TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-v82v-rq72-phq9
Summary: Server side request forgery in @isomorphic-git/cors-proxy
Aliases: CVE-2021-23664
Severity: HIGH
CVSS score: 8.6
CWE: CWE-918
Published: 2022-01-26T22:13:05Z

The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.
Vulnerability: GHSA-w36g-q975-37rg
Summary: Improper Input Validation (RCE)
Aliases: CVE-2021-26814
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2021-03-18T19:30:20Z

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service script.
Vulnerability: GHSA-48vq-8jqv-gm6f
Summary: Remote memory exhaustion in ckb
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2021-08-25T21:01:23Z

In the ckb sync protocol, SyncState maintains a HashMap called 'misbehavior' that keeps a score of a peer's violations of the protocol. This HashMap is keyed to PeerIndex (an alias for SessionId), and entries are never removed from it. SessionId is an integer that increases monotonically with every new connection.

A remote attacker can manipulate this HashMap to grow forever, resulting in degraded performance and ultimately a panic on allocation failure or being killed by the OS, depending on the platform.

This is a critical severity security bug. It could be exploited to create a targeted or network-wide denial of service, to reduce the hash power of the network as part of a 51% attack, and perhaps in other creative ways.

An attack is trivial:

1. connect to another node
2. send an invalid sync protocol request, such as `SendHeaders` for non-consecutive blocks
3. disconnect
4. repeat
Vulnerability: GHSA-g7h8-p22m-2rvx
Summary: Prototype Pollution in flat-wrap
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:08:46Z

All versions of `flat-wrap` are vulnerable to prototype pollution. The function `unflatten` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-mfcp-34xw-p57x
Summary: Authentication Bypass in saml2-js
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-287
Published: 2020-09-03T21:20:52Z

Versions of `saml2-js` prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely.


## Recommendation

Upgrade to version 2.0.5 or later.
Vulnerability: GHSA-995j-587r-259w
Summary: Moderate severity vulnerability that affects rack-mini-profiler
Severity: MODERATE
CVSS score: 0
Published: 2018-08-13T20:46:58Z

Withdrawn, accidental duplicate publish.

The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
Vulnerability: GHSA-w4f3-7f7c-x652
Summary: SQL Injection in tribalsystems/zenario 
Aliases: CVE-2021-26830
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-89
Published: 2022-03-18T17:49:01Z

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
Vulnerability: GHSA-qhrx-hcm6-pmrw
Summary: Unsafe deserialization in SmtpTransport in CakePHP
Aliases: CVE-2019-11458
Severity: HIGH
CVSS score: 7.5
CWE: CWE-502
Published: 2019-12-02T18:12:26Z

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
Vulnerability: GHSA-r7rh-g777-g5gx
Summary: SilverStripe GraphQL Server permission checker not inherited by query subclass.
Aliases: CVE-2021-28661
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-863
Published: 2021-10-12T18:49:23Z

Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
Vulnerability: GHSA-gmv4-vmx3-x9f3
Summary: Data races in lock_api
Aliases: CVE-2020-35914
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362
Published: 2021-08-25T20:49:37Z

An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
Vulnerability: GHSA-cgmg-2v6m-fjg7
Summary: Free of uninitialized memory in autorand
Aliases: CVE-2020-36210
Severity: HIGH
CVSS score: 7.8
CWE: CWE-908
Published: 2021-08-25T20:50:41Z

An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.
Vulnerability: GHSA-cpjc-p7fc-j9xh
Summary: Moderate severity vulnerability that affects mail
Aliases: CVE-2011-0739
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.
Vulnerability: GHSA-4964-cjrr-jg97
Summary: Malicious Package in jqeury
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:38:43Z

Version 3.3.1 of `jqeury` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-ch52-vgq2-943f
Summary: Regular Expression Denial of Service in marked
Severity: LOW
CVSS score: 0
Published: 2020-09-03T18:15:53Z

Affected versions of `marked` are vulnerable to Regular Expression Denial of Service (ReDoS). The `_label` subrule may significantly degrade parsing performance of malformed input.


