TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-c2q3-4qrh-fm48
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14061
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2020-06-18T14:44:50Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
Vulnerability: GHSA-pgmg-gf5p-54j8
Summary: Prototype Pollution in gammautils
Aliases: CVE-2020-7718
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:26:14Z

"All versions of package gammautils up to and including version 0.0.81 are vulnerable to Prototype Pollution via the deepSet and deepMerge functions."
Vulnerability: GHSA-q4g7-jrxv-67r9
Summary: Silent Configuration Failure in Puppet Agent
Aliases: CVE-2021-27025
Severity: MODERATE
CVSS score: 6.5
Published: 2021-12-02T17:54:25Z

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
Vulnerability: GHSA-6gr8-c3m5-mvrg
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32717
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-09-08T18:00:47Z

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
Vulnerability: GHSA-gx5g-xcxj-cx2w
Summary: Critical severity vulnerability that affects smart_proxy_dynflow
Aliases: CVE-2018-14643
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2018-10-08T23:18:13Z

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
Vulnerability: GHSA-792r-mh2q-p8qp
Summary: Server Side Request Forgery (SSRF) in org.mitre:openid-connect-server
Aliases: CVE-2021-26715
Severity: HIGH
CVSS score: 9.1
CWE: CWE-918
Published: 2021-05-13T22:30:52Z

The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might, for example, have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries, obtain sensitive data, or attack other hosts in the internal network.
Vulnerability: GHSA-6r92-cgxc-r5fg
Summary: Denial of service in CBOR library
Severity: HIGH
CVSS score: 0
CWE: CWE-407
Published: 2022-01-21T23:35:35Z

### Impact
Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.

Affected versions _include_ versions 4.0.0 through 4.5.0.

This vulnerability was privately reported to me.

### Patches
This issue has been fixed in version 4.5.1.  Users should use the latest version of this library. (The latest version is not necessarily 4.5.1.  Check the [NuGet page](https://www.nuget.org/packages/PeterO.Cbor) to see the latest version's version number.)

### Workarounds

Again, users should use the latest version of this library.

In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if&mdash;

- it begins with a byte other than 0x80 through 0xDF, or
- it does not contain a byte in the range 0xa0 through 0xBF.

Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR).
Vulnerability: GHSA-rjf2-j2r6-q8gr
Summary: Prototype Pollution in vm2
Aliases: CVE-2021-23449
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321, CWE-915
Published: 2021-10-19T15:28:45Z

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.
Vulnerability: GHSA-82hx-w2r5-c2wq
Summary: Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes
Aliases: CVE-2020-8552
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-789, CWE-400
Published: 2022-02-15T01:57:18Z

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
Vulnerability: GHSA-7g9h-c88w-r7h2
Summary: High severity vulnerability that affects django
Aliases: CVE-2011-0698
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T19:52:31Z

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
Vulnerability: GHSA-fqh4-rh59-xhvf
Summary: Denial of service
Aliases: CVE-2021-23351
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-400
Published: 2021-05-18T21:07:43Z

The package `github.com/pires/go-proxyproto` before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1() function. The reader in this package is a default bufio.Reader wrapping a net.Conn. It will read from the connection until it finds a newline. Since no limits are implemented in the code, a deliberately malformed V1 header could be used to exhaust memory in a server process using this code - and create a DoS. This can be exploited by sending a stream starting with PROXY and continuing to send data (which does not contain a newline) until the target stops acknowledging. The risk here is small, because only trusted sources should be allowed to send proxy protocol headers.
Vulnerability: GHSA-6jq2-789q-fff2
Summary: High severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-11761
Severity: HIGH
CVSS score: 7.5
CWE: CWE-611
Published: 2018-10-17T15:49:36Z

In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
Vulnerability: GHSA-79jw-2f46-wv22
Summary: Authenticated remote code execution in October CMS
Aliases: CVE-2022-21705
Severity: HIGH
CVSS score: 7.2
CWE: CWE-74
Published: 2022-02-23T21:08:44Z

### Impact

An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass  `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code.

- This issue only affects admin panels that rely on safe mode and restricted permissions.
- To exploit this vulnerability, an attacker must first have access to the backend area.

### Patches

The issue has been patched in Build 474 (v1.0.474) and v1.1.10.

### Workarounds

Apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually if unable to upgrade to Build 474 or v1.1.10.

### References

Credits to:
- David Miller

### For more information

If you have any questions or comments about this advisory:
- Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-j7c4-2xj8-wm7r
Summary: Moderate severity vulnerability that affects kdcproxy
Aliases: CVE-2015-5159
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-11-01T14:49:30Z

python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
Vulnerability: GHSA-77g3-3j5w-64w4
Summary: Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
Aliases: CVE-2020-10685
Severity: LOW
CVSS score: 5.5
CWE: CWE-668, CWE-377, CWE-459
Published: 2021-04-07T20:36:46Z

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.
Vulnerability: GHSA-838h-jqp6-cf2f
Summary: Sandbox bypass leading to arbitrary code execution in Deno
Aliases: CVE-2022-24783
Severity: CRITICAL
CVSS score: 10
CWE: CWE-269
Published: 2022-03-29T22:10:10Z

### Impact

The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass permission checks and execute arbitrary shell code.

