TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-82rr-mq4r-p4r3
Summary: SQL injection in francoisjacquet/rosariosis
Aliases: CVE-2021-44567
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-02-25T00:01:08Z

An SQL Injection vulnerability exits in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.
Vulnerability: GHSA-q948-x8rf-888m
Summary: os_str_bytes relies on undefined behavior of `char::from_u32_unchecked`
Aliases: CVE-2020-35865
Severity: HIGH
CVSS score: 7.5
CWE: CWE-704
Published: 2021-08-25T20:47:55Z

An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust. It has false expectations about char::from_u32_unchecked behavior.
Vulnerability: GHSA-8hj4-w233-g35q
Summary: Downloads Resources over HTTP in react-native-baidu-voice-synthesizer
Aliases: CVE-2016-10697
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-07-31T22:47:16Z

Affected versions of `react-native-baidu-voice-synthesizer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `react-native-baidu-voice-synthesizer`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-chqj-j4fh-rw7m
Summary: Cross-Site Scripting in dompurify
Aliases: CVE-2019-16728
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2020-08-28T21:25:11Z

Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of `<svg>`/`<math>` elements and `</p>`/`</br>`. An example payload is: `<svg></p><style><a id="</style><img src=1 onerror=alert(1)>">`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.0.3 or later. You may also disallow `<svg>` and `<math>` through `dompurify` configurations:
```DOMPurify.sanitize(input, {
     FORBID_TAGS: ['svg', 'math']
 });```
Vulnerability: GHSA-q77q-vx4q-xx6q
Summary: Cross-site Scripting in org.owasp.esapi:esapi
Aliases: CVE-2022-24891
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-04-27T21:09:46Z

### Impact
There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause URLs with the "javascript:" scheme to NOT be sanitized. See the reference below for full details.

### Patches
Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below.

### Workarounds
Manually edit your **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression as per remediation instructions in the reference below.

### References
[Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf)

### For more information
If you have any questions or comments about this advisory:
* Email one of the project co-leaders. See email addresses listed on  the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders".
* Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.
Vulnerability: GHSA-c3x7-gjmx-r2ff
Summary: Open Redirect in serve-static
Aliases: CVE-2015-1164
Severity: LOW
CVSS score: 3.1
CWE: CWE-601
Published: 2020-08-31T22:57:02Z

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.


## Proof of Concept

A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`

Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.


## Recommendation

Version 1.7.x: Update to version 1.7.2 or later.
Version 1.6.x: Update to version 1.6.5 or later.
Vulnerability: GHSA-r56q-vv3c-6g9c
Summary: Improper sanitization of delegated role names
Aliases: CVE-2021-41150
Severity: HIGH
CVSS score: 8.2
CWE: CWE-22
Published: 2021-10-19T20:16:26Z

### Impact
The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system.

AWS would like to thank https://github.com/jku for reporting this issue.

### Patches
A fix is available in version 0.12.0.

### Workarounds
No workarounds to this issue are known.

### References
https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr
Vulnerability: GHSA-g27j-74fp-xfpr
Summary: Insecure default value for CORS configuration
Aliases: CVE-2022-26969
Severity: HIGH
CVSS score: 8.3
Published: 2022-04-05T18:31:22Z

### Impact

The default value for the `CORS_ENABLED` and `CORS_ORIGIN` configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.

### Patches

The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0

### Workarounds

Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [directus/directus](https://github.com/directus/directus)
* Email us at [security@directus.io](mailto:security@directus.io)
Vulnerability: GHSA-f366-4rvv-95x2
Summary: Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration
Severity: LOW
CVSS score: 0
CWE: CWE-120
Published: 2020-10-02T16:33:19Z

### Impact
1) If an application is making use of the deprecated kit protocol HALs as the communication channel to the target device an attacker can masquerade as a device and return malformed packets of arbitrary length which the protocol stack will write to the stack. HALs intended for production use are unaffected (I2C, SWI, & SPI) as well as the hidapi HAL (hal_all_platforms_kit_hidapi.c).

2) The hidapi HAL can be made to overrun the application stack by attaching more than 10 (real or virtual) devices likely resulting in an application crash as this does not allow arbitrary data to be written to the stack.

### Patches
USB kit enumeration has been patched in v3.2.3 for the hidapi HAL (hal_all_platforms_kit_hidapi.c).

### Removal of deprecated HALs
Deprecated usb kit HALs have been removed in v3.2.3.

### Workarounds
This vulnerability is limited to users of the kit protocol which is used with Microchip kits and kit firmware to bridge communication from USB-HID to I2C or SWI. It is not expected that kits would be used in an production environment. This is an optional component for users as well so they can always compile the library without the usb support option.

### Special python packaging notes
The python package for cryptoauthlib uses date codes for identifying versions. The patched version for python packages is 20200912

### References
Please see [Microchip PSIRT](https://www.microchip.com/design-centers/embedded-security/how-to-report-potential-product-security-vulnerabilities) for Microchip's security policy and reporting procedures

### Credits
Special thanks to Ruben Santamarta of [IOActive](https://blogs.ioactive.com/) for reporting
Vulnerability: GHSA-ff2r-xpwq-6whj
Summary: Use of Uninitialized Resource in gfx-auxil
Aliases: CVE-2021-45689
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:12:14Z

An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
Vulnerability: GHSA-pfjj-m3jj-9jc9
Summary: Undefined behavior in `SparseTensorSliceDataset`
Aliases: CVE-2022-21736
Severity: HIGH
CVSS score: 7.6
CWE: CWE-476
Published: 2022-02-09T23:43:27Z

### Impact 
The [implementation of `SparseTensorSliceDataset`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/data/sparse_tensor_slice_dataset_op.cc#L227-L292) has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.SparseTensorSliceDataset(
  indices=[[]],
  values=[],
  dense_shape=[1,1])
```

