TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-9c4x-5hgq-q3wh
Summary: Instance config inline secret exposure in Grafana
Aliases: CVE-2021-41090
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200, CWE-312
Published: 2021-12-08T19:52:40Z

### Impact
Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server:

* Inline secrets for metrics instance configs in the base YAML file are exposed at `/-/config` 
* Inline secrets for integrations are exposed at `/-/config`
* Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at `/-/config`.
* Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at `/-/config`.
* Inline secrets for metrics instance configs loaded from the scraping service are exposed at `/agent/api/v1/configs/{name}`.

Inline secrets will be exposed to anyone being able to reach these endpoints.

Secrets found in these sections are used for:

* Delivering metrics to a Prometheus Remote Write system 
* Authenticating against a system for discovering Prometheus targets 
* Authenticating against a system for collecting metrics (scrape_configs and integrations)
* Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode 
* Authenticating against Kafka for receiving traces

Non-inlined secrets, such as `*_file`-based secrets, are not impacted by this vulnerability. 

### Patches

Download [v0.20.1](https://github.com/grafana/agent/releases/tag/v0.20.1) or any version past [v0.21.2](https://github.com/grafana/agent/releases/tag/v0.21.2) to patch Grafana Agent. These patches obfuscate the listed impacted secrets from the vulnerable endpoints.

The patches also disable the endpoints by default. Pass the command-line flag `--config.enable-read-api` to opt-in and re-enable the endpoints.  
 
### Workarounds
If for some reason you cannot upgrade, use non-inline secrets where possible. Not all configuration options may have a non-inline equivalent.

You also may desire to restrict API access to Grafana Agent, with some combination of:

* Restrict network interfaces Grafana Agent listens on through `http_listen_address` in the `server` block. `127.0.0.1` is the most restrictive, `0.0.0.0` is the default. 
* Configure Grafana Agent to use HTTPS with client authentication. 
* Use firewall rules to restrict external access to Grafana Agent's API.
Vulnerability: GHSA-h4hr-7fg3-h35w
Summary: Denial of service in prismjs
Aliases: CVE-2021-23341
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-03-01T19:52:33Z

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.
Vulnerability: GHSA-xxq4-3742-3h28
Summary: Generation of Error Message Containing Sensitive Information in microweber
Aliases: CVE-2022-0504
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-209
Published: 2022-02-09T00:00:31Z

microweber version 1.2.10 and prior may generate an error message containing sensitive information.
Vulnerability: GHSA-h6qv-f5gf-8gcf
Summary: Missing Authorization in Jenkins P4 plugin
Aliases: CVE-2021-21654
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2021-06-16T17:29:35Z

Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.
Vulnerability: GHSA-v899-28g4-qmh8
Summary: XML External Entity vulnerability in Easy-XML
Aliases: CVE-2020-26705
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-611
Published: 2021-11-01T19:19:54Z

The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input.
Vulnerability: GHSA-p3hc-fv2j-rp68
Summary: Prototype Pollution in swiper
Aliases: CVE-2021-23370
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-10T15:36:30Z

Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.
Vulnerability: GHSA-44cg-qcpr-fwjh
Summary: Cross site scripting in francoisjacquet/rosariosis
Aliases: CVE-2021-44565
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-25T00:01:07Z

A Cross Site Scripting (XSS) vulnerabilty exits in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JaveScript of HTML.An example of affected components are all Markdown input fields.
Vulnerability: GHSA-mr7p-25v2-35wr
Summary: Path Traversal in nltk
Aliases: CVE-2019-14751
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-08-23T21:53:51Z

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
Vulnerability: GHSA-r5fx-8r73-v86c
Summary: Cross-Site Scripting in angular
Aliases: CVE-2019-14863
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-02-14T23:08:49Z

Versions of `angular` prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize `xlink:href` attributes, which may allow attackers to execute arbitrary JavaScript in a victim's browser if the value is user-controlled.