## Recommendation

Upgrade to version 0.7.0 or later.
Vulnerability: GHSA-hhvc-g5hv-48c6
Summary: Write to immutable memory region in TensorFlow
Aliases: CVE-2020-26268
Severity: LOW
CVSS score: 4.4
CWE: CWE-471
Published: 2020-12-10T19:07:28Z

### Impact
The `tf.raw_ops.ImmutableConst` operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area:

```python
>>> import tensorflow as tf
>>> with open('/tmp/test.txt','w') as f: f.write('a'*128)
>>> tf.raw_ops.ImmutableConst(dtype=tf.string,shape=2,
                              memory_region_name='/tmp/test.txt')
```

If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault.

This is because the alocator used to return the buffer data is not marked as returning an opaque handle since the [needed virtual method](https://github.com/tensorflow/tensorflow/blob/c1e1fc899ad5f8c725dcbb6470069890b5060bc7/tensorflow/core/framework/typed_allocator.h#L78-L85) is [not overriden](https://github.com/tensorflow/tensorflow/blob/acdf3c04fcfa767ae8d109b9e1f727ef050dba4d/tensorflow/core/kernels/immutable_constant_op.cc).

### Patches
We have patched the issue in GitHub commit [c1e1fc899ad5f8c725dcbb6470069890b5060bc7](https://github.com/tensorflow/tensorflow/commit/c1e1fc899ad5f8c725dcbb6470069890b5060bc7) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-2hpj-g53m-9gj6
Summary: Downloads Resources over HTTP in closure-util
Aliases: CVE-2016-10583
Severity: HIGH
CVSS score: 8.1
Published: 2019-02-18T23:58:03Z

Affected versions of `closure-util` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closure-util`.


## Recommendation

To mitigate this issue:
1. Install the package using npm's `--ignore-scripts` flag.
2. Navigate to the package directory, and open `default-config.json` in a text editor
3. Change the download URLs in the `compiler_url` and `library_url` to `https` equivalents
4. run `npm i` in the package directory.
Vulnerability: GHSA-jrgf-vfw2-hj26
Summary: RCE via PHP Object injection via SOAP Requests
Aliases: CVE-2020-15244
Severity: HIGH
CVSS score: 8
CWE: CWE-74, CWE-502
Published: 2020-10-30T17:06:06Z

### Impact
This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

### Patches
The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved

### Credits
Credit to Luke Rodgers for reporting
Vulnerability: GHSA-2mj8-pj3j-h362
Summary: Symlink reference outside of node_modules in bin-links
Severity: LOW
CVSS score: 0
Published: 2020-09-04T17:17:39Z

Versions of `bin-links` prior to 1.1.5 are vulnerable to a Symlink reference outside of node_modules. It is possible to create symlinks to files outside of the`node_modules` folder through the `bin` field. This may allow attackers to access unauthorized files.


## Recommendation

Upgrade to version 1.1.5 or later.
Vulnerability: GHSA-q4j7-v27r-fgcx
Summary: Prototype Pollution in realms-shim
Aliases: CVE-2021-23543
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-01-13T15:00:36Z

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
Vulnerability: GHSA-8cc8-8vvx-fhgw
Summary: Downloads Resources over HTTP in jdf-sass
Aliases: CVE-2016-10595
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:34:11Z

Affected versions of `jdf-sass` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jdf-sass`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-wqgx-4q47-j2w5
Summary: Insecure Cryptography Algorithm in parsel
Severity: CRITICAL
CVSS score: 0
CWE: CWE-327
Published: 2020-09-04T17:36:04Z

