TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-qjmq-8hjr-qcv6
Summary: SQL Injection when creating an application with Reactive SQL backend 
Aliases: CVE-2022-24815
Severity: HIGH
CVSS score: 8.1
CWE: CWE-89
Published: 2022-04-07T15:18:05Z

### Impact
SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. 

If you have generated a microservice Gateway using the affected version, you might be impacted as Gateways are reactive by default.

Currently, SQL injection is possible in the `findAllBy(Pageable pageable, Criteria criteria)` method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria.

## Impacted applications
- Monolith and microservice applications with SQL database and reactive with Spring WebFlux combination (other combinations are not affected and the issue is only present when you generate entities)
- Gateway applications with SQL database (issue will appear only when generating entities)

### Patches
Patched in v7.8.1

The `findAllBy(Pageable pageable, Criteria criteria)` method has been removed from the entity repositories and `org.springframework.data.relational.core.query.Criteria` support in the underlying methods has been replaced with `org.springframework.data.relational.core.sql.Condition`. This means you won't be able to do custom filtering in the generated applications.

If you have existing reactive applications generated by the impacted version, we advise you to audit for use of `Criteria` and take appropriate actions.

### Workarounds

The problem lies in the `EntityManager.java` class when creating the where clause via `Conditions.just(criteria.toString())`.

`just` accepts the literal string provided. Criteria's `toString` method returns a plain string and this combination is vulnerable to sql injection as the string is not sanitized and will contain whatever used passed as input using any plain SQL

So be careful when combining criterias and conditions. As a workaround we have removed the possibility to pass any user-provided criteria to the `createSelect` method of `EntityManager`.

### Example 

```java
Criteria criteria = Criteria.where("name").is("foobar';DROP TABLE example;--"); // parameter is user provided input
criteria.toString(); // --> "'foobar';DROP TABLE example;--'"
```

### References
[More details in this Issue report](https://github.com/jhipster/generator-jhipster/issues/18269)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JHipster issue tracker](https://github.com/jhipster/generator-jhipster/issues)
Vulnerability: GHSA-7xwj-5r4v-429p
Summary: NPE in TFLite
Aliases: CVE-2021-37681
Severity: HIGH
CVSS score: 7.8
CWE: CWE-476
Published: 2021-08-25T14:40:35Z

### Impact
The implementation of SVDF in TFLite is [vulnerable to a null pointer error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/svdf.cc#L300-L313):

```cc
  TfLiteTensor* state = GetVariableInput(context, node, kStateTensor);
  // ...
  GetTensorData<float>(state)
```

The [`GetVariableInput` function](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/kernel_util.cc#L115-L119) can return a null pointer but `GetTensorData` assumes that the argument is always a valid tensor.

```cc
TfLiteTensor* GetVariableInput(TfLiteContext* context, const TfLiteNode* node,
                               int index) {
  TfLiteTensor* tensor = GetMutableInput(context, node, index);
  return tensor->is_variable ? tensor : nullptr;
}
```

Furthermore, because `GetVariableInput` calls [`GetMutableInput`](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/kernel_util.cc#L82-L90) which might return `nullptr`, the `tensor->is_variable` expression can also trigger a null pointer exception.

### Patches
We have patched the issue in GitHub commit [5b048e87e4e55990dae6b547add4dae59f4e1c76](https://github.com/tensorflow/tensorflow/commit/5b048e87e4e55990dae6b547add4dae59f4e1c76).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-xhfx-hgmf-v6vp
Summary: Potential Host Header Poisoning on misconfigured servers
Aliases: CVE-2021-21265
Severity: LOW
CVSS score: 0
CWE: CWE-644
Published: 2021-03-10T21:07:25Z

### Impact
When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning:
- https://portswigger.net/web-security/host-header
- https://dzone.com/articles/what-is-a-host-header-attack

### Patches

A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application.

### Workarounds

- Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation manually if unable to upgrade to v1.1.2.

- Check that the configuration setting `cms.linkPolicy` is set to `force`.