The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.

### Patches
We have patched the issue in GitHub commit [965b97e4a9650495cda5a8c210ef6684b4b9eceb](https://github.com/tensorflow/tensorflow/commit/965b97e4a9650495cda5a8c210ef6684b4b9eceb).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Vulnerability: GHSA-c2m4-w5hm-vqjw
Summary: Hijacked Environment Variables in crossenv
Aliases: CVE-2017-16074
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-29T23:05:46Z

The `crossenv` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-7vph-p634-vrqf
Summary: Command Injection in RaspAP 2.6.6
Aliases: CVE-2021-38556
Severity: HIGH
CVSS score: 8.8
CWE: CWE-77
Published: 2021-09-02T17:11:00Z

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
Vulnerability: GHSA-c722-pv5w-cfg2
Summary: Malicious Package in github-jquery-widgets
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-11T21:20:14Z

Version 0.1.2 of `github-jquery-widgets` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-93p5-8fqw-wjx3
Summary: Authentication bypass by capture-replay in github.com/cosmos/ethermint
Aliases: CVE-2021-25834
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-294
Published: 2022-02-15T01:57:18Z

Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
Vulnerability: GHSA-ph3v-2hq5-5qfq
Summary: Code injection in RazorEngine
Aliases: CVE-2021-46703
Severity: MODERATE
CVSS score: 0
Published: 2022-03-07T00:00:41Z

In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability: GHSA-qhmp-h54x-38qr
Summary: CWE-730 Regex injection with IFTTT Plugin
Aliases: CVE-2021-39229
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-09-20T20:57:02Z

### Impact
Anyone _publicly_ hosting the Apprise library and granting them access to the IFTTT notification service.

### Patches
Update to Apprise v0.9.5.1
   ```bash
   # Install Apprise v0.9.5.1 from PyPI
   pip install apprise==0.9.5.1
   ```

The patch to the problem was performed [here](https://github.com/caronc/apprise/pull/436/files).