All versions of `parsel` use an insecure cryptography algorithm. The package uses `aes-256-cbc` without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.
Vulnerability: GHSA-rx34-jff5-ph35
Summary: Out-of-bounds write
Aliases: CVE-2019-0917
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:06Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-fxwm-579q-49qq
Summary: Moderate severity vulnerability that affects Bootstrap.Less, bootstrap, and bootstrap.sass
Aliases: CVE-2019-8331
Severity: MODERATE
CVSS score: 0
Published: 2019-02-22T20:54:40Z

In Bootstrap 4 before 4.3.1 and Bootstrap 3 before 3.4.1, XSS is possible in the tooltip or popover data-template attribute. For more information, see: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
Vulnerability: GHSA-v7mf-qgxf-qmvf
Summary: Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies
Aliases: CVE-2016-8751
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2018-10-17T17:21:54Z

Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.
Vulnerability: GHSA-7pgq-hhq9-9r27
Summary: Directory Traversal in lab6drewfusbyu
Aliases: CVE-2017-16141
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:48:38Z

Affected versions of `lab6drewfusbyu` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6jp6-9rf9-gc66
Summary: Cross-site Scripting in Weblate
Aliases: CVE-2022-24710
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-25T22:18:50Z

### Impact
Due to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names.

### Patches

The issues were fixed in the 4.11 release. The following commits are addressing it:

* f6753a1a1c63fade6ad418fbda827c6750ab0bda
* 9e19a8414337692cc90da2a91c9af5420f2952f1
* 22d577b1f1e88665a88b4569380148030e0f8389

### Workarounds

You can look for crafted user and language names to see if you were affected.

### References
* https://hackerone.com/reports/1486674
* https://hackerone.com/reports/1486718
* https://hackerone.com/reports/1485226

### For more information
If you have any questions or comments about this advisory:
* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)
* Email us at [care@weblate.org](mailto:care@weblate.org)
Vulnerability: GHSA-pfxf-wh96-fvjc
Summary: Log Forging in generator-jhipster-kotlin
Aliases: CVE-2020-4072
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-117
Published: 2020-06-25T20:02:51Z

### Impact

We log the mail for invalid password reset attempts. 
As the email is provided by a user and the api is public this can be used by an attacker to forge log entries.
This is vulnerable to https://cwe.mitre.org/data/definitions/117.html

This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable.

### Patches

version 1.7.0.

### Workarounds

In `AccountResource.kt` you should change the line

```kotlin
 log.warn("Password reset requested for non existing mail '$mail'");
```

to 

```kotlin
 log.warn("Password reset requested for non existing mail");
```

### References

* https://cwe.mitre.org/data/definitions/117.html
* https://owasp.org/www-community/attacks/Log_Injection
* https://www.baeldung.com/jvm-log-forging

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jhipster kotlin](https://github.com/jhipster/jhipster-kotlin)
Vulnerability: GHSA-m79w-4mqv-r39f
Summary: Downloads Resources over HTTP in windows-seleniumjar
Aliases: CVE-2016-10691
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-07-31T22:06:33Z

Affected versions of `windows-seleniumjar` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-seleniumjar`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-54gp-qff8-946c
Summary: Insecure direct object reference of log files of the Import/Export feature
Aliases: CVE-2021-37709
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-639, CWE-532
Published: 2021-08-30T16:14:19Z

### Impact
Insecure direct object reference of log files of the Import/Export feature

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-mhpp-875w-9cpv
Summary: Denial of Service in jquery
Aliases: CVE-2016-10707
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-01-22T13:32:42Z

Affected versions of `jquery` use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, `jquery` enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.


## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-fq86-3f29-px2c
Summary: `CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow
Aliases: CVE-2022-23581
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-07T22:01:14Z

### Impact
The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that [`IsSimplifiableReshape`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/constant_folding.cc#L1687-L1742) would trigger `CHECK` failures.