## Recommendation

Upgrade to version 1.5.0-beta.1 or later.
Vulnerability: GHSA-7mqr-2v3q-v2wm
Summary: Ignored errors on token revokation in github.com/ory/fosite
Aliases: CVE-2020-15223
Severity: HIGH
CVSS score: 8
CWE: CWE-755
Published: 2021-05-24T16:57:39Z

### Impact
The `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store.

### References
[RFC 7009](https://tools.ietf.org/html/rfc7009#section-2.2.1) states that a 503 HTTP code must be returned when the server has a problem.
Vulnerability: GHSA-6m8p-x4qw-gh5j
Summary: Insufficient Session Expiration in OpenStack Keystone
Aliases: CVE-2020-12690
Severity: HIGH
CVSS score: 8.8
CWE: CWE-613
Published: 2021-06-09T17:34:09Z

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.
Vulnerability: GHSA-468q-v4jj-485h
Summary: Inefficient Regular Expression Complexity in taro
Aliases: CVE-2021-3804
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1333
Published: 2021-09-20T20:09:59Z

taro is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-rjmf-p882-645m
Summary: Improper Certificate Validation
Aliases: CVE-2021-20327
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-295
Published: 2021-04-12T18:51:17Z

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
Vulnerability: GHSA-862g-9h5m-m3qv
Summary: coreos-installer < 0.10.0 writes world-readable Ignition config to installed system
Aliases: CVE-2021-3917
Severity: LOW
CVSS score: 0
Published: 2021-11-08T18:01:13Z

### Impact
On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to `/boot/ignition/config.ign` with world-readable permissions, granting unprivileged users access to any secrets included in the config.

Default configurations of Fedora CoreOS and RHEL CoreOS do not include any unprivileged user accounts.  In addition, instances launched from a cloud image, and systems provisioned with the `ignition.config.url` kernel argument, do not use the `config.ign` file and are unaffected.

### Patches
coreos-installer 0.10.0 and later [writes](https://github.com/coreos/coreos-installer/pull/571) the Ignition config with restricted permissions.

### Workarounds

On Fedora CoreOS systems installed from version 34.20210711.3.0 (stable), 34.20210711.2.0 (testing), 34.20210711.1.1 (next) and later, the `/boot/ignition` directory and its contents are removed after provisioning is complete. All Fedora CoreOS systems that have updated to these versions or later have automatically removed the `/boot/ignition` directory and no action is required.

On other systems, `/boot/ignition/config.ign` can be removed manually, as it is not used after provisioning is complete:

```
sudo mount -o remount,rw /boot
sudo rm -rf /boot/ignition
```

### References
For more information, see https://github.com/coreos/fedora-coreos-tracker/issues/889.

### For more information
If you have any questions or comments about this advisory, [open an issue in coreos-installer](https://github.com/coreos/coreos-installer/issues/new/choose) or email the CoreOS [development mailing list](https://lists.fedoraproject.org/archives/list/coreos@lists.fedoraproject.org/).
Vulnerability: GHSA-m6vm-8g8v-xfjh
Summary: Out-of-bounds Write in OpenCV
Aliases: CVE-2019-5063
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-10-12T22:23:13Z

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 (corresponds with OpenCV-Python 4.1.0.25). A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
Vulnerability: GHSA-g8j6-m4p7-5rfq
Summary: High severity vulnerability that affects DotNetNuke.Core
Aliases: CVE-2017-0929
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2018-10-16T17:18:12Z

DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers may be able to access information about internal network resources.
Vulnerability: GHSA-3rhm-67j6-42jq
Summary: Moderate severity vulnerability that affects com.jason-goodwin:authentikat-jwt_2.12
Aliases: CVE-2017-18239
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-11-09T17:50:40Z