### Workarounds
Alternatively, if upgrading is not an option, you can safely remove the following file:
- `apprise/plugins/NotifyIFTTT.py` 

The above will eliminate the ability to use IFTTT, but everything else will work smoothly.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Apprise](https://github.com/caronc/apprise/issues)
* Email me at [lead2gold@gmail.com](mailto:lead2gold@gmail.com)

### Additional Credit
Github would not allow me to additionally credit **Rasmus Petersen**, but I would like to put that here at the very least - thank you for finding and reporting this issue along with those already credited

## Additional Notes:
- Github would not allow me to add/tag the 2 CWE's this issue is applicable to (only CWE-400).  The other is: CWE-730 (placed in the title)
Vulnerability: GHSA-cjg2-2fjg-fph4
Summary: Integer underflow in Frontier
Aliases: CVE-2022-21685
Severity: MODERATE
CVSS score: 0
CWE: CWE-191
Published: 2022-01-14T21:03:36Z

### Impact

A bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. It is recommended that you apply the patch as soon as possible.

If you do not use MODEXP precompile in your runtime, then you are not impacted.

### Patches

Patches are applied in PR #549.

### Workarounds

None.

### References

Patch PR: #549

### Credits

Thanks to SR-Labs for discovering the security vulnerability, and thanks to PureStake team for the patches.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)
Vulnerability: GHSA-qm28-7hqv-wg5j
Summary: OS Command Injection in ng-packagr
Aliases: CVE-2020-7735
Severity: MODERATE
CVSS score: 6.6
CWE: CWE-78
Published: 2021-05-07T16:47:32Z

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
Vulnerability: GHSA-352p-rhvq-7g78
Summary: Null pointer deference in av-data
Aliases: CVE-2021-25904
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2021-08-25T20:52:55Z

An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced, leading to a read of an arbitrary memory address, sometimes causing a segfault.
Vulnerability: GHSA-p5hj-xxfr-pwc3
Summary: Code Injection in microweber
Aliases: CVE-2022-0282
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94
Published: 2022-01-21T18:02:39Z

Code Injection in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-r496-7hgp-53wf
Summary: Vulnerability in dump function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36377
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2021-11-02T15:42:24Z

aaptjs is a node wraper for aapt. An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-2r4h-2ghh-5hpx
Summary: Directory Traversal in weather.swlyons
Aliases: CVE-2017-16110
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:18:33Z

Affected versions of `weather.swlyons` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-3qp6-m7hp-jrwf
Summary: Cross-site Scripting in Apache Pluto
Aliases: CVE-2021-36739
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-08T00:46:21Z

The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
Vulnerability: GHSA-jv64-2m3x-6v4q
Summary: Cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS
Aliases: CVE-2021-41948
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-04-30T00:00:36Z

A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".
Vulnerability: GHSA-vwjj-2852-3765
Summary: Cross-Site Scripting in forms
Aliases: CVE-2017-16015
Severity: MODERATE
CVSS score: 0
CWE: CWE-80
Published: 2018-11-09T17:46:27Z

Affected versions of `forms` do not properly escape HTML in generated forms, which may result in cross-site scripting.


## Recommendation

Update to version 1.3.0 or later.
Vulnerability: GHSA-7vwg-39h8-8qp8
Summary: /user/sessions endpoint allows detecting valid accounts
Severity: HIGH
CVSS score: 0
CWE: CWE-203
Published: 2021-03-11T17:42:01Z

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
Vulnerability: GHSA-v633-x5vv-hqwc
Summary: Cross-Site Scripting in serve-index
Aliases: CVE-2015-8856
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Versions 1.6.2 and earlier of `serve-index` are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.


## Recommendation

Update to version 1.6.3 or later.
Vulnerability: GHSA-53mj-mc38-q894
Summary: Remote Memory Exposure in openwhisk
Severity: MODERATE
CVSS score: 0
Published: 2020-09-01T19:40:41Z

Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure.

When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).

