TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-x2xg-6wcj-6xf9
Summary: SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
Aliases: CVE-2020-36474
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-08-25T14:49:48Z

SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
Vulnerability: GHSA-4ccc-jm2p-vg3p
Summary: Downloads Resources over HTTP in windows-latestchromedriver
Aliases: CVE-2016-10696
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2020-09-01T16:14:22Z

Affected versions of `windows-latestchromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-latestchromedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-x8m7-cv39-xmg9
Summary: Malicious Package in jq-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:56:10Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-w4pj-7p68-3vgv
Summary: Stored XSS in October
Aliases: CVE-2020-11083
Severity: LOW
CVSS score: 3.5
CWE: CWE-79
Published: 2020-08-05T14:52:44Z

### Impact
A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field.

### Patches
Issue has been patched in Build 466 (v1.0.466) & RainLab.Blog v1.4.1 by restricting the ability to store JS in markdown to only users that have been explicitly granted the `backend.allow_unsafe_markdown` permission.

### Workarounds
Apply https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746 & https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 to your installation manually if unable to upgrade to Build 466 or v1.4.1 of RainLab.Blog (if using that plugin).

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png">
Vulnerability: GHSA-gc37-9g7f-96fx
Summary: Exposure of sensitive information in Apache Ozone
Aliases: CVE-2021-41532
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-668
Published: 2021-11-23T18:17:50Z

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
Vulnerability: GHSA-fqfh-778m-2v32
Summary: GitHub CLI can execute a git binary from the current directory
Severity: MODERATE
CVSS score: 0
Published: 2022-02-11T23:41:11Z

### Impact
GitHub CLI depends on a `git.exe` executable being found in system `%PATH%` on Windows. However, if a malicious `.\git.exe` or `.\git.bat` is found in the current working directory at the time of running `gh`, the malicious command will be invoked instead of the system one.

Windows users who run `gh` inside untrusted directories are affected.

### Patches
Users should upgrade to GitHub CLI v1.2.1.

### Workarounds
Other than avoiding untrusted repositories, there is no workaround.

### References
https://github.com/golang/go/issues/38736
Vulnerability: GHSA-8grg-q944-cch5
Summary: SQL Injection in Hibernate ORM
Aliases: CVE-2019-14900
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-89
Published: 2022-02-10T23:05:04Z

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Vulnerability: GHSA-7vmw-7x57-q6jw
Summary: Cross-site scripting
Aliases: CVE-2021-32713
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-09-08T18:00:00Z

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
Vulnerability: GHSA-6hpv-v2rx-c5g6
Summary: FPE in convolutions with zero size filters
Aliases: CVE-2021-41209
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-369
Published: 2021-11-10T19:02:17Z

### Impact
The [implementations for convolution operators](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/conv_ops.cc) trigger a division by 0 if passed empty filter tensor arguments.

### Patches
We have patched the issue in GitHub commit [f2c3931113eaafe9ef558faaddd48e00a6606235](https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235).
  
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-whgm-jr23-g3j9
Summary: Uncontrolled Resource Consumption in ansi-html
Aliases: CVE-2021-23424
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-09-02T17:15:24Z

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Vulnerability: GHSA-8m9g-647g-5pxw
Summary: Infinite loop in Yubico yubihsm-connector
Aliases: CVE-2021-28484
Severity: HIGH
CVSS score: 5.4
CWE: CWE-835
Published: 2022-02-15T01:57:18Z

An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK before 2021.04). The handler did not validate the length of the request, which can lead to a state where yubihsm-connector becomes stuck in a loop waiting for the YubiHSM to send it data, preventing any further operations until the yubihsm-connector is restarted. An attacker can send 0, 1, or 2 bytes to trigger this.
Vulnerability: GHSA-j7rm-8ww4-xx2g
Summary: Division by zero in TFLite's implementation of `SpaceToDepth`
Aliases: CVE-2021-29587
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:26:45Z

### Impact
The `Prepare` step of the `SpaceToDepth` TFLite operator [does not check for 0 before division](https://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/space_to_depth.cc#L63-L67).

```cc 
const int block_size = params->block_size;
const int input_height = input->dims->data[1];
const int input_width = input->dims->data[2];
int output_height = input_height / block_size;
int output_width = input_width / block_size;
```   

An attacker can craft a model such that `params->block_size` would be zero.