### Alternative Workaround

Check to make sure that your web server does not accept any hostname when serving your web application.

1. Add an entry called `testing.tld` to your computer's host file and direct it to your server's IP address
2. Open the address `testing.tld` in your web browser
3. Make sure an October CMS website is not available at this address

If an October CMS website is returned, configure your webserver to only allow known hostnames. If you require assistance with this, please contact your server administrator.

### References

Reported by [Abdullah Hussam](https://github.com/ahussam)

### For More Information

If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
<img width="1108" alt="Screen Shot 2021-01-15 at 4 12 57 PM" src="https://user-images.githubusercontent.com/7253840/104783859-92fb3600-574c-11eb-9e21-c0dc05d230a9.png">
Vulnerability: GHSA-8gwj-8hxc-285w
Summary: Prototype Pollution in json-ptr
Aliases: CVE-2021-23509
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:43:27Z

This affects the package `json-ptr` before `3.0.0`. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
Vulnerability: GHSA-g2q5-5433-rhrf
Summary: Embedded malware in rc
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2021-11-04T16:24:44Z

The npm package `rc` had versions published with malicious code. Users of affected versions (1.2.9, 1.3.9, and 2.3.9) should downgrade to 1.2.8 as soon as possible and check their systems for suspicious activity.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-58f5-hfqc-jgch
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose
Aliases: CVE-2021-29443
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-696, CWE-203
Published: 2021-04-19T14:57:22Z

jose is an npm library providing a number of cryptographic operations.
### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`.

Users should upgrade their v1.x dependency to [`^1.28.1`](https://github.com/panva/jose/releases/tag/v1.28.1), their v2.x dependency to [`^2.0.5`](https://github.com/panva/jose/releases/tag/v2.0.5), and their v3.x dependency to [`^3.11.4`](https://github.com/panva/jose/releases/tag/v3.11.4)

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-7f53-fmmv-mfjv
Summary: Regular expression denial of service in react-native
Aliases: CVE-2020-1920
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-07-20T17:33:28Z

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
Vulnerability: GHSA-2r2c-g63r-vccr
Summary: Improper Verification of Cryptographic Signature in `node-forge`
Aliases: CVE-2022-24773
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-347
Published: 2022-03-18T23:10:48Z

### Impact

RSA PKCS#1 v1.5 signature verification code is not properly checking `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
Vulnerability: GHSA-7534-mm45-c74v
Summary: Buffer Overflow in Pillow
Aliases: CVE-2021-34552
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-120
Published: 2021-10-05T20:24:41Z

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
Vulnerability: GHSA-f6hm-88x3-mfjv
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-21349
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-502, CWE-918
Published: 2021-03-22T23:29:19Z

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21349](https://x-stream.github.io/CVE-2021-21349.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-9chx-2vqw-8vq5
Summary: Path Traversal in the Logs plugin for Craft CMS
Aliases: CVE-2022-23409
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-22
Published: 2022-02-01T00:01:00Z

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php.
Vulnerability: GHSA-4446-656p-f54g
Summary: Deserialization of Untrusted Data in Bouncy castle
Aliases: CVE-2018-1000613
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-470, CWE-502
Published: 2018-10-17T16:23:12Z

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs version prior to version 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.
Vulnerability: GHSA-wg6g-ppvx-927h
Summary: Prototype Pollution in cached-path-relative
Aliases: CVE-2021-23518
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321
Published: 2022-01-27T14:27:53Z

The package cached-path-relative before 1.1.0 is vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
Vulnerability: GHSA-3gh2-xw74-jmcw
Summary: SQL injection in Django
Aliases: CVE-2020-9402
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2020-06-05T14:52:07Z

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
Vulnerability: GHSA-4gr7-qw2q-jxh6
Summary: Cross-site Scripting in Nacos
Aliases: CVE-2021-44667
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-12T00:00:27Z

A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
Vulnerability: GHSA-mpjf-8cmf-p789
Summary: Cross-Site Scripting in jingo
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T21:25:46Z

Versions of `jingo` prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as `<script>alert(1)</script>` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.