Proof of concept:

```js
var openwhisk = require('openwhisk');
var options = {
  apihost: '127.0.0.1:1433', 
  api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
```


## Recommendation

Update to version 3.3.1 or later.
Vulnerability: GHSA-g4rw-8m5q-6453
Summary: Out of bounds access in rgb
Aliases: CVE-2020-25016
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-119, CWE-843
Published: 2021-08-25T20:45:12Z

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations.
Vulnerability: GHSA-gpqq-952q-5327
Summary: XSS in the `of` option of the `.position()` util in jquery-ui
Aliases: CVE-2021-41184
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2021-10-26T14:55:12Z

### Impact
Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following code:
```js
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='window.globalOf=true' src='/404' />",
	collision: "none"
} );
```
will call the `doEvilThing()` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `of` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-ff6g-gm92-rf32
Summary: Malicious Package in coinstirng
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:42:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-w3j4-76qw-wwjm
Summary: Older releases of better_errors open to Cross-Site Request Forgery attack
Aliases: CVE-2021-39197
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-352
Published: 2021-09-07T23:08:24Z

### Impact
better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks.

_As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent)._

### Patches
Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3".

### Workarounds
There are no known workarounds to mitigate the risk of using older releases of better_errors.

### References
- Chris Moberly provided [an example attack that uses a now-patched vulnerability of webpack-dev-server in conjunction with Better Errors](https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/)

### For more information
If you have any questions or comments about this advisory, please
- Add to the [discussion in better_errors](https://github.com/BetterErrors/better_errors/discussions/507)
- Open an issue in [better_errors](https://github.com/BetterErrors/better_errors)
Vulnerability: GHSA-6jm6-cmcp-fqjq
Summary: Nomad Spread Job Stanza May Trigger Panic in Servers
Aliases: CVE-2022-24684
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-400
Published: 2022-02-16T00:01:42Z

Nomad and Nomad Enterprise allows operators with job-submit capabilities to use the spread stanza in a way such that it can cause panic in Nomad servers. This vulnerability, CVE-2022-24684, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6.
Vulnerability: GHSA-xq5j-gw7f-jgj8
Summary: CSRF Vulnerability in rails-ujs
Aliases: CVE-2020-8167
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-352
Published: 2020-07-07T16:34:10Z

There is an vulnerability in rails-ujs that allows attackers to send
CSRF tokens to wrong domains.

Versions Affected:  rails <= 6.0.3
Not affected:       Applications which don't use rails-ujs.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

This is a regression of CVE-2015-1840.

In the scenario where an attacker might be able to control the href attribute of an anchor tag or
the action attribute of a form tag that will trigger a POST action, the attacker can set the
href or action to a cross-origin URL, and the CSRF token will be sent.

Workarounds
-----------

To work around this problem, change code that allows users to control the href attribute of an anchor
tag or the action attribute of a form tag to filter the user parameters.

For example, code like this:

    link_to params

to code like this:

    link_to filtered_params

    def filtered_params
      # Filter just the parameters that you trust
    end
Vulnerability: GHSA-7ghq-fvr3-pj2x
Summary: Incomplete validation in `MaxPoolGrad`
Aliases: CVE-2021-37674
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2021-08-25T14:41:33Z

### Impact
An attacker can trigger a denial of service via a segmentation fault in `tf.raw_ops.MaxPoolGrad` caused by missing validation:

```python
import tensorflow as tf
  
tf.raw_ops.MaxPoolGrad(
  orig_input = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32),
  orig_output = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32),
  grad = tf.constant([], shape=[3, 0, 0, 2], dtype=tf.float32),
  ksize = [1, 16, 16, 1],
  strides = [1, 16, 18, 1],
  padding = "EXPLICIT",
  explicit_paddings = [0, 0, 14, 3, 15, 5, 0, 0])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/maxpooling_op.cc) misses some validation for the `orig_input` and `orig_output` tensors.

The fixes for [CVE-2021-29579](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-068.md) were incomplete.
                                                                                                                                                                                                                                                                                          
### Patches
We have patched the issue in GitHub commit [136b51f10903e044308cf77117c0ed9871350475](https://github.com/tensorflow/tensorflow/commit/136b51f10903e044308cf77117c0ed9871350475).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang of Baidu Security.
Vulnerability: GHSA-jwfh-j623-m97h
Summary: Use of Uninitialized Resource in messagepack-rs
Aliases: CVE-2021-45691
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:12:35Z

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
Vulnerability: GHSA-gfhx-jjwq-63gv
Summary: Cross-site Scripting in Apereo CAS
Aliases: CVE-2021-42567
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-12-10T20:24:11Z

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
Vulnerability: GHSA-xfxf-qw26-hr33
Summary: Arbitrary command execution in roar-pidusage
Aliases: CVE-2021-23380
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-77
Published: 2021-05-06T15:55:43Z

This affects all current versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-h3c2-x77c-7pvr
Summary: High severity vulnerability that affects git-dummy-commit
Aliases: CVE-2018-3785
Severity: HIGH
CVSS score: 0
CWE: CWE-78
Published: 2018-08-21T17:03:33Z

A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
Vulnerability: GHSA-79mg-4w23-4fqc
Summary: Unauthenticated SQL Injection in Cachet
Aliases: CVE-2021-39165
Severity: HIGH
CVSS score: 8.1
CWE: CWE-89, CWE-287
Published: 2021-08-30T16:12:58Z

### Impact
In Cachet versions through 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session.

### Patches

The original repository of [https://github.com/CachetHQ/Cachet](https://github.com/CachetHQ/Cachet) is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected. 

Update to version 2.5 or later in the [https://github.com/fiveai/Cachet fork](https://github.com/fiveai/Cachet) to fix this vulnerability.
Vulnerability: GHSA-6rrw-4fm9-rghv
Summary: Use of Hard-coded Cryptographic Key in Netmaker
Aliases: CVE-2022-0664
Severity: HIGH
CVSS score: 8.8
CWE: CWE-321
Published: 2022-02-19T00:01:36Z

Netmaker prior to versions 0.8.5, 0.9.4, 0.10.0, and 0.10.1 uses a hard-coded cryptographic key.
Vulnerability: GHSA-mm33-5vfq-3mm3
Summary: XSS Vulnerability in Action Pack
Aliases: CVE-2022-22577
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2022-04-27T22:28:59Z

There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.

Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

CSP headers were only sent along with responses that Rails considered as
"HTML" responses.  This left API requests without CSP headers, which could
possibly expose users to XSS attacks.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Set a CSP for your API responses manually.
Vulnerability: GHSA-9722-rr68-rfpg
Summary: Upload whitelisted files to any directory in OctoberCMS
Aliases: CVE-2020-5297
Severity: LOW
CVSS score: 3.4
CWE: CWE-73
Published: 2020-06-03T21:58:27Z

### Impact
An attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1241" alt="Screen Shot 2020-03-31 at 12 21 10 PM" src="https://user-images.githubusercontent.com/7253840/78061230-255f5400-734a-11ea-92b4-1120f6960505.png">
Vulnerability: GHSA-rrp4-2xx3-mv29
Summary: Command injection in gh-ost
Aliases: CVE-2022-21687
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-74, CWE-20
Published: 2022-02-01T00:47:33Z

Gh-ost version <= 1.1.2 allows users to inject DSN strings via the `-database` parameter.

This is a low severity vulnerability as the attacker must have access to the target host or trick an administrator into executing a malicious `gh-ost` command on a host running `gh-ost`, plus network access from host running `gh-ost` to the attack's malicious MySQL server.

### Impact
This issue may lead to arbitrary local file read.

### Patches
Fixed in 1.1.3+.

### Workarounds
None

### References
- https://advisory.dw1.io/51

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github/gh-ost](http://github.com/github/gh-ost)
Vulnerability: GHSA-qmm9-x5gr-4gfm
Summary: Open Redirect in hekto
Aliases: CVE-2018-3743
Severity: LOW
CVSS score: 0
CWE: CWE-601
Published: 2018-07-18T21:20:12Z

Versions of `hekto` before 0.2.4 are vulnerable to open redirect when a domain name is used as part of the `.html` filename.


## Recommendation

Update to version 0.2.4 or later.
Vulnerability: GHSA-5r76-cjf4-c9qx
Summary: Moderate severity vulnerability that affects mayan-edms
Aliases: CVE-2018-16406
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-06T03:24:57Z

An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.
Vulnerability: GHSA-2pqj-h3vj-pqgw
Summary: Cross-Site Scripting in jquery
Aliases: CVE-2012-6708
Severity: HIGH
CVSS score: 0
CWE: CWE-64, CWE-79
Published: 2020-09-01T16:41:46Z

Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution.

## Proof of Concept
```
$("#log").html(
    $("element[attribute='<img src=\"x\" onerror=\"alert(1)\" />']").html()
);
```




## Recommendation

Update to version 1.9.0 or later.
Vulnerability: GHSA-5wmg-j84w-4jj4
Summary: Arbitrary File Write via Archive Extraction in mholt/archiver
Aliases: CVE-2018-1002207
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-22
Published: 2022-02-15T01:57:18Z

mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Vulnerability: GHSA-r92x-f52r-x54g
Summary: regular expression denial of service (ReDoS)
Aliases: CVE-2020-26289
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-12-24T20:49:02Z

date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.
Vulnerability: GHSA-cggj-fvv3-cqwv
Summary: FasterXML jackson-databind allows unauthenticated remote code execution 
Aliases: CVE-2018-7489
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-184, CWE-502
Published: 2018-10-16T17:45:18Z

FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
Vulnerability: GHSA-jp9g-5x75-ccp8
Summary: Malicious Package in colro-name
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:34:30Z

Version 9.0.0 of `colro-name` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m2w9-rm58-mhm9
Summary: Downloads Resources over HTTP in node-thulac
Aliases: CVE-2016-10640
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:06Z

Affected versions of `node-thulac` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `node-thulac`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-vj62-g63v-f8mf
Summary: Validity check missing in Frontier
Aliases: CVE-2021-41138
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-10-13T18:53:38Z

### Impact

In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block.

The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors.

### Patches

The issue is patched in commit 146bb48849e5393004be5c88beefe76fdf009aba.

### References

Patch PR: https://github.com/paritytech/frontier/pull/495

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Frontier repo](https://github.com/paritytech/frontier/issues)

### Special thanks

Special thanks to @librelois, @nanocryk and the Moonbeam team for reporting and fixing this security vulnerability.
Vulnerability: GHSA-x3r5-q6mj-m485
Summary: Improper sanitization of target names
Aliases: CVE-2021-41149
Severity: HIGH
CVSS score: 8.2
CWE: CWE-22
Published: 2021-10-19T20:16:15Z

### Impact
The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system.

AWS would like to thank https://github.com/jku for reporting this issue.

### Patches
A fix is available in version 0.12.0.

### Workarounds
No workarounds to this issue are known.
Vulnerability: GHSA-j756-f273-xhp4
Summary: Import token permissions checking not enforced
Severity: CRITICAL
CVSS score: 7.5
CWE: CWE-863
Published: 2021-05-21T16:22:20Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2021-3127.txt>)

## Problem Description

The NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects.  Some Exports are public, such that anyone can import the
relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.

The JWT library's validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.

As a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the
importing account is not rejected, and use it to import *any* Subject from the Exporting account, not just the Subject referenced in the Import Token.

The NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.

The CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.


## Affected versions

#### JWT library

 * all versions prior to 2.0.1
 * fixed after nats-io/jwt#149 landed (2021-03-14)

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable
 * fixed with nats-io/nats-server@423b79440c (2021-03-14)


## Impact

In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.

Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.


## Workaround

Deny access to clients to update their account JWT in the account server.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).

Audit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at <https://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a>.
Vulnerability: GHSA-j68r-23hj-xf9c
Summary: Hijacked Environment Variables in node-openssl
Aliases: CVE-2017-16064
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-10-10T17:28:14Z

The `node-openssl` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-8xjq-8fcg-g5hw
Summary: Out-of-bounds Write in Pillow
Aliases: CVE-2021-25290
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T16:35:36Z

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
Vulnerability: GHSA-xgc3-m89p-vr3x
Summary: Heap buffer overflow in `Conv2DBackpropFilter`
Aliases: CVE-2021-29540
Severity: LOW
CVSS score: 2.5
CWE: CWE-787, CWE-120
Published: 2021-05-21T14:23:09Z

### Impact
An attacker can cause a heap buffer overflow to occur in `Conv2DBackpropFilter`:

```python
import tensorflow as tf

input_tensor = tf.constant([386.078431372549, 386.07843139643234],
                           shape=[1, 1, 1, 2], dtype=tf.float32)
filter_sizes = tf.constant([1, 1, 1, 1], shape=[4], dtype=tf.int32)
out_backprop = tf.constant([386.078431372549], shape=[1, 1, 1, 1],
                           dtype=tf.float32)
  
tf.raw_ops.Conv2DBackpropFilter(
  input=input_tensor,
  filter_sizes=filter_sizes,
  out_backprop=out_backprop,
  strides=[1, 66, 49, 1],
  use_cudnn_on_gpu=True,
  padding='VALID',
  explicit_paddings=[],
  data_format='NHWC',
  dilations=[1, 1, 1, 1]
)
```

Alternatively, passing empty tensors also results in similar behavior: 

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[0, 1, 1, 5], dtype=tf.float32)
filter_sizes = tf.constant([3, 8, 1, 1], shape=[4], dtype=tf.int32)
out_backprop = tf.constant([], shape=[0, 1, 1, 1], dtype=tf.float32)

tf.raw_ops.Conv2DBackpropFilter(
  input=input_tensor,
  filter_sizes=filter_sizes, 
  out_backprop=out_backprop,
  strides=[1, 66, 49, 1], 
  use_cudnn_on_gpu=True,
  padding='VALID',
  explicit_paddings=[],
  data_format='NHWC',
  dilations=[1, 1, 1, 1]
)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/1b0296c3b8dd9bd948f924aa8cd62f87dbb7c3da/tensorflow/core/kernels/conv_grad_filter_ops.cc#L495-L497) computes the size of the filter tensor but does not validate that it matches the number of elements in `filter_sizes`. Later, when reading/writing to this buffer, code uses the value computed here, instead of the number of elements in the tensor.

### Patches 
We have patched the issue in GitHub commit [c570e2ecfc822941335ad48f6e10df4e21f11c96](https://github.com/tensorflow/tensorflow/commit/c570e2ecfc822941335ad48f6e10df4e21f11c96).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-cj6j-32rg-45r2
Summary: Cross-site Scripting in JSPWiki
Aliases: CVE-2019-10077
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-06-06T15:29:25Z

A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Vulnerability: GHSA-3c45-wgjp-7v9r
Summary: A single version of twisted does not respect the trustedRoot setting
Aliases: CVE-2014-7143
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2019-12-17T22:52:34Z

Python Twisted 14.0 trustRoot is not respected in HTTP client
Vulnerability: GHSA-pq3x-96c3-xgjg
Summary: Moderate severity vulnerability that affects Products.PlonePAS
Aliases: CVE-2009-0662
Severity: MODERATE
CVSS score: 0
CWE: CWE-287
Published: 2018-07-23T19:50:29Z

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
Vulnerability: GHSA-22jr-vc7j-g762
Summary: Potential buffer overflow in psd-tools
Aliases: CVE-2020-10571
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-754
Published: 2020-03-16T22:46:19Z

### Impact
An issue was discovered in psd-tools before 1.9.4.
The Cython implementation of RLE decoding did not check for malformed PSD input data
during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.

### Patches
Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.

### Workarounds
Without Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.

### References
https://github.com/psd-tools/psd-tools/pull/198

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)