### Patches
We have patched the issue in GitHub commit [0d45ea1ca641b21b73bcf9c00e0179cda284e7e7](https://github.com/tensorflow/tensorflow/commit/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-7qcx-jmrc-h2rr
Summary: Cross-Site Scripting in keystone
Aliases: CVE-2017-15878
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2017-11-15T19:44:16Z

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize user input on the `Contact Us` page,  allowing attackers to submit contact forms with malicious JavaScript in the message field. The output is not properly encoded leading an admin that opens new inquiry to execute the arbitrary JavaScript supplied in their browser.


## Recommendation

Update to version 4.0.0 or later.
Vulnerability: GHSA-2q8x-2p7f-574v
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39153
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502
Published: 2021-08-25T14:46:49Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39153](https://x-stream.github.io/CVE-2021-39153.html).

### Credits
Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-m553-9wmx-533h
Summary: Cross-site scripting in Dolibarr
Aliases: CVE-2019-16197
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-08T20:05:31Z

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
Vulnerability: GHSA-2v2v-fx7r-f2fh
Summary: pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4082
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-12-16T14:28:10Z

pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-wv67-9jq7-8r69
Summary: Improper Input Validation and Buffer Over-read in mqtt-packet
Aliases: CVE-2019-5432
Severity: HIGH
CVSS score: 7.5
CWE: CWE-126, CWE-125
Published: 2019-05-14T04:02:45Z

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.
Vulnerability: GHSA-xgx2-332h-9x6q
Summary: SQL Injection in Yeswiki
Aliases: CVE-2021-43091
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2022-03-26T00:00:32Z

An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. The issue was fixed in Yeswiki version 4.1.0.
Vulnerability: GHSA-689x-x68p-fph3
Summary: Cross-site Scripting in vditor
Aliases: CVE-2022-0350
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-01T00:00:41Z

Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
Vulnerability: GHSA-73qw-ww62-m54x
Summary: Critical severity vulnerability that affects colorscore
Aliases: CVE-2015-7541
Severity: CRITICAL
CVSS score: 10
CWE: CWE-77
Published: 2017-10-24T18:33:36Z

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
Vulnerability: GHSA-hm3x-jwwf-jpr9
Summary: Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates
Aliases: CVE-2021-4180
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200
Published: 2022-03-24T00:00:17Z

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the `www_authenticate_uri parameter` (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. A patch is available on the `master` branch and anticipated to be part of version 11.6.1.
Vulnerability: GHSA-7w4p-72j7-v7c2
Summary: Phar object injection in PHPMailer
Aliases: CVE-2018-19296
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502, CWE-915
Published: 2020-03-05T22:08:55Z

PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.

### Impact
Object injection, possible remote code execution

### Patches
Fixed in 6.0.6 and 5.2.27

### Workarounds
Validate and sanitise user input before using.

### References
https://nvd.nist.gov/vuln/detail/CVE-2018-19296

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-3w9q-c44j-37jj
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0773
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2019-04-09T19:43:32Z

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0783.
Vulnerability: GHSA-wgpj-7c2j-vfjm
Summary: Tampering with links (e.g. password reset) in emails sent by Indico
Aliases: CVE-2021-30185
Severity: HIGH
CVSS score: 0
CWE: CWE-640
Published: 2021-04-08T16:33:38Z

### Impact
An external audit of the Indico codebase has discovered a vulnerability in Indico's URL generation logic which could have allowed an attacker to make Indico send a password reset link with a valid token pointing to an attacker-controlled domain by sending that domain in the `Host` header. Had a user clicked such a link without realizing it does not point to Indico (and that they never requested it), it would have revealed their password reset token to the attacker, allowing them to reset the password for that user and thus take over their Indico account.