## Recommendation

Upgrade to version 1.9.2
Vulnerability: GHSA-wrp6-9w7f-3wxg
Summary: calibre-web is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4170
Severity: HIGH
CVSS score: 7.3
CWE: CWE-79
Published: 2022-01-21T23:55:34Z

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-j79j-cx3h-g27h
Summary: Out of bounds write in traitobject
Aliases: CVE-2020-35881
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2021-08-25T20:48:02Z

An issue was discovered in the traitobject crate through 2020-06-01 for Rust. It has false expectations about fat pointers, possibly causing memory corruption in, for example, Rust 2.x.
Vulnerability: GHSA-mcrf-7hf9-f6q5
Summary: Unchecked vector pre-allocation
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2021-08-25T21:00:09Z

Affected versions of this crate pre-allocate memory on deserializing raw
buffers without checking whether there is sufficient data available.

This allows an attacker to do denial-of-service attacks by sending small
msgpack messages that allocate gigabytes of memory.
Vulnerability: GHSA-cw7p-q79f-m2v7
Summary: incomplete JupyterHub logout with simultaneous JupyterLab sessions
Aliases: CVE-2021-41247
Severity: LOW
CVSS score: 3.5
CWE: CWE-613
Published: 2021-11-08T18:02:37Z

### Impact

Users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place.

### Patches

Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment.

### Workarounds

The only workaround is to make sure that only one JupyterLab tab is open when you log out.
Vulnerability: GHSA-h87q-g2wp-47pj
Summary: Signatures are mistakenly recognized to be valid in jsrsasign
Severity: MODERATE
CVSS score: 0
CWE: CWE-347
Published: 2022-02-09T22:41:19Z

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
Vulnerability: GHSA-77pw-c3j2-5fc8
Summary: Plaintext password leak in Apache Superset
Aliases: CVE-2020-13952
Severity: HIGH
CVSS score: 8.1
CWE: CWE-200
Published: 2021-04-30T17:34:03Z

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.
Vulnerability: GHSA-hvf8-h2qh-37m9
Summary: IPC messages delivered to the wrong frame in Electron
Aliases: CVE-2020-26272
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-668
Published: 2021-01-28T19:11:34Z

### Impact
IPC messages sent from the main process to a subframe in the renderer process, through `webContents.sendToFrame`, `event.reply` or when using the `remote` module, can in some cases be delivered to the wrong frame.

If your app does ANY of the following, then it is impacted by this issue:
- Uses `remote`
- Calls `webContents.sendToFrame`
- Calls `event.reply` in an IPC message handler

### Patches
This has been fixed in the following versions:

- 9.4.0
- 10.2.0
- 11.1.0
- 12.0.0-beta.9

### Workarounds
There are no workarounds for this issue.

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Vulnerability: GHSA-224h-p7p5-rh85
Summary: Directory Traversal in wenluhong1
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2020-09-01T17:32:26Z

Affected versions of `wenluhong1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-42fp-4hm3-j8r7
Summary: Moderate severity vulnerability that affects moin
Aliases: CVE-2017-5934
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-01-04T17:46:08Z

Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Vulnerability: GHSA-g556-x5vx-qh59
Summary: Moderate severity vulnerability that affects com.caverock:androidsvg
Aliases: CVE-2017-1000498
Severity: HIGH
CVSS score: 7.8
CWE: CWE-611
Published: 2018-10-19T16:50:33Z

AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution
Vulnerability: GHSA-fvfc-8pqr-wjpv
Summary: Missing Authorization in Jenkins S3 publisher Plugin
Aliases: CVE-2021-21650
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2021-06-16T17:29:08Z

Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.
Vulnerability: GHSA-x27v-x225-gq8g
Summary: Server-Side Request Forgery in Recurly
Aliases: CVE-2017-0905
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-918
Published: 2017-12-06T16:43:00Z

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.
Vulnerability: GHSA-rv95-4wxj-6fqq
Summary: Low severity vulnerability that affects colander
Aliases: CVE-2017-18361
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2019-02-07T18:18:22Z

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.
Vulnerability: GHSA-hh27-ffr2-f2jc
Summary: Open redirect in url-parse
Aliases: CVE-2021-3664
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2021-08-10T16:07:08Z

# Overview

Affected versions of npm `url-parse` are vulnerable to URL Redirection to Untrusted Site.

# Impact

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.
Vulnerability: GHSA-r28v-mw67-m5p9
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2018-7536
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-185
Published: 2019-01-04T17:50:07Z

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
Vulnerability: GHSA-7chv-rrw6-w6fc
Summary: XStream is vulnerable to a Remote Command Execution attack
Aliases: CVE-2021-29505
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94, CWE-74, CWE-502
Published: 2021-05-18T18:36:27Z

### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-29505](https://x-stream.github.io/CVE-2021-29505.html).

### Credits

V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Email us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-frxg-hf44-q765
Summary: Exposure of Sensitive Information to an Unauthorized Actor in DisCatSharp
Aliases: CVE-2022-24849
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2022-04-22T20:39:47Z

### Impact
Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of the two `RequireDisCatSharpDeveloperAttribute`s or the `BaseDiscordClient.LibraryDeveloperTeam` have potentially had their bot token sent to a web server not affiliated with Discord. This server is owned and operated by DisCatSharp's development team. The tokens were not logged, yet it is still advisable to reset the tokens of potentially affected bots.

### Patches
9.9.1 has been released to patch the issue for the current stable release and the current 10.0.0 prereleases are also no longer affected.

### Workarounds
Remove all uses of the two `RequireDisCatSharpDeveloperAttribute`s and all direct calls to `BaseDiscordClient.LibraryDeveloperTeam`.

### Details
The `HttpClient` responsible for sending requests to the Discord API was erroneously reused to send requests to our website when DisCatSharp's team members were to be fetched.

### For more information
If you have any questions or comments about this advisory:
* Join our [Discord server](https://discord.gg/GGYSywkxwN)
* Email us at [ottero@aitsys.dev](mailto:ottero@aitsys.dev)
Vulnerability: GHSA-mx7p-6679-8g3q
Summary: Polymorphic Typing in FasterXML jackson-databind
Aliases: CVE-2019-16942
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-10-28T20:51:15Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
Vulnerability: GHSA-6fjr-m7v6-fpg9
Summary: Exfiltrates data on installation in jquey
Aliases: CVE-2017-16204
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-06T21:41:38Z

The `jquey` package is malware that attempts to discover and exfiltrate sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

If you have found `jquey` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-r24h-634p-m72x
Summary: Validation Bypass in schema-inspector
Aliases: CVE-2019-10781
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-668
Published: 2020-06-10T20:02:47Z

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
Vulnerability: GHSA-gqcf-83rq-gpfr
Summary: Any storage file can be downloaded from p.sh if full server path is known
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2021-09-14T20:24:44Z

The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.
Vulnerability: GHSA-cmx4-p4v5-hmr5
Summary: Server-side request forgery (SSRF) in Apache Batik
Aliases: CVE-2019-17566
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-918
Published: 2022-02-09T00:46:46Z

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Vulnerability: GHSA-rj5f-7c8x-gjg4
Summary: Prototype Pollution in promisehelpers
Aliases: CVE-2020-7723
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:26:07Z

All versions of package promisehelpers up to and including version 0.0.5 are vulnerable to Prototype Pollution via the insert function.
Vulnerability: GHSA-p69g-f978-xxv9
Summary: Moderate severity vulnerability that affects luigi
Aliases: CVE-2018-1000843
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2018-12-20T22:01:39Z

Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Request Forgery (CSRF) vulnerability in API endpoint: /api/<method> that can result in Task metadata such as task name, id, parameter, etc. will be leaked to unauthorized users. This attack appear to be exploitable via The victim must visit a specially crafted webpage from the network where their Luigi server is accessible.. This vulnerability appears to have been fixed in 2.8.0 and later.
Vulnerability: GHSA-2wmv-37vq-52g5
Summary: FPE in `tf.raw_ops.UnravelIndex`
Aliases: CVE-2021-37668
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-08-25T14:42:06Z

### Impact
An attacker can cause denial of service in applications serving models using `tf.raw_ops.UnravelIndex` by triggering a division by 0:

```python
import tensorflow as tf

tf.raw_ops.UnravelIndex(indices=-1, dims=[1,0,2])
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/unravel_index_op.cc#L36) does not check that the tensor subsumed by `dims` is not empty. Hence, if one element of `dims` is 0, the implementation does a division by 0.

### Patches
We have patched the issue in GitHub commit [a776040a5e7ebf76eeb7eb923bf1ae417dd4d233](https://github.com/tensorflow/tensorflow/commit/a776040a5e7ebf76eeb7eb923bf1ae417dd4d233).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-8hfj-j24r-96c4
Summary: Path Traversal: 'dir/../../filename' in moment.locale
Aliases: CVE-2022-24785
Severity: HIGH
CVSS score: 7.5
CWE: CWE-27, CWE-22
Published: 2022-04-04T21:25:48Z

### Impact
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale.

### Patches
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).

### Workarounds
Sanitize user-provided locale name before passing it to moment.js.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [moment repo](https://github.com/moment/moment)
Vulnerability: GHSA-49pj-69vf-c689
Summary: Incorrect Default Permissions in netaddr
Aliases: CVE-2019-17383
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-276
Published: 2019-10-14T21:43:19Z

The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
Vulnerability: GHSA-4jhc-wjr3-pwh2
Summary: An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node.
Aliases: CVE-2020-35211
Severity: HIGH
CVSS score: 7.5
Published: 2021-12-17T20:40:38Z

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable terms in RaftContext.
Vulnerability: GHSA-rrvg-2c69-p9rf
Summary: Cross-Site Request Forgery in Jenkins Xray 
Aliases: CVE-2021-21652
Severity: HIGH
CVSS score: 7.1
CWE: CWE-352
Published: 2021-06-16T17:28:58Z

A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Vulnerability: GHSA-2jx8-v4hv-gx3h
Summary: XXE vulnerability in Launch import
Aliases: CVE-2020-12642
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2021-06-28T16:45:47Z

| Release Date | Affected Projects | Affected Versions | Access Vector| Security Risk |
|--------------|-------------------|-------------------|---------------|---------------|
| Monday, May 4, 2020| [service-api](https://github.com/reportportal/service-api) | Every version, starting from 3.1.0 | Remote | Medium |

### Impact
Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file that uses external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

Report Portal versions 4.3.12+ and 5.1.1+ disables external entity resolution for theirs XML parser.

We advise our users install the latest releases we built specifically to address this issue.

### Patches
Fixed with https://github.com/reportportal/service-api/pull/1201

### Binary Download
https://bintray.com/epam/reportportal/service-api/5.1.1
https://bintray.com/epam/reportportal/service-api/4.3.12

### Docker Container Download
* RP v4: `docker pull reportportal/service-api:4.3.12`
* RP v5: `docker pull reportportal/service-api:5.1.1`

### Acknowledgement
The issue was reported to Report Portal Team by an external security researcher.
Our Team thanks Julien M. for reporting the issue.

### For more information
If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)
Vulnerability: GHSA-gh4g-3gm9-5wrq
Summary: Cross-Site Scripting in shave
Aliases: CVE-2019-12313
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-05-29T18:38:08Z