### Patches
We have patched the issue in GitHub commits [ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1](https://github.com/tensorflow/tensorflow/commit/ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1), [1fb27733f943295d874417630edd3b38b34ce082](https://github.com/tensorflow/tensorflow/commit/1fb27733f943295d874417630edd3b38b34ce082), and [240655511cd3e701155f944a972db71b6c0b1bb6](https://github.com/tensorflow/tensorflow/commit/240655511cd3e701155f944a972db71b6c0b1bb6).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-m6h2-jx9v-58w6
Summary: Missing Authorization in Apache Airflow
Aliases: CVE-2021-35936
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-862
Published: 2021-08-30T16:25:57Z

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.
Vulnerability: GHSA-23fq-q7hc-993r
Summary: Improper Preservation of Permissions in HashiCorp Vault
Aliases: CVE-2021-38553
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-281
Published: 2021-08-30T17:22:53Z

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
Vulnerability: GHSA-m3j9-p4x2-97q6
Summary: Directory Traversal in liyujing
Aliases: CVE-2017-16120
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:22:49Z

Affected versions of `liyujing` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-m49f-hcxp-6hm6
Summary: CSRF allowing an external page to trigger a user logout event
Aliases: CVE-2021-41176
Severity: LOW
CVSS score: 0
CWE: CWE-352
Published: 2021-10-25T19:42:46Z

### Impact
A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.**

### Patches
None.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory please contact `Tactical Fish#8008` on Discord, or email `dane@pterodactyl.io`.
Vulnerability: GHSA-qp6m-jqfr-2f7v
Summary: Malicious Package in babel-laoder
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:27:11Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6m85-wvcr-pgw3
Summary: Prototype Pollution in safetydance
Aliases: CVE-2020-7737
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2022-02-10T20:33:49Z

All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-2pr6-76vf-7546
Summary: Denial of Service in js-yaml
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2019-06-05T14:35:29Z

Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.


## Recommendation

Upgrade to version 3.13.0.
Vulnerability: GHSA-mmq6-q8r3-48fm
Summary: Crash in `tf.strings.substr` due to `CHECK`-fail
Aliases: CVE-2021-29617
Severity: LOW
CVSS score: 2.5
CWE: CWE-755
Published: 2021-05-21T14:28:50Z

### Impact
An attacker can cause a denial of service via `CHECK`-fail in  `tf.strings.substr` with invalid arguments:

```python 
import tensorflow as tf
tf.strings.substr(input='abc', len=1, pos=[1,-1])
```

```python
import tensorflow as tf
tf.strings.substr(input='abc', len=1, pos=[1,2])
```

### Patches
We have received a patch for the issue in GitHub commit [890f7164b70354c57d40eda52dcdd7658677c09f](https://github.com/tensorflow/tensorflow/commit/890f7164b70354c57d40eda52dcdd7658677c09f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in [#46900](https://github.com/tensorflow/issues/46900) and fixed in [#46974](https://github.com/tensorflow/issues/46974).
Vulnerability: GHSA-vj42-xq3r-hr3r
Summary: Out-of-bounds reads in Pillow
Aliases: CVE-2020-10994
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-125
Published: 2020-07-27T21:52:39Z

In libImaging/Jpeg2KDecode.c in Pillow before 7.0.0, there are multiple out-of-bounds reads via a crafted JP2 file.
Vulnerability: GHSA-3jqw-vv45-mjhh
Summary: XSS/Script injection vulnerability in matestack
Aliases: CVE-2020-5241
Severity: HIGH
CVSS score: 7.7
CWE: CWE-80
Published: 2020-02-12T23:37:46Z

matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection.

This vulnerability is patched in version 0.7.4.
Vulnerability: GHSA-74qp-233x-p5j8
Summary: Cross-site scripting (XSS) in Apache Livy
Aliases: CVE-2021-26544
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-05-13T22:30:41Z

Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Vulnerability: GHSA-rrx2-r989-2c43
Summary: Integer overflows in Tensorflow
Aliases: CVE-2022-23567
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-190
Published: 2022-02-09T23:39:33Z

### Impact 
The [implementations of `Sparse*Cwise*` ops](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc) are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so, assert failures based denial of service):

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.SparseDenseCwiseDiv(
    sp_indices=np.array([[9]]),
    sp_values=np.array([5]),
    sp_shape=np.array([92233720368., 92233720368]),
    dense=np.array([4]))
```

We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The latter is an instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197) and is easily fixed by replacing a call to `TensorShape` constructor with a call to `BuildTensorShape` static helper factory.

### Patches
We have patched the issue in GitHub commits [1b54cadd19391b60b6fcccd8d076426f7221d5e8](https://github.com/tensorflow/tensorflow/commit/1b54cadd19391b60b6fcccd8d076426f7221d5e8) and [e952a89b7026b98fe8cbe626514a93ed68b7c510](https://github.com/tensorflow/tensorflow/commit/e952a89b7026b98fe8cbe626514a93ed68b7c510).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-x3g3-334f-q6h4
Summary: Moderate severity vulnerability that affects editor.md
Aliases: CVE-2018-19056
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-09T17:41:15Z

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.
Vulnerability: GHSA-mrmf-qwxg-7c3h
Summary: XSS in Data URI in remarkable
Aliases: CVE-2017-16006
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2018-11-09T17:48:20Z

Affected versions of `remarkable` are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of `data:` URIs in links, and can therefore execute javascript. 


## Proof of Concept

```
[link](data:text/html,<script>alert('0')</script>)
```


## Recommendation

Update to v1.7.0 or later
Vulnerability: GHSA-6394-6h9h-cfjg
Summary: Regular Expression Denial of Service
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2019-06-07T21:12:35Z

A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the "\s*" pattern.
Vulnerability: GHSA-vpfp-5gwq-g533
Summary: Improper Authentication in Apache ShenYu Admin
Aliases: CVE-2021-37580
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-11-17T23:15:30Z

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0
Vulnerability: GHSA-8vcr-vxm8-293m
Summary: Denial of Service in SheetsJS Pro
Aliases: CVE-2021-32013
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400
Published: 2021-07-22T19:48:13Z

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
Vulnerability: GHSA-hqxw-mm44-gc4r
Summary: Fragments in Path May Lead to Authorization Policy Bypass
Aliases: CVE-2021-39156
Severity: HIGH
CVSS score: 8.1
CWE: CWE-863
Published: 2021-08-30T16:16:14Z

### Impact
Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. 

### Patches
* Istio 1.11.1 and above
* Istio 1.10.4 and above
* Istio 1.9.8 and above

### Workarounds
A Lua filter may be written to normalize the path.  This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2021-008)

### For more information
If you have any questions or comments about this advisory, please email us at istio-security-vulnerability-reports@googlegroups.com
Vulnerability: GHSA-9jxw-cfrh-jxq6
Summary: New line injection during configuration edition
Aliases: CVE-2021-39172
Severity: HIGH
CVSS score: 8.8
CWE: CWE-93
Published: 2021-08-30T16:11:24Z

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server.

### Patches

This issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values.

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-v6gp-9mmm-c6p5
Summary: Out-of-bounds Write in zlib affects Nokogiri
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2022-04-11T21:21:28Z

## Summary

Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032). That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby) for a complete description of which platform gems vendor `zlib`. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `zlib` release announcements. 

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) in zlib

- **Severity**: High
- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html) Out of bounds write
- **Description**: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
Vulnerability: GHSA-589w-hccm-265x
Summary: Inline attribute values were not processed.
Aliases: CVE-2020-15263
Severity: HIGH
CVSS score: 8
CWE: CWE-79
Published: 2020-10-19T20:17:47Z

### Impact
Inline attributes have not been processed escape.
If the data that came from users was not processed, then an XSS vulnerability is possible

### Patches
Fixed in 9.4.4
Vulnerability: GHSA-vv4c-g6q7-p3q7
Summary: Moderate severity vulnerability that affects doorkeeper-openid_connect
Aliases: CVE-2019-9837
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2019-03-25T16:15:54Z

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
Vulnerability: GHSA-573x-jhqh-jg36
Summary: Moderate severity vulnerability that affects chloride
Aliases: CVE-2018-6517
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2019-03-25T16:16:27Z

Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
Vulnerability: GHSA-cr4x-w2v7-4mmf
Summary: Malicious Package in bufver-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:26:13Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-229r-pqp6-8w6g
Summary: High severity vulnerability that affects sprout
Aliases: CVE-2013-6421
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
Vulnerability: GHSA-hrqr-hxpp-chr3
Summary: Possible Information Leak / Session Hijack Vulnerability in Rack
Aliases: CVE-2019-16782
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-208, CWE-203
Published: 2019-12-18T19:01:31Z

There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.

The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.

### Impact

The session id stored in a cookie is the same id that is used when querying the backing session storage engine.  Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id.  By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.

## Releases

The 1.6.12 and 2.0.8 releases are available at the normal locations.

### Workarounds

There are no known workarounds.

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* 1-6-session-timing-attack.patch - Patch for 1.6 series
* 2-0-session-timing-attack.patch - Patch for 2.6 series

### Credits

Thanks Will Leinweber for reporting this!
Vulnerability: GHSA-772j-h9xw-ffp5
Summary: CHECK-fail in SparseCross due to type confusion
Aliases: CVE-2021-29519
Severity: LOW
CVSS score: 2.5
CWE: CWE-843
Published: 2021-05-21T14:21:08Z

### Impact
The API of `tf.raw_ops.SparseCross` allows combinations which would result in a `CHECK`-failure and denial of service:

```python
import tensorflow as tf

hashed_output = False
num_buckets = 1949315406
hash_key = 1869835877
out_type = tf.string 
internal_type = tf.string

indices_1 = tf.constant([0, 6], shape=[1, 2], dtype=tf.int64)
indices_2 = tf.constant([0, 0], shape=[1, 2], dtype=tf.int64)
indices = [indices_1, indices_2]

values_1 = tf.constant([0], dtype=tf.int64)
values_2 = tf.constant([72], dtype=tf.int64)
values = [values_1, values_2]

batch_size = 4
shape_1 = tf.constant([4, 122], dtype=tf.int64)
shape_2 = tf.constant([4, 188], dtype=tf.int64)
shapes = [shape_1, shape_2]

dense_1 = tf.constant([188, 127, 336, 0], shape=[4, 1], dtype=tf.int64)
dense_2 = tf.constant([341, 470, 470, 470], shape=[4, 1], dtype=tf.int64)
dense_3 = tf.constant([188, 188, 341, 922], shape=[4, 1], dtype=tf.int64)
denses = [dense_1, dense_2, dense_3]

tf.raw_ops.SparseCross(indices=indices, values=values, shapes=shapes, dense_inputs=denses, hashed_output=hashed_output,
                       num_buckets=num_buckets, hash_key=hash_key, out_type=out_type, internal_type=internal_type)
```

The above code will result in a `CHECK` fail in [`tensor.cc`](https://github.com/tensorflow/tensorflow/blob/3d782b7d47b1bf2ed32bd4a246d6d6cadc4c903d/tensorflow/core/framework/tensor.cc#L670-L675):

```cc
void Tensor::CheckTypeAndIsAligned(DataType expected_dtype) const {
  CHECK_EQ(dtype(), expected_dtype)
      << " " << DataTypeString(expected_dtype) << " expected, got "
      << DataTypeString(dtype());
  ...
}
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/3d782b7d47b1bf2ed32bd4a246d6d6cadc4c903d/tensorflow/core/kernels/sparse_cross_op.cc#L114-L116) is tricked to consider a tensor of type `tstring` which in fact contains integral elements:

```cc
  if (DT_STRING == values_.dtype())
      return Fingerprint64(values_.vec<tstring>().data()[start + n]);
  return values_.vec<int64>().data()[start + n];
```

Fixing the type confusion by preventing mixing `DT_STRING` and `DT_INT64` types solves this issue.