- If the web server already enforces a canonical host name, this cannot be exploited (this was not part of the default config from the Indico setup guide)
- If only SSO is used ([`LOCAL_IDENTITIES`](https://docs.getindico.io/en/stable/config/settings/#LOCAL_IDENTITIES) set to `False`), the vulnerability cannot be exploited for password reset links, but other links in emails set by Indico could be tampered with in the same way (with less problematic impact though)

### Patches
You need to update to [Indico 2.3.4](https://github.com/indico/indico/releases/tag/v2.3.4) as soon as possible.
See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.

### Workarounds
You can configure the web server to canonicalize the URL to the hostname used for Indico. See [this commit](https://github.com/indico/indico/pull/4815/commits/b6bff6d004abcf07db1891e26a0eb4aa0edb7c21) for the changes in our setup docs; they can be easily applied to your existing web server config.

### For more information
If you have any questions or comments about this advisory:

- Open a thread in [our forum](https://talk.getindico.io/)
- Email us privately at indico-team@cern.ch
Vulnerability: GHSA-4jj4-m52p-8rx3
Summary: Prototype pollution in set-object-value
Aliases: CVE-2020-28281
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-04-13T15:24:08Z

Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-h59f-p56g-g75v
Summary: SQL Injection in librenms
Aliases: CVE-2020-35700
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2021-05-06T18:53:02Z

A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint.
Vulnerability: GHSA-j87c-cj65-vmh5
Summary: High severity vulnerability that affects rendertron
Aliases: CVE-2017-18354
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2019-01-04T17:41:51Z

Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker.
Vulnerability: GHSA-m8xh-cqc2-5q6f
Summary: Type Confusion in ImpressCMS
Aliases: CVE-2021-26600
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-843
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
Vulnerability: GHSA-78p3-96hc-3j47
Summary: Malicious Package in jquery-airload
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:11:17Z

Version 0.2.5 of `jquery-airload` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-jmm9-2p29-vh2w
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2011-0448
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Vulnerability: GHSA-hp5x-rqf7-43vf
Summary: Improper Handling of Exceptional Conditions and Improper Input Validation in Reactor Netty
Aliases: CVE-2020-5403
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-20, CWE-755
Published: 2022-02-10T20:24:21Z

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
Vulnerability: GHSA-vx5c-87qx-cv6c
Summary: Arbitrary Code Execution in mathjs
Aliases: CVE-2017-1001002
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2017-12-18T22:27:45Z

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.


## Recommendation

Update to version 3.17.0 or later.
Vulnerability: GHSA-gvqv-779r-4jgp
Summary: Use after free in CefSharp
Aliases: CVE-2020-16017
Severity: HIGH
CVSS score: 0
CWE: CWE-416
Published: 2020-11-27T20:13:05Z

CVE-2020-16017: Use after free in site isolation

- https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16017

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as `High` severity.
Vulnerability: GHSA-xw5p-hw6r-2j98
Summary: Denial of service in fastify
Aliases: CVE-2020-8192
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2020-08-05T14:53:22Z

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
Vulnerability: GHSA-x3j8-g4v9-67jq
Summary: Downloads Resources over HTTP in pennyworth
Aliases: CVE-2016-10619
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:56:51Z

Affected versions of `pennyworth` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-hrmm-f4j8-8vxc
Summary: Out-of-bounds write
Aliases: CVE-2019-0922
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:11Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-59jw-jqf4-3wq3
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21344
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-434, CWE-502
Published: 2021-03-22T23:28:23Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21344](https://x-stream.github.io/CVE-2021-21344.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-x3rm-644h-67m8
Summary: Out-of-bounds Read in OpenCV
Aliases: CVE-2019-16249
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-125
Published: 2021-10-12T22:22:05Z

OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp.
Vulnerability: GHSA-5888-ffcr-r425
Summary: Prototype Pollution leading to Remote Code Execution in superjson
Aliases: CVE-2022-23631
Severity: CRITICAL
CVSS score: 9
CWE: CWE-94, CWE-1321
Published: 2022-02-09T22:20:49Z

### Impact

This is critical vulnerability, as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or knowledge. Attackers gain full control over the server so they could steal and manipulate data or attack further systems. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. In the case of Blitz.js, it would be at least one RPC call. 

### Patches
This has been patched in superjson 1.8.1 and Blitz.js 0.45.3. 

If you are unable to upgrade to Blitz.js 0.45.3 in a timely manner, you can instead upgrade only superjson to version 1.8.1 using yarn resolutions are similar. Blitz versions < 0.45.3 are only affected because they used superjson versions < 1.8.1.

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/blitz-js/superjson
* Email us at b@bayer.ws
Vulnerability: GHSA-v45m-2wcp-gg98
Summary: Global node_modules Binary Overwrite in bin-links
Severity: LOW
CVSS score: 0
Published: 2020-09-04T17:18:44Z

Versions of  `bin-links` prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This behavior is still allowed in local installations.


## Recommendation

Upgrade to version 1.1.6 or later.
Vulnerability: GHSA-m3fm-h5jp-q79p
Summary: Authorization bypass in Openshift
Aliases: CVE-2016-1906
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-285
Published: 2021-12-20T16:58:14Z

Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
Vulnerability: GHSA-2cfc-865j-gm4w
Summary: XML External Entity Reference in detekt
Aliases: CVE-2022-0272
Severity: HIGH
CVSS score: 7.3
CWE: CWE-611
Published: 2022-04-22T00:00:36Z

Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Vulnerability: GHSA-m539-j985-hcr8
Summary: Crash in `max_pool3d` when size argument is 0 or negative
Aliases: CVE-2021-41196
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-191
Published: 2021-11-10T19:36:21Z

### Impact
The Keras pooling layers can trigger a segfault if the size of the pool is 0 or if a dimension is negative: 

```python
import tensorflow as tf

pool_size = [2, 2, 0]
layer = tf.keras.layers.MaxPooling3D(strides=1, pool_size=pool_size)
input_tensor = tf.random.uniform([3, 4, 10, 11, 12], dtype=tf.float32)
res = layer(input_tensor)
```

This is due to the TensorFlow's implementation of pooling operations where the values in the sliding window are not checked to be strictly positive.

### Patches
We have patched the issue in GitHub commit [12b1ff82b3f26ff8de17e58703231d5a02ef1b8b](https://github.com/tensorflow/tensorflow/commit/12b1ff82b3f26ff8de17e58703231d5a02ef1b8b) (merging [#51975](https://github.com/tensorflow/tensorflow/pull/51975)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/51936).
Vulnerability: GHSA-cg75-6938-wx58
Summary: python-docutils allows insecure usage of temporary files
Aliases: CVE-2009-5042
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-668
Published: 2020-03-13T20:04:51Z

python-docutils allows insecure usage of temporary files
Vulnerability: GHSA-42xw-2xvc-qx8m
Summary: Denial of Service in axios
Aliases: CVE-2019-10742
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-755
Published: 2019-05-29T18:04:45Z

Versions of `axios` prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the `maxContentLength` property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service.


## Recommendation

Upgrade to 0.18.1 or later.
Vulnerability: GHSA-7fm6-2qw4-g3x3
Summary: High severity vulnerability that affects ro.pippo:pippo-core
Aliases: CVE-2018-18628
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-24T19:46:20Z

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.
Vulnerability: GHSA-44vc-fpcg-5cc5
Summary: Moderate severity vulnerability that affects safemode
Severity: MODERATE
CVSS score: 0
Published: 2018-08-08T22:29:49Z

Withdrawn, accidental duplicate publish.

The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Vulnerability: GHSA-7j93-5m2h-rvjx
Summary: Malicious Package in bconi
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:32:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rqjh-jp2r-59cj
Summary: nltk is vulnerable to Inefficient Regular Expression Complexity
Aliases: CVE-2021-3842
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1333
Published: 2022-01-06T22:24:14Z

nltk is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-r587-7jh2-4qr3
Summary: Server secret was included in static assets and served to clients
Severity: CRITICAL
CVSS score: 0
Published: 2020-08-26T19:32:50Z

### Impact
Server JWT signing secret was included in static assets and served to clients.

This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface (which is unprotected and ALLOWS arbitrary code execution) and usually wide-ranging privileges to files, along with Flood's lack of security controls against authenticated users, the severity of this vulnerability is **CRITICAL**. 

### Background
Commit 8d11640b imported `config.js` to client (frontend) components to get `disableUsersAndAuth` configuration variable. Subsequently contents of `config.js` are compiled into static assets and served to users. Unfortunately `config.js` also includes `secret`.

Intruders can use `secret` to sign authentication tokens themselves to bypass builtin access control of Flood.

### Patches
Commit 042cb4ce removed imports of `config.js` from client (frontend) components. Additionally an eslint rule was added to prevent config.js from being imported to client (frontend) components.

Commit 103f53c8 provided a general mitigation to this kind of problem by searching static assets to ensure `secret` is not included before starting server (backend). 

### Workarounds
Users shall upgrade if they use Flood's builtin authentication system.

While maintainers will do their best to support it, Flood cannot guarantee its in-house access control system can stand against determined attackers in high-stake environments. 

> Use `HTTP Basic Auth` or other battle-hardened authentication methods instead of Flood's in-house one. You can use `disableUsersAndAuth` to avoid duplicate authentication.

Users are advised to check out the [wiki](https://github.com/jesec/flood/wiki) for more information on security precautions.

### References
[Wiki - Security precautions](https://github.com/jesec/flood/wiki/Security-precautions)

[Introduction to JSON Web Tokens](https://jwt.io/introduction/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [issue tracker](https://github.com/jesec/flood/issues)
* Email us at [jc@linux.com](mailto:jc@linux.com)
Vulnerability: GHSA-63qc-p2x4-9fgf
Summary: Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library
Aliases: CVE-2019-11777
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-346, CWE-755
Published: 2019-09-17T22:47:11Z

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
Vulnerability: GHSA-2xjj-5x6h-8vmf
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-1099
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
Vulnerability: GHSA-5qcg-w2cc-xffw
Summary: Uncontrolled resource consumption in validators Python package
Aliases: CVE-2019-19588
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2020-01-21T20:32:09Z

The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.
Vulnerability: GHSA-cwh5-3cw7-4286
Summary: Moderate severity vulnerability that affects tlslite-ng
Aliases: CVE-2018-1000159
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-354
Published: 2018-07-12T20:30:44Z

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ct_check_cbc_mac_and_pad(); line "end_pos = data_len - 1 - mac.digest_size" that can result in an attacker manipulating the TLS ciphertext which will not be detected by receiving tlslite-ng. This attack appears to be exploitable via man in the middle on a network connection. This vulnerability appears to have been fixed after commit 3674815d1b0f7484454995e2737a352e0a6a93d8.
Vulnerability: GHSA-4r5x-qjqc-p579
Summary: Tracking Module in botbait
Aliases: CVE-2017-16126
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2020-09-01T18:57:44Z

The module `botbait` is a tool to be used to track bot and automated tools usage with-in the npm ecosystem.

`botbait` is known to record and track user information.

The module tracks the following information.
- Source IP
- process.versions
- process.platform
- How the module was invoked (test, require, pre-install)


## Recommendation

This package has no functional value, and should be removed from your environment if discovered.
Vulnerability: GHSA-9h9c-f287-c6vp
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-17184
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-799
Published: 2018-11-06T23:16:18Z

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
Vulnerability: GHSA-pchc-949f-53m5
Summary: High severity vulnerability that affects multi_xml
Aliases: CVE-2013-0175
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Vulnerability: GHSA-5mwx-f6w6-7w5r
Summary: Cross-site Scripting in GeniXCMS
Aliases: CVE-2022-24563
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-04T00:00:19Z

In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.
Vulnerability: GHSA-q75g-2496-mxpp
Summary: Regular Expression Denial of Service in parsejson
Aliases: CVE-2017-16113
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:11:13Z

Affected versions of `parsejson` are vulnerable to a regular expression denial of service when parsing untrusted user input.


## Recommendation

The `parsejson` package has not been functionally updated since it was initially released.

Additionally, it provides functionality which is natively included in Node.js, and therefore the native `JSON.parse()` should be used, for both performance and security reasons.
Vulnerability: GHSA-652h-xwhf-q4h6
Summary: OS Command Injection in ssh2
Aliases: CVE-2020-26301
Severity: HIGH
CVSS score: 7.5
CWE: CWE-78
Published: 2021-09-21T16:50:46Z

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Vulnerability: GHSA-6jmm-mp6w-4rrg
Summary: OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser
Aliases: CVE-2022-29546
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2022-04-26T21:14:57Z

### Impact
NekoHtml Parser suffers from a denial of service vulnerability on versions 2.60.0 and below. A specifically crafted input regarding the parsing of processing instructions leads to heap memory consumption. Please update to version 2.61.0.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/HtmlUnit/htmlunit-neko](https://github.com/HtmlUnit/htmlunit-neko)
* Email us at [rbri at rbri.de]
Vulnerability: GHSA-273r-mgr4-v34f
Summary: Uncaught Exception in engine.io
Aliases: CVE-2022-21676
Severity: HIGH
CVSS score: 7.5
CWE: CWE-754
Published: 2022-01-13T16:14:17Z

### Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

> RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear
>   at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14)
>   at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22)
>   at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10)
>   at writeOrBuffer (internal/streams/writable.js:358:12)

This impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package starting from version `4.0.0`, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).

### Patches

A fix has been released for each major branch:

| Version range | Fixed version |
| --- | --- |
| `engine.io@4.x.x` | `4.1.2` |
| `engine.io@5.x.x` | `5.2.1` |
| `engine.io@6.x.x` | `6.1.1` |

Previous versions (`< 4.0.0`) are not impacted.

For `socket.io` users:

| Version range | `engine.io` version | Needs minor update? |
| --- | --- | --- |
| `socket.io@4.4.x` | `~6.1.0` | -
| `socket.io@4.3.x` | `~6.0.0` | Please upgrade to `socket.io@4.4.x`
| `socket.io@4.2.x` | `~5.2.0` | -
| `socket.io@4.1.x` | `~5.1.1` | Please upgrade to `socket.io@4.4.x`
| `socket.io@4.0.x` | `~5.0.0` | Please upgrade to `socket.io@4.4.x`
| `socket.io@3.1.x` | `~4.1.0` | -
| `socket.io@3.0.x` | `~4.0.0` | Please upgrade to `socket.io@3.1.x` or `socket.io@4.4.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/))

In most cases, running `npm audit fix` should be sufficient. You can also use  `npm update engine.io --depth=9999`.

### Workarounds

There is no known workaround except upgrading to a safe version.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)

Thanks to Marcus Wejderot from Mevisio for the responsible disclosure.
Vulnerability: GHSA-v9wp-8r97-v6xg
Summary: Cross-Site Scripting in jquery.json-viewer
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T17:17:00Z

Versions of `jquery.json-viewer` prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user input in an `<a>` tag. This allows attackers to create malicious links with JSON payloads such as: 
```
{
  "foo": "https://bar.com\" onmouseover=alert('xss') \""
}
```

This may lead to arbitrary JavaScript execution in a victim's browser.


## Recommendation

Upgrade to version 1.3.0 or later.
Vulnerability: GHSA-xgp2-cc4r-7vf6
Summary: Denial of Service in http-live-simulator
Severity: MODERATE
CVSS score: 0
Published: 2020-09-03T20:44:21Z

Versions of `http-live-simulator` prior to 1.0.8 are vulnerable to Denial of Service. The package fails to catch an exception that causes the Node process to crash, effectively shutting down the server. This allows an attacker to send an HTTP request that crashes the server.


## Recommendation

Upgrade to version 1.0.8 or later.
Vulnerability: GHSA-j8qc-5fqr-52fp
Summary: Division by zero in `Conv2DBackpropFilter`
Aliases: CVE-2021-29538
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:22:38Z

### Impact
An attacker can cause a division by zero to occur in `Conv2DBackpropFilter`:

```python
import tensorflow as tf

input_tensor = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
filter_sizes = tf.constant([0, 0, 0, 0], shape=[4], dtype=tf.int32)
out_backprop = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)

tf.raw_ops.Conv2DBackpropFilter(
  input=input_tensor,
  filter_sizes=filter_sizes,
  out_backprop=out_backprop,
  strides=[1, 1, 1, 1],
  use_cudnn_on_gpu=False,
  padding='SAME',
  explicit_paddings=[],
  data_format='NHWC',
  dilations=[1, 1, 1, 1]
)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/1b0296c3b8dd9bd948f924aa8cd62f87dbb7c3da/tensorflow/core/kernels/conv_grad_filter_ops.cc#L513-L522) computes a divisor based on user provided data (i.e., the shape of the tensors given as arguments):

```cc
const size_t size_A = output_image_size * filter_total_size; 
const size_t size_B = output_image_size * dims.out_depth;
const size_t size_C = filter_total_size * dims.out_depth;
const size_t work_unit_size = size_A + size_B + size_C;
const size_t shard_size = (target_working_set_size + work_unit_size - 1) / work_unit_size;
```

If all shapes are empty then `work_unit_size` is 0. Since there is no check for this case before division, this results in a runtime exception, with potential to be abused for a denial of service. 

### Patches
We have patched the issue in GitHub commit [c570e2ecfc822941335ad48f6e10df4e21f11c96](https://github.com/tensorflow/tensorflow/commit/c570e2ecfc822941335ad48f6e10df4e21f11c96).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-cxm3-284p-qc4v
Summary: Prototype Pollution in sds
Aliases: CVE-2020-7618
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-915
Published: 2020-09-03T15:53:12Z

Affected versions of `sds` are vulnerable to prototype pollution. The `set` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

## Recommendation

Upgrade to version 4.0.0 or later
Vulnerability: GHSA-qj3g-wfr7-3cv7
Summary: Malicious Package in require-ports
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:41:53Z

Version 10.4.0 of `require-ports` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-wxgw-qj99-44c2
Summary: Prototype Pollution in node-forge util.setPath API
Severity: LOW
CVSS score: 0
Published: 2022-01-08T00:22:40Z

### Impact
`forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.

### Patches
The `forge.util.setPath` API and related functions were removed in 0.10.0.

### Workarounds
Don't call `forge.util.setPath` directly or indirectly with untrusted keys.

### References
- https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge).
* Email us at support@digitalbazaar.com.
Vulnerability: GHSA-jhgp-hvj6-x2p2
Summary: Stored Cross-Site Scripting in tianma-static
Aliases: CVE-2018-16474
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2018-11-06T23:12:01Z

All versions of `tianma-static` are vulnerable to stored cross-site scripting (XSS). The vulnerability is exploitable if a user can control the name of a file that is served by `tianma-static`


## Recommendation

As no fix is available for this vulnerability at this time it is our recommendation to use another static file server.
Vulnerability: GHSA-vj72-mwrj-m2xq
Summary: Prototype Pollution in deepmergefn
Aliases: CVE-2021-23417
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-1321, CWE-915
Published: 2021-08-10T16:09:25Z

All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.