Versions of `shave` prior to 2.5.3 are vulnerable to Cross-Site Scripting. The `shave` package overwrites HTML elements and in doing so fails to properly encode the output. If encoded HTML input is passed into `shave` the output will be decoded which may lead to Cross-Site Scripting.


## Recommendation

Upgrade to version 2.5.3 or later.
Vulnerability: GHSA-rr8m-29g8-8cgc
Summary: SQL Injection in Fork CMS
Aliases: CVE-2022-1064
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2022-03-26T00:00:32Z

Fork CMS is vulnerable to SQL injection through marking blog comments on bulk as spam in versions prior to 5.11.1.
Vulnerability: GHSA-38w8-h222-wrpp
Summary: Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Aliases: CVE-2022-25209
Severity: HIGH
CVSS score: 8.8
CWE: CWE-611
Published: 2022-02-16T00:01:14Z

Jenkins Chef Sinatra Plugin 1.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-f9cm-qmx5-m98h
Summary: Prototype Pollution in merge
Aliases: CVE-2018-16469
Severity: LOW
CVSS score: 0
CWE: CWE-400
Published: 2018-11-01T14:45:42Z

Versions of `merge` before 1.2.1 are vulnerable to prototype pollution. The `merge.recursive` function can be tricked into adding or modifying properties of the Object prototype.


## Recommendation

Update to version 1.2.1 or later.
Vulnerability: GHSA-jqj4-r483-4gvr
Summary: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-81
Published: 2021-04-19T14:48:51Z

Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

- https://vaadin.com/security/cve-2019-25027
Vulnerability: GHSA-2xhg-w2g5-w95x
Summary: CSV Injection in symfony/serializer
Aliases: CVE-2021-41270
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1236
Published: 2021-11-24T21:01:23Z

Description
-----------

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with `=` is interpreted by the software as a formula and could be abused by an attacker.

In Symfony 4.1, we've added the opt-in `csv_escape_formulas` option in `CsvEncoder`, to prefix all cells starting by  `=`, `+`, `-` or `@` by a tab `\t`. 

Since then, OWASP added 2 chars in that list: 
- Tab (0x09)
- Carriage return (0x0D)

This makes our previous prefix char (Tab `\t`) part of the vulnerable characters, and [OWASP suggests](https://owasp.org/www-community/attacks/CSV_Injection) using the single quote `'` for prefixing the value.

Resolution
----------

Symfony now follows the OWASP recommendations and use the single quote `'` to prefix formulas and adds the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8) for branch 4.4.

Credits
-------

We would like to thank Jake Barwell for reporting the issue and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-273r-rm8g-7f3x
Summary: Uncaught Exception in mercurius
Aliases: CVE-2021-43801
Severity: HIGH
CVSS score: 7.5
CWE: CWE-754
Published: 2021-12-13T21:33:04Z

### Impact

Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler.

### Patches

The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2.

### Workarounds

Use a custom error handler.

### References

See https://github.com/mercurius-js/mercurius/issues/677

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/mercurius-js/mercurius
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-x7g2-wrrp-r6h3
Summary: Use of a Broken or Risky Cryptographic Algorithm
Aliases: CVE-2021-27913
Severity: LOW
CVSS score: 3.5
CWE: CWE-327
Published: 2021-09-01T18:41:06Z

## ✍️ Description
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control

## 🕵️‍♂️ Proof of Concept
Numerous examples and attack implementations can be found in this paper . If you're looking for a practical tool that can crack your mt_rand implementation's seed value, see this project and run the following commands in a console with php5 and OpenWall's tool installed:

`root$ php -r 'mt_srand(13333337); echo mt_rand( ), "\n";'`
After that, copy the output (1863134308) and execute the following commands:

`root$ gcc php_mt_seed.c -o php_mt_seedroot$ ./php_mt_seed 1863134308`
After waiting ~1 minute you should have a few possible seeds corresponding to their PHP versions, next to your installed PHP version you should see something akin to:

seed = 0x00cb7359 = 13333337 (PHP 7.1.0+)
Hey, that's your seed!

## 💥 Impact
An attacker could takeover accounts at random by enumerating and using access tokens.

## 📝 References

- https://openwall.com/php_mt_seedhttps://crypto.di.uoa.gr/CRYPTO.SEC/Randomness_Attacks_files/paper.pdf
- https://github.com/mautic/mautic/blob/5213e320b4ef4d0c51bb84c1d46a1071e8e4f7fc/app/bundles/PointBundle/Controller/TriggerController.php#L187
- https://github.com/mautic/mautic/releases/tag/3.3.4
- https://github.com/mautic/mautic/releases/tag/4.0.0
Vulnerability: GHSA-rf3w-29h3-r636
Summary: Arbitrary Code Execution in feehi/cms
Aliases: CVE-2020-21322
Severity: HIGH
CVSS score: 0
CWE: CWE-434
Published: 2021-09-20T20:45:35Z

An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
Vulnerability: GHSA-vxr4-rxw7-g7v6
Summary: Prototype Pollution in comb.
Aliases: CVE-2021-23561
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-1321
Published: 2021-12-16T14:30:56Z

All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.
Vulnerability: GHSA-vf4q-8mr7-5c5c
Summary: Camel-castor component in Apache Camel is vulnerable to Java object de-serialisation
Aliases: CVE-2017-12634
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-16T23:05:58Z

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Vulnerability: GHSA-7j93-2h6r-hm49
Summary: Cross-Site Scripting in http-file-server
Aliases: CVE-2019-5458
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-07-31T04:22:36Z

All versions of `http-file-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-8v5f-hp78-jgxq
Summary: Signature Verification Bypass in jwt-simple
Severity: HIGH
CVSS score: 0
CWE: CWE-347
Published: 2019-06-06T15:30:33Z

Versions of `jwt-simple` prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the `decode()` function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).


## Recommendation

Upgrade to version 0.5.3 or later.
Vulnerability: GHSA-hhx9-p69v-cx2j
Summary: Authentication bypass in Apache Airflow
Aliases: CVE-2020-13927
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-04-30T17:34:13Z

"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default"
Vulnerability: GHSA-58v3-j75h-xr49
Summary: Improper Input Validation in libseccomp-golang
Aliases: CVE-2017-18367
Severity: HIGH
CVSS score: 4.8
CWE: CWE-284
Published: 2021-05-18T15:44:30Z

libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under a restrictive seccomp filter that specified multiple syscall arguments could bypass intended access restrictions by specifying a single matching argument.
Vulnerability: GHSA-6fmm-47qc-p4m4
Summary: Unauthorized File Access in harp
Aliases: CVE-2019-5438
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2019-06-13T16:12:26Z

All versions of `harp` are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-w6cx-qg2q-rvq8
Summary: Path Traversal in @finastra/ssr-pages
Aliases: CVE-2022-24718
Severity: HIGH
CVSS score: 7.6
CWE: CWE-22
Published: 2022-03-01T22:09:18Z

A path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function.

### References
- https://github.com/Finastra/ssr-pages/pull/1
- https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780
Vulnerability: GHSA-5r2v-6gm6-vpvh
Summary: Insecure Permissions in Gogs
Aliases: CVE-2019-14544
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-200
Published: 2021-05-18T17:33:58Z

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
Vulnerability: GHSA-9vrw-m88g-w75q
Summary: Denial of Service in @hapi/accept
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:45:53Z

Versions of `@hapi/accept` prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 3.2.4 or 5.0.1.
Vulnerability: GHSA-6gjf-7w99-j7x7
Summary: Deleted Admin Can Sign In to Admin Interface
Aliases: CVE-2021-41126
Severity: HIGH
CVSS score: 7.2
CWE: CWE-287
Published: 2021-10-06T17:46:40Z

### Impact
Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0.

### Patches
The issue has been patched in v2.1.12

### Workarounds

- Reset the password of the deleted accounts to prevent them from signing in.

- Please contact hello@octobercms.com for code change instructions if you are unable to upgrade.

### References

Credits to:
• Daniel Bidala

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-pphf-f93w-gc84
Summary: Data race in may_queue
Aliases: CVE-2020-36217
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-662, CWE-787
Published: 2021-08-25T20:51:47Z

An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corruption can occur.