### Patches
We have patched the issue in GitHub commit [b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025](https://github.com/tensorflow/tensorflow/commit/b1cc5e5a50e7cee09f2c6eb48eb40ee9c4125025).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-2j5x-56p6-hj6x
Summary: Path Traversal in statichttpserver
Aliases: CVE-2019-5480
Severity: CRITICAL
CVSS score: 0
CWE: CWE-22
Published: 2019-09-04T10:02:14Z

All versions of `statichttpserver` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7f5c-rpf4-86p8
Summary: Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs
Aliases: CVE-2021-32822
Severity: MODERATE
CVSS score: 4
CWE: CWE-200, CWE-538
Published: 2021-09-02T17:16:46Z

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
Vulnerability: GHSA-jq4v-f5q6-mjqq
Summary: Cross-Site Scripting in lxml
Aliases: CVE-2021-28957
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-03-22T16:53:53Z

An XSS vulnerability was discovered in the python `lxml` clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in `lxml` 4.6.3.
Vulnerability: GHSA-2x4q-6jfv-8h9h
Summary: Path Traversal in glance
Aliases: CVE-2018-3715
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-26T14:53:14Z

Versions of `glance` before 3.0.4 are vulnerable to path traversal allowing a remote attacker to read arbitrary files from the server using `glance`.


## Recommendation

Update to version 3.0.4 or later.
Vulnerability: GHSA-4f5x-q4jc-xfcf
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0262
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-79
Published: 2022-01-21T23:31:35Z

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore.
Vulnerability: GHSA-5m6c-jp6f-2vcv
Summary: Open Redirect in OAuth2 Proxy
Aliases: CVE-2020-4037
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-601
Published: 2021-12-20T17:58:59Z

### Impact
As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access.
This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites.
Vulnerability: GHSA-ppc3-fpvh-7396
Summary: Improper synchronization in Apache Netbeans HTML/Java API
Aliases: CVE-2020-17534
Severity: HIGH
CVSS score: 7
CWE: CWE-362
Published: 2022-02-09T22:25:18Z

There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file.
Vulnerability: GHSA-fv82-r8qv-ch4v
Summary: pomerium_signature is not verified in middleware in github.com/pomerium/pomerium
Aliases: CVE-2021-29652
Severity: HIGH
CVSS score: 5.4
CWE: CWE-601
Published: 2021-05-21T16:24:22Z

### Impact
Some API endpoints under /.pomerium/ do not verify parameters with pomerium_signature. This could allow modifying parameters intended to be trusted to Pomerium. 

The issue mainly affects routes responsible for sign in/out, but does not introduce an authentication bypass.

### Patches
Patched in v0.13.4

### For more information
If you have any questions or comments about this advisory
* Open an issue in [pomerium](http://github.com/pomerium/pomerium)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Vulnerability: GHSA-63q7-h895-m982
Summary: Cross-site Scripting in dompurify
Aliases: CVE-2020-26870
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-12-18T22:51:40Z

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
Vulnerability: GHSA-8fw4-xh83-3j6q
Summary: Cross-Site Scripting in diagram-js
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:18:05Z

Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.


## Recommendation

If you are using diagram-js 3.x, upgrade to version 3.3.1.
If you are using diagram-js 2.x, upgrade to version 2.6.2.
Vulnerability: GHSA-4qr3-m7ww-hh9g
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45717
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:01:40Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.
Vulnerability: GHSA-f698-m2v9-5fh3
Summary: Command Injection in opencv
Severity: LOW
CVSS score: 0
CWE: CWE-77
Published: 2019-06-04T20:11:44Z

Versions of `opencv`prior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands.


## Recommendation

Upgrade to version 6.1.0.
Vulnerability: GHSA-m46p-ggm5-5j83
Summary: Moderate severity vulnerability that affects rails
Aliases: CVE-2014-0081
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.