There is **no** evidence that this vulnerability has been exploited in the wild.

This vulnerability does **not** affect users of Deno Deploy.

### Patches

The vulnerability has been patched in Deno 1.20.3.

### Workarounds

There is no workaround. All users are recommended to upgrade to 1.20.3 immediately

---

The cause of this error was that certain FFI operations did not correctly check for permissions. The issue was fixed in [this](https://github.com/denoland/deno/pull/14115) pull request.
Vulnerability: GHSA-gcr6-rf47-jrgf
Summary: Loaded Databook of Tablib prone to python insertion resulting in command execution
Aliases: CVE-2017-2810
Severity: CRITICAL
CVSS score: 9.8
Published: 2018-07-13T16:01:25Z

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Vulnerability: GHSA-f7f4-5w9j-23p2
Summary: festivaltts4r allows arbitrary command execution
Aliases: CVE-2016-10194
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2017-10-24T18:33:35Z

The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 method in lib/festivaltts4r/festival4r.rb.
Vulnerability: GHSA-cg8j-8w52-735v
Summary: Missing warning can lead to unauthenticated admin access in SilverStripe
Aliases: CVE-2019-12204
Severity: CRITICAL
CVSS score: 9.8
Published: 2019-11-12T23:01:25Z

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Vulnerability: GHSA-cpgr-wmr9-qxv4
Summary: Cross-Site Scripting in serve
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:20:14Z

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

Upgrade to version 10.0.2 or later.
Vulnerability: GHSA-3vg2-4qxc-ch4j
Summary: Directory Traversal in unicorn-list
Aliases: CVE-2017-16131
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:49:38Z

Affected versions of `unicorn-list` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fj67-w3m4-rfmp
Summary: Cross-site scripting in Plone
Aliases: CVE-2021-33513
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-08T23:19:28Z

Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.
Vulnerability: GHSA-vv2x-vrpj-qqpq
Summary: Cross-site scripting in Bleach
Aliases: CVE-2021-23980
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-02-02T17:58:40Z

### Impact                                                                                                                                                                                                                                                    

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* `svg` or `math` in the allowed tags
* `p` or `br` in allowed tags
* `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags
* the keyword argument `strip_comments=False`

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

* modify `bleach.clean` calls to at least one of:
  * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag
  * not allow `svg` or `math` tags
  * not allow `p` or `br` tags
  * set `strip_comments=True`

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399
* https://advisory.checkmarx.net/advisory/CX-2021-4303
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980
* https://cure53.de/fp170.pdf

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx
* Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by [Michał Bentkowski](https://twitter.com/SecurityMB) at Securitum

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)
Vulnerability: GHSA-m52x-29pq-w3vv
Summary: Cross-Site Scripting in pannellum
Aliases: CVE-2019-16763
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2019-11-22T18:18:03Z

Versions of `pannellum ` prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim's browser. 


## Recommendation

Upgrade to version 2.5.6 or later.
Vulnerability: GHSA-7mvr-5x2g-wfc8
Summary: Moderate severity vulnerability that affects bootstrap
Aliases: CVE-2018-14042
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-09-13T15:50:32Z

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.  This is similar to CVE-2018-14041.
Vulnerability: GHSA-646x-m363-9rh4
Summary: Hijacked Environment Variables in node-opensl
Aliases: CVE-2017-16063
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-10-03T20:27:55Z

The `node-opensl` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-hm2p-fhwx-9285
Summary: Incorrect Permission Assignment for Critical Resource	in Plone
Aliases: CVE-2021-33509
Severity: CRITICAL
CVSS score: 9.9
CWE: CWE-732
Published: 2021-06-15T16:11:38Z

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
Vulnerability: GHSA-gf8v-vxf9-7c66
Summary: Downloads Resources over HTTP in cloudpub-redis
Aliases: CVE-2016-10672
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:26Z

Affected versions of `cloudpub-redis` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cloudpub-redis`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-2r3v-q9x3-7g46
Summary: Link injection in SimpleSAMLphp
Severity: LOW
CVSS score: 3.7
CWE: CWE-74
Published: 2020-01-24T21:27:16Z

### Background
Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.

### Description
The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:

- `www/logout.php`
- `modules/core/www/no_cookie.php`

The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the `link_href` and `retryURL` HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the `trusted.url.domains` configuration option.

### Affected versions
All SimpleSAMLphp versions prior to 1.14.4.

### Impact
A remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.

### Resolution
Upgrade to the latest version.

### Credit
This security issue was discovered and reported by John Page (hyp3rlinx).
Vulnerability: GHSA-2f29-pmpx-vj62
Summary: Directory Traversal in serverwg
Aliases: CVE-2017-16101
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:52:33Z

`serverwg` is a simple http server.

