity: CRITICAL
CVSS score: 0
Published: 2021-09-07T22:57:58Z

### Impact
A security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse Platform. Even though no releases were published with these incorrect versions, it was possible to define a Parse Server dependency that pointed to these version tags, for example if you defined this dependency: 
```js
"parse-server": "git@github.com:parse-community/parse-server.git#4.9.3"
```

We have since deleted the incorrect version tags, but they may still show up in your personal fork on GitHub or locally. We do not know when these tags have been pushed to the Parse Server repository, but we first became aware of this issue on July 21, 2021. We are not aware of any malicious code or concerns related to privacy, security or legality (e.g. proprietary code). However, it has been reported that some functionality does not work as expected and the introduction of security vulnerabilities cannot be ruled out.

You may be also affected if you used the Bitnami image for Parse Server. Bitnami picked up the incorrect version tag `4.9.3` and published a new Bitnami image for Parse Server. 
 
**If you are using any of the affected versions, we urgently recommend to upgrade to version `4.10.0`.**


These are the incorrect tags:
```
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-beta4
4.0.0-beta5
4.0.0-beta6
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.3
4.0.4
4.0.6
4.0.7
4.0.8
4.0.9
4.6.0
4.6.0-beta
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.2
4.9.3
```

### Patches
Upgrade to version `4.10.0`.

### Workarounds
Downgrade to version `4.5.2`.

### References
n/a
Vulnerability: GHSA-f8vc-wfc8-hxqh
Summary: Improper Privilege Management in Apache Hadoop
Aliases: CVE-2020-9492
Severity: HIGH
CVSS score: 8.8
CWE: CWE-863, CWE-269
Published: 2022-02-09T22:17:38Z

In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to remote URL without proper verification.
Vulnerability: GHSA-rcpf-vj53-7h2m
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1257
Severity: MODERATE
CVSS score: 6.5
Published: 2018-10-17T20:02:20Z

Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack.
Vulnerability: GHSA-ch3r-vp46-8g22
Summary: Code injection in topthink/think
Aliases: CVE-2020-17952
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2021-08-09T20:39:52Z

A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
Vulnerability: GHSA-4w4p-xwrr-9crh
Summary: Injection in Apache Syncope
Aliases: CVE-2020-1961
Severity: HIGH
CVSS score: 9.8
CWE: CWE-74
Published: 2021-06-16T17:18:49Z

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.
Vulnerability: GHSA-9856-9gg9-qcmq
Summary: Consensus flaw during block processing
Aliases: CVE-2021-39137
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-436
Published: 2021-08-30T16:15:41Z

### Impact

A vulnerability in the Geth EVM could cause a node to reject the canonical chain. 

### Description 

A memory-corruption bug within the EVM can cause a consensus error, where vulnerable nodes obtain a different `stateRoot` when processing a maliciously crafted transaction. This, in turn, would lead to the chain being split in two forks.

All Geth versions supporting the London hard fork are vulnerable (which predates London), so all users should update.

This bug was exploited on Mainnet at block 13107518, leading to a minority chain split. 

### Patches

A patch is included in the `v1.10.8` release.
The exact patch to fix the issue is contained within this [commit](https://github.com/ethereum/go-ethereum/pull/23381/commits/4d4879cafd1b3c906fc184a8c4a357137465128f)

### Workarounds

No workarounds exist, save to update and/or apply the patch commit. 

### References. 

Post-mortem [write-up](https://github.com/ethereum/go-ethereum/blob/master/docs/postmortems/2021-08-22-split-postmortem.md).

### Credits

The bug was found by @guidovranken (working for [Sentnl](https://sentnl.io/) during an audit of the [Telos EVM](https://www.telos.net/evm)) and reported via bounty@ethereum.org.

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum/)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Vulnerability: GHSA-gxjj-f44v-qm94
Summary: Open Redirect in Flask-Security-Too
Severity: LOW
CVSS score: 3.1
CWE: CWE-601
Published: 2021-12-14T18:14:04Z

# Withdrawn

Duplicate of GHSA-6qmf-fj6m-686c

# Original description

Flask-Security-Too allows redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL.

This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com
will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want.

This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False`.
Vulnerability: GHSA-r36x-p5pv-9mfx
Summary: Downloads Resources over HTTP in prebuild-lwip
Aliases: CVE-2016-10652
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:45:25Z

Affected versions of `prebuild-lwip` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-hhw9-35p2-q2c5
Summary: Steam Socialite Provider v1 does not correctly validate openid server
Severity: CRITICAL
CVSS score: 0
CWE: CWE-346
Published: 2021-01-29T20:51:30Z

### Impact
The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.

### Patches
This vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)
* Email us at [socialite@atymic.dev](mailto:socialite@atymic.dev)
Vulnerability: GHSA-qjj8-32p7-h289
Summary: Division by 0 in `ResourceGather`
Aliases: CVE-2021-37653
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:43:04Z

### Impact
An attacker can trigger a crash via a floating point exception in `tf.raw_ops.ResourceGather`:

```python
import tensorflow as tf

tensor = tf.constant(value=[[]],shape=(0,1),dtype=tf.uint32)
v = tf.Variable(tensor)
tf.raw_ops.ResourceGather(
  resource=v.handle,
  indices=[0],
  dtype=tf.uint32,
  batch_dims=1,
  validate_indices=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L725-L731) computes the value of a value, `batch_size`, and then divides by it without checking that this value is not 0. 

### Patches
We have patched the issue in GitHub commit  [ac117ee8a8ea57b73d34665cdf00ef3303bc0b11](https://github.com/tensorflow/tensorflow/commit/ac117ee8a8ea57b73d34665cdf00ef3303bc0b11).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-4hpq-rjcx-7vj9
Summary: Open Redirect in clearance
Aliases: CVE-2021-23435
Severity: HIGH
CVSS score: 7.6
CWE: CWE-601
Published: 2021-09-13T20:05:09Z

This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).
Vulnerability: GHSA-fv3m-xhqw-9m79
Summary: ballcat-codegen template engine remote code execution injection
Aliases: CVE-2022-24881
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2022-04-27T21:05:15Z

### Impact
Ballcat Codegen provides the function of online editing code to generate templates.
In version < 1.0.0.beta.2, since Velocity and freemarker templates are introduced but input verification is not done, attackers can implement remote code execution through malicious code injection of the template engine.

### Patches
The fault is rectified and needs to be upgraded to the latest version.
Vulnerability: GHSA-q5r4-cfpx-h6fh
Summary: Improper Handling of Length Parameter Inconsistency in Apache Ant
Aliases: CVE-2021-36373
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-130
Published: 2021-08-02T16:56:17Z

When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Vulnerability: GHSA-f5f4-m7qp-w6gc
Summary: Cross-site Scripting in Jooby
Aliases: CVE-2019-15477
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-08-27T17:40:33Z

Jooby before 1.6.4 has XSS via the default error handler.
Vulnerability: GHSA-332q-7ff2-57h2
Summary: Prototype Pollution in undefsafe
Aliases: CVE-2019-10795
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-74
Published: 2022-02-09T22:34:01Z

undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.
Vulnerability: GHSA-vfp4-xx6m-7vf6
Summary: Cryptographic Issues in ECK
Aliases: CVE-2020-7010
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-335
Published: 2022-02-15T01:57:18Z

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.
Vulnerability: GHSA-j2h6-73x8-22c4
Summary: Exposure of Sensitive Information to an Unauthorized Actor in ansible
Aliases: CVE-2020-1746
Severity: MODERATE
CVSS score: 5
CWE: CWE-200
Published: 2021-04-20T16:43:53Z

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.
Vulnerability: GHSA-m7fm-4jfh-jrg6
Summary: Use after free in boosted trees creation
Aliases: CVE-2021-37652
Severity: HIGH
CVSS score: 7.8
CWE: CWE-416
Published: 2021-08-25T14:43:07Z

### Impact
The implementation for `tf.raw_ops.BoostedTreesCreateEnsemble` can result in a use after free error if an attacker supplies specially crafted arguments:

```python
import tensorflow as tf

v= tf.Variable([0.0])
tf.raw_ops.BoostedTreesCreateEnsemble(
  tree_ensemble_handle=v.handle,
  stamp_token=[0],
  tree_ensemble_serialized=['0']) 
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/boosted_trees/resource_ops.cc#L55) uses a reference counted resource and decrements the refcount if the initialization fails, as it should. However, when the code was written, the  resource was represented as a naked pointer but later refactoring has changed it to be a smart pointer. Thus, when the pointer leaves the scope, a subsequent `free`-ing of the resource occurs, but this fails to take into account that the refcount has already reached 0, thus the resource has been already freed. During this double-free process, members of the resource object are accessed for cleanup but they are invalid as the entire resource has been freed.

### Patches
We have patched the issue in GitHub commit [5ecec9c6fbdbc6be03295685190a45e7eee726ab](https://github.com/tensorflow/tensorflow/commit/5ecec9c6fbdbc6be03295685190a45e7eee726ab).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-52mq-6jcv-j79x
Summary: User content sandbox can be confused into opening arbitrary documents
Aliases: CVE-2021-21320
Severity: LOW
CVSS score: 2.6
CWE: CWE-345
Published: 2021-03-03T02:23:56Z

### Impact

The user content sandbox can be abused to trick users into opening unexpected documents after several user interactions. The content can be opened with a `blob` origin from the Matrix client, so it is possible for a malicious document to access user messages and secrets.

### Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5657, which is included in 3.15.0.

### Workarounds

There are no known workarounds.
Vulnerability: GHSA-8687-vv9j-hgph
Summary: Improper Input Validation in Automattic Mongoose
Aliases: CVE-2019-17426
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-20
Published: 2019-10-22T20:19:54Z

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Vulnerability: GHSA-v525-c3g5-cg9p
Summary: Unsafe Deserialization that can Result in Code Execution
Aliases: CVE-2020-36282
Severity: HIGH
CVSS score: 0
CWE: CWE-502
Published: 2021-12-10T17:15:49Z

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Vulnerability: GHSA-p93c-h8qm-7256
Summary: Improper escaping in XWiki Platform
Aliases: CVE-2020-13654
Severity: HIGH
CVSS score: 7.5
CWE: CWE-116
Published: 2022-02-09T22:32:29Z

XWiki Platform before 12.8 mishandles escaping in the property displayer.
Vulnerability: GHSA-jrh7-mhhx-6h88
Summary: Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Aliases: CVE-2021-21393
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-04-13T15:12:40Z

### Impact
Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.

### Patches
This issue is fixed by #9321 and #9393.

### Workarounds
The groups feature can be disabled (by setting `enable_group_creation` to `False`) to mitigate this issue. Note that it is disabled by default.

### Other information
Note that the groups feature is not part of the [Matrix specification](https://matrix.org/docs/spec/) and the chosen maximum lengths are arbitrary. Not all clients might abide by them.
Vulnerability: GHSA-9q94-v7ch-mxqw
Summary: Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard
Aliases: CVE-2020-8867
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-613, CWE-367
Published: 2021-08-02T17:35:42Z

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of sessions. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to create a denial-of-service condition against the application. Was ZDI-CAN-10295.
Vulnerability: GHSA-m6j2-v3gq-45r5
Summary: Cross-site Scripting in aurelia-framework
Aliases: CVE-2019-10062
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-02-10T23:42:39Z

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example.
Vulnerability: GHSA-cq77-8jpx-892g
Summary: Command Injection in killing
Aliases: CVE-2021-23381
Severity: HIGH
CVSS score: 7.3
CWE: CWE-77
Published: 2021-05-06T15:53:32Z

This affects all versions of package killing up to and including 1.0.6. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.