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
Vulnerability: GHSA-rh4p-g7x6-8pqg
Summary: Out-of-bounds write
Aliases: CVE-2019-1062
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:09Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1092, CVE-2019-1103, CVE-2019-1106, CVE-2019-1107.
Vulnerability: GHSA-4cj8-g9cp-v5wr
Summary: High severity vulnerability that affects blueimp-file-upload
Aliases: CVE-2018-9206
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2018-10-22T18:53:56Z

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
Vulnerability: GHSA-x3mh-jvjw-3xwx
Summary: Infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
Aliases: CVE-2022-0778
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2022-03-16T00:00:45Z

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).
Vulnerability: GHSA-wpfr-6297-9v57
Summary: User object created with invalid provider data in GoTrue
Severity: MODERATE
CVSS score: 0
Published: 2022-02-09T22:29:01Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Under certain circumstances a valid user object would have been created with invalid provider metadata.

This vulnerability affects everyone running an instance of GoTrue as a service. We advise you to update especially if you are using the provider metadata from the user object to secure other resources.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

A patch is available with the release of version [1.0.1 on Github](https://github.com/netlify/gotrue/releases/tag/v1.0.1).

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

If you don't rely on the provider metadata in the user object, you might not be affected. We still strongly recommend upgrading.

### References
_Are there any links users can visit to find out more?_

This problem was initially found and reported by the team at Supabase: https://github.com/supabase/gotrue/security/advisories/GHSA-5hvv-9cqv-894r. We want to thank them for the cooperation around this report.

In contrast to their advisory, we decided to set the severity to "Moderate" since the provider metadata is not an inherent security feature of this GoTrue codebase or the Netlify ecosystem.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@netlify.com](mailto:security@netlify.com)
Vulnerability: GHSA-656c-6cxf-hvcv
Summary: Deserialization of Untrusted Data in Flask-Caching
Aliases: CVE-2021-33026
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502, CWE-269
Published: 2021-06-18T18:33:40Z

Flask-Cache adds easy cache support to Flask. The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code.
Vulnerability: GHSA-3c33-3465-fhx2
Summary: Exposure of Resource to Wrong Sphere in LibreNMS
Aliases: CVE-2020-15877
Severity: HIGH
CVSS score: 8.8
CWE: CWE-668
Published: 2021-09-08T17:27:16Z

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
Vulnerability: GHSA-455w-gv5p-wgg3
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0260
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-26T22:10:48Z

pimcore is vulnerable to Stored XSS at Name field in the setting tab of the Global Targeting Rules.
Vulnerability: GHSA-m7xv-7p93-g6q8
Summary: Malicious Package in libubx
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T00:35:35Z

Version 1.0.3 of `libubx` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qj2g-642f-4jrv
Summary: Malicious Package in carloprojectlesang
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:17:30Z

All versions of `carloprojectlesang` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-m59c-jpc8-m2x4
Summary: In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder 
Aliases: CVE-2018-1336
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2018-10-17T16:32:18Z

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
Vulnerability: GHSA-4574-qv3w-fcmg
Summary:  Deserialization of Untrusted Data in codeception/codeception
Aliases: CVE-2021-23420
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-09-01T18:36:15Z

This affects the package codeception/codeception from 4.0.0 before 4.1.22 and before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.
Vulnerability: GHSA-hh7m-rx4f-4vpv
Summary: CSRF can expose users authentication token
Aliases: CVE-2021-21241
Severity: HIGH
CVSS score: 0
CWE: CWE-352
Published: 2021-01-11T20:38:28Z

### Issue
The  /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.

### Patches
Version 3.4.5 and soon to be released 4.0.0 are patched.

### Workarounds
If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.

### References
None
Vulnerability: GHSA-jcq3-cprp-m333
Summary: Privilege escalation in mysql-connector-jav
Aliases: CVE-2019-2692
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-843
Published: 2020-07-01T17:12:20Z

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
Vulnerability: GHSA-f68h-hfqp-8rmv
Summary: Path Traversal in Crafter CMS Crafter Studio
Aliases: CVE-2017-15684
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2022-02-09T23:08:03Z

Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
Vulnerability: GHSA-32rp-q37p-jg6w
Summary: Insecure plugin handling in Mattermost
Aliases: CVE-2022-1384
Severity: HIGH
CVSS score: 8.8
CWE: CWE-862
Published: 2022-04-20T00:00:30Z

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.
Vulnerability: GHSA-xmmp-hrmx-x5g7
Summary: Malicious Package in bowe
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:32:22Z

Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4gfq-6m28-m5mg
Summary: Improper neutralization of arguments in freediskspace
Aliases: CVE-2020-7775
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-04-13T15:16:11Z

This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js.
Vulnerability: GHSA-g9rq-x4fj-f5hx
Summary: Remote Code Execution Through Image Uploads in BookStack
Aliases: CVE-2020-5256
Severity: HIGH
CVSS score: 7.9
CWE: CWE-95
Published: 2020-03-13T20:21:27Z

### Impact

A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process.

This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. 

### Patches

The issue was addressed in a series of patches: v0.25.3, v0.25.4 and v0.25.5.
Users should upgrade to at least v0.25.5 to avoid this patch but ideally the latest BookStack version as previous versions are un-supported.

### Workarounds

Depending on BookStack version, you could use the [local_secure](https://www.bookstackapp.com/docs/admin/upload-config/#local-secure) image storage option, or use s3 or a similar compatible service.

Preventing direct execution of any `php` files, apart from the `public/index.php` file, though web-server configuration would also prevent this.

### References

[BookStack Beta v0.25.3](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3)
[BookStack Beta v0.25.4](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4)
[BookStack Beta v0.25.5](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the BookStack GitHub repository](BookStackApp/BookStack/issues).
* Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).
* Follow the [BookStack Security advise](https://github.com/BookStackApp/BookStack#-security) to contact someone privately.
Vulnerability: GHSA-v5jg-558j-q67c
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-2931
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.
Vulnerability: GHSA-3hrc-f439-727g
Summary: Moderate severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2015-0263
Severity: MODERATE
CVSS score: 0
CWE: CWE-611
Published: 2018-10-16T23:08:43Z

XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Vulnerability: GHSA-j6v9-xgvh-f796
Summary: Command Injection in wxchangba
Severity: MODERATE
CVSS score: 0
CWE: CWE-77
Published: 2020-09-11T21:11:34Z

All versions of `wxchangba` are vulnerable to Command Injection. The package does not validate user input on the `reqPostMaterial` function, passing contents of the `file` parameter to an exec call. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-jmgf-p46x-982h
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2008-5189
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2017-10-24T18:33:38Z

CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function.
Vulnerability: GHSA-r6h7-5pq2-j77h
Summary: Insufficiently random values in Ansible
Aliases: CVE-2020-10729
Severity: MODERATE
CVSS score: 5
CWE: CWE-330
Published: 2021-06-15T16:10:11Z

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.
Vulnerability: GHSA-jfx5-7mr2-g8hg
Summary: Malicious Package in alico
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:31:41Z

All versions of `alico` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-pxr8-w3jq-rcwj
Summary: Moderate severity vulnerability that affects rails_admin
Aliases: CVE-2017-12098
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-03-05T19:37:23Z

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.
Vulnerability: GHSA-9fh3-vh3h-q4g3
Summary: Moderate severity vulnerability that affects activesupport
Aliases: CVE-2011-2932
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."
Vulnerability: GHSA-27qf-jwm8-g7f3
Summary: FPE in LSH in TFLite
Aliases: CVE-2021-37691
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:39:17Z

### Impact
An attacker can craft a TFLite model that would trigger a division by zero error in LSH  [implementation](https://github.com/tensorflow/tensorflow/blob/149562d49faa709ea80df1d99fc41d005b81082a/tensorflow/lite/kernels/lsh_projection.cc#L118).

```cc
int RunningSignBit(const TfLiteTensor* input, const TfLiteTensor* weight,
                   float seed) {
  int input_item_bytes = input->bytes / SizeOfDimension(input, 0);
  // ...
}
```
          
There is no check that the first dimension of the input is non zero.
      
### Patches
We have patched the issue in GitHub commit [0575b640091680cfb70f4dd93e70658de43b94f9](https://github.com/tensorflow/tensorflow/commit/0575b640091680cfb70f4dd93e70658de43b94f9).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for  more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-2q4g-w47c-4674
Summary: Unpreventable top-level navigation
Aliases: CVE-2020-15174
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-693
Published: 2020-10-06T14:24:04Z

### Impact
The `will-navigate` event that apps use to prevent navigations to unexpected destinations [as per our security recommendations](https://www.electronjs.org/docs/tutorial/security) can be bypassed when a sub-frame performs a top-frame navigation across sites.

### Patches

* `11.0.0-beta.1`
* `10.0.1`
* `9.3.0`
* `8.5.1`

### Workarounds
Sandbox all your iframes using the [`sandbox` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox).  This will prevent them creating top-frame navigations and is good practice anyway.

### For more information
If you have any questions or comments about this advisory:

* Email us at security@electronjs.org
Vulnerability: GHSA-5hg3-6c2f-f3wr
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2018-14574
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2018-10-04T21:58:46Z

django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect.
Vulnerability: GHSA-wxc4-f4m6-wwqv
Summary: Excessive Platform Resource Consumption within a Loop in Kubernetes
Aliases: CVE-2019-11254
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1050
Published: 2021-12-20T16:55:06Z

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
Vulnerability: GHSA-jq42-hfch-42f3
Summary: Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-20
Published: 2021-06-01T21:20:53Z

# Impact
Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container.

Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint.

# Patches
All users should upgrade to Singularity 3.7.4 or later.

# Workarounds
Users who only interact with the default remote endpoint or do not use the library:// url are not affected.

Installations with an execution control list configured to restrict execution to containers signed with specific secure keys are not affected.

# Acknowledgements
This issue was found by Mike Frisch and brought to our attention by Sylabs.  Sylabs is making a [coordinated disclosure](https://github.com/sylabs/singularity/security/advisories/GHSA-5mv9-q7fq-9394).

# For more information
General questions about the impact of the advisory can be asked in the:

[Singularity Slack Channel](https://join.slack.com/t/hpcng/shared_invite/zt-qda4h1ls-OP0Uouq6sSmVE6i_0NrWdw)
[Singularity Mailing List](https://groups.google.com/a/lbl.gov/g/singularity)
Any sensitive security concerns should be directed to: [singularity-security@hpcng.org](mailto:singularity-security@hpcng.org)
Vulnerability: GHSA-gwg9-rgvj-4h5j
Summary: Code Injection in morgan
Aliases: CVE-2019-5413
Severity: MODERATE
CVSS score: 0
CWE: CWE-94
Published: 2019-03-25T18:03:23Z

Verisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack.


## Recommendation

Update to version 1.9.1 or later.
Vulnerability: GHSA-x7rp-74x2-mjf3
Summary: Segfault in Tensorflow
Aliases: CVE-2020-15200
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-20, CWE-787, CWE-122
Published: 2020-09-25T18:28:32Z

### Impact
The `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the `splits` tensor generate a valid partitioning of the `values` tensor. Thus, the [following code](https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L248-L265
) sets up conditions to cause a heap buffer overflow:
```cc
    auto per_batch_counts = BatchedMap<W>(num_batches);
    int batch_idx = 0;
    for (int idx = 0; idx < num_values; ++idx) {
      while (idx >= splits_values(batch_idx)) {
        batch_idx++;
      }
      const auto& value = values_values(idx);
      if (value >= 0 && (maxlength_ <= 0 || value < maxlength_)) {
        per_batch_counts[batch_idx - 1][value] = 1;
      }
    }
```

A `BatchedMap` is equivalent to a vector where each element is a hashmap. However, if the first element of `splits_values` is not 0, `batch_idx` will never be 1, hence there will be no hashmap at index 0 in `per_batch_counts`. Trying to access that in the user code results in a segmentation fault.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)
Vulnerability: GHSA-3cqr-58rm-57f8
Summary: Arbitrary Code Execution in Handlebars
Aliases: CVE-2019-20920
Severity: HIGH
CVSS score: 8.1
CWE: CWE-94
Published: 2022-02-10T20:38:19Z

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Vulnerability: GHSA-cg57-p69r-3m7p
Summary: Improper file handling in matrix-react-sdk
Aliases: CVE-2021-32622
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-434, CWE-74
Published: 2022-02-10T23:46:51Z

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
Vulnerability: GHSA-wq4r-8342-jmc9
Summary: SQL injection in vhs (aka VHS: Fluid ViewHelpers)
Aliases: CVE-2021-28381
Severity: CRITICAL
CVSS score: 5
CWE: CWE-89
Published: 2021-03-29T20:24:44Z

The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.
Vulnerability: GHSA-cv7x-6rc6-pq5v
Summary: Double free in containers
Aliases: CVE-2021-25907
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:53:05Z

An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::{mutate,mutate2} double drop can be performed.
Vulnerability: GHSA-9qw8-ccq9-ffj9
Summary: Out-of-bounds write
Aliases: CVE-2019-1139
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:53Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1140, CVE-2019-1141, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
Vulnerability: GHSA-hggx-3h72-49ww
Summary: Moderate severity vulnerability that affects Pillow
Aliases: CVE-2016-0740
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-119
Published: 2018-07-24T20:03:51Z

Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.
Vulnerability: GHSA-hx2x-85gr-wrpq
Summary: Out of bounds access in tensorflow-lite
Aliases: CVE-2020-15212
Severity: HIGH
CVSS score: 8.1
CWE: CWE-787
Published: 2020-09-25T18:29:00Z

### Impact
In TensorFlow Lite models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/reference_ops.h#L2625-L2631

Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `output_data` buffer.

This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits.

### Patches
We have patched the issue in 204945b and will release patch releases for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that the segment ids are all positive, although this only handles the case when the segment ids are stored statically in the model.

A similar validation could be done if the segment ids are generated at runtime between inference steps.

If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered from a variant analysis of [GHSA-p2cq-cprg-frvm](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p2cq-cprg-frvm).
Vulnerability: GHSA-xr2c-5w89-63pv
Summary: Untrusted Search Path in Poetry
Aliases: CVE-2022-26184
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-426
Published: 2022-03-23T00:00:24Z

Poetry prior to v1.1.9 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Vulnerability: GHSA-mp6f-p9gp-vpj9
Summary: Array size is not checked in sized-chunks
Aliases: CVE-2020-25792
Severity: HIGH
CVSS score: 0
CWE: CWE-129
Published: 2021-08-25T20:46:06Z

An issue was discovered in the sized-chunks crate through 0.6.2 for Rust. In the Chunk implementation, the array size is not checked when constructed with pair().
Vulnerability: GHSA-2xm2-xj2q-qgpj
Summary: receiving subscription objects with deleted session
Aliases: CVE-2020-15270
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-672
Published: 2020-10-27T19:15:19Z

Original Message:
Hi,

I create objects with one client with an ACL of all users with a specific column value. Thats working so far.

Then I deleted the session object from one user to look if he can receive subscription objects and he can receive them.
The client with the deleted session cant create new objects, which Parse restricts right.

The LiveQueryServer doesnt detect deleted sessions after the websocket connection was established.
There should be a mechanism that checks in an specific interval if the session exists.
I dont know if its true with expired sessions.

Any solutions?

Parse version: 4.3.0
Parse js SDK version: 2.17

Solution:
Hi guys.

I've found and fixed the problem. It happens because there are two caches in place for the session token:

- at Parse Server level, which, according with the docs, should be changed via cacheTTL option and defaults to 5 seconds;
- at Parse Live Query level, which, according with the docs, should be changed via liveQueryServerOptions.cacheTimeout and defaults to 30 days.

But there are three problems:

- cacheTTL has currently no effect over Live Query Server;
- cacheTimeout also has currently no effect over Live Query Server;
- cacheTimeout actually defaults to 1h.

So, currently, if you wait 1 hour after the session token was invalidated, the clients using the old session token are not able to receive the events.

What I did:

- Added a test case for the problem;
- Fixed cacheTTL for Live Query Server;
- Fixed cacheTimeout for Live Query Server;
- Changed the cacheTimeout to default 5s;
- Changed the docs to reflect the actual 5s default for cacheTimeout.
Vulnerability: GHSA-g99m-3m46-4gm9
Summary: Infinite Loop in Apache Sanselan
Aliases: CVE-2018-17202
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2019-05-14T04:00:47Z

Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Vulnerability: GHSA-3mgp-fx93-9xv5
Summary: XSS vulnerability that affects bootstrap
Aliases: CVE-2018-20676
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-17T13:57:34Z

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Vulnerability: GHSA-43fq-w8qq-v88h
Summary: Out-of-bounds read in Pillow
Aliases: CVE-2020-11538
Severity: HIGH
CVSS score: 8.1
CWE: CWE-125
Published: 2020-07-27T21:52:36Z

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Vulnerability: GHSA-77g4-36jp-5v3m
Summary: Remote Memory Disclosure in bittorrent-dht
Aliases: CVE-2016-10519
Severity: MODERATE
CVSS score: 0
CWE: CWE-201
Published: 2020-09-01T15:22:12Z

Versions of `bittorrent-dht` prior to 5.1.3 are affected by a remote memory disclosure vulnerability. This vulnerability allows an attacker to send a specific series of of messages to a listening peer and get it to reveal internal memory.


There are two mitigating factors here, that slightly reduce the impact of this vulnerability:

1. Any modern kernel will zero out new memory pages before handing them off to a process. This means that only memory previously used and deallocated by the node process can be leaked.
1. Node.js manages Buffers by creating a few large internal SlowBuffers, and slicing them up into smaller Buffers which are made accessible in JS. They are not stored on V8's heap, because garbage collection would interfere. The result is that only memory that has been previously allocated as a Buffer can be leaked.


## Recommendation

Update to version 5.1.3 or later.
Vulnerability: GHSA-mcgw-5fhw-3fq8
Summary: Incorrect Authorization in saleor
Aliases: CVE-2022-0932
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863
Published: 2022-03-12T00:00:34Z

Incorrect Authorization in saleor prior to 3.1.2.
Vulnerability: GHSA-3gx9-37ww-9qw6
Summary: Code injection in Spring Cloud Gateway
Aliases: CVE-2022-22947
Severity: CRITICAL
CVSS score: 10
CWE: CWE-94
Published: 2022-03-04T00:00:15Z

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
Vulnerability: GHSA-6jqp-j69q-pm62
Summary: AWS Lambda parser is vulnerable to Regular Expression Denial of Service
Aliases: CVE-2018-7560
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-03-05T19:16:56Z

index.js in the aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
Vulnerability: GHSA-7vm7-j8p7-h346
Summary: Code injection in blamer
Aliases: CVE-2020-8137
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94
Published: 2021-05-06T18:27:55Z

Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
Vulnerability: GHSA-x457-cw4h-hq5f
Summary: High severity vulnerability that affects json
Aliases: CVE-2013-0269
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Vulnerability: GHSA-5mf7-26mw-3rqr
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-1338
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-835
Published: 2018-10-17T15:50:45Z

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Vulnerability: GHSA-hj5v-574p-mj7c
Summary: Regular expression denial of service in py
Aliases: CVE-2020-29651
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-04-20T16:39:57Z

A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
Vulnerability: GHSA-r8fh-hq2p-7qhq
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2014-3483
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:36Z

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.