`serverwg` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```
and response:
```
HTTP/1.1 200 OK
Date: Wed, 17 May 2017 22:52:08 GMT
Connection: keep-alive

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-c9rv-3jmq-527w
Summary: Unexpected panic when decoding tokens in branca
Aliases: CVE-2020-35918
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2021-08-25T20:49:50Z

An issue was discovered in the branca crate before 0.10.0 for Rust. Decoding tokens (with invalid base62 data) can panic.
Vulnerability: GHSA-9gjv-6qq6-v7qm
Summary: 2FA bypass through deleting devices in wagtail-2fa
Aliases: CVE-2020-5240
Severity: HIGH
CVSS score: 7.6
CWE: CWE-285
Published: 2020-03-13T21:18:55Z

### Impact
Any user with access to the CMS can view and delete other users&#39; 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user&#39;s device they can disable the target user&#39;s 2FA devices and potentially compromise the account if they figure out their password.

### Patches
The problem has been patched in version 1.4.1.

### Workarounds
There is no workaround for this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)
* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)
Vulnerability: GHSA-3rh7-vm4x-q2hp
Summary: Hijacked Environment Variables in sqlserver
Aliases: CVE-2017-16055
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-11-09T17:49:22Z

The `sqlserver` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-9gcm-f4x3-8jpw
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-11039
Severity: MODERATE
CVSS score: 5.9
Published: 2018-10-16T17:35:54Z

Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.
Vulnerability: GHSA-c4r5-xvgw-2942
Summary: Metrics exposure in Wildfly
Aliases: CVE-2021-3503
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2022-04-19T00:00:50Z

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.
Vulnerability: GHSA-h45v-vgvp-3h5v
Summary: Out-of-bounds write in stack
Aliases: CVE-2020-35895
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2021-08-25T20:49:13Z

An issue was discovered in the stack crate before 0.3.1 for Rust. ArrayVec has an out-of-bounds write via element insertion.
Vulnerability: GHSA-8j65-4pcq-xq95
Summary: Options structure open to XSS if passed unfiltered
Aliases: CVE-2021-29489
Severity: HIGH
CVSS score: 7.6
CWE: CWE-79
Published: 2021-05-06T15:45:03Z

### Impact
In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. Especially when using the `useHTML` flag, HTML string options would be inserted unfiltered directly into the DOM. When `useHTML` was false, malicious code could be inserted by using various character replacement tricks or malformed HTML.

If your chart configuration comes from a trusted source like a static setup or pre-filtered HTML (or no markup at all in the configuration), you are not impacted.

### Patches
In version 9, the whole rendering layer was refactored to use an DOMParser, an AST and tag and HTML allow-listing to make sure only safe content entered the DOM. In addition, prototype pollution was stopped.

### Workarounds
Implementers who are not able to upgrade may apply [DOMPurify](https://github.com/cure53/DOMPurify) recursively [to the options structure](https://jsfiddle.net/highcharts/zd3wcm5L/) to filter out malicious markup.

### References
* Details on the improved [Highcharts security](https://www.highcharts.com/docs/chart-concepts/security)
* [The AST and TextBuilder refactoring](https://github.com/highcharts/highcharts/pull/14913)
* [The fix for prototype pollution](https://github.com/highcharts/highcharts/pull/14884)

### For more information
If you have any questions or comments about this advisory:
* Visit our [support page](https://www.highcharts.com/blog/support/)
* For more Email us at [security@highcharts.com](mailto:security@highcharts.com)
Vulnerability: GHSA-4c32-xmgj-2g98
Summary: High severity vulnerability that affects org.apache.pdfbox:pdfbox
Aliases: CVE-2016-2175
Severity: HIGH
CVSS score: 7.8
CWE: CWE-611
Published: 2018-10-17T18:22:15Z

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Vulnerability: GHSA-vgv5-cxvh-vfxh
Summary: Arbitrary code execution in clickhouse-driver
Aliases: CVE-2020-26759
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-120
Published: 2021-04-07T20:50:57Z

clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.
Vulnerability: GHSA-wg5r-c793-w5w2
Summary: Downloads Resources over HTTP in mystem-wrapper
Aliases: CVE-2016-10671
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:28Z

Affected versions of `mystem-wrapper` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem-wrapper`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-6jhm-4vmx-mr76
Summary: SQL injection in Moodle
Aliases: CVE-2022-0332
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2022-01-28T22:08:14Z

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
Vulnerability: GHSA-pw3c-h7wp-cvhx
Summary: Improper Initialization in Pillow
Aliases: CVE-2022-22815
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-665
Published: 2022-01-12T20:07:43Z

Pillow is the friendly PIL (Python Imaging Library) fork. path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
Vulnerability: GHSA-8q89-pwhh-7wfq
Summary: Moderate severity vulnerability that affects com.github.penggle:kaptcha
Aliases: CVE-2018-18531
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-330
Published: 2018-10-23T16:08:56Z

text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 use the Random (rather than SecureRandom) function for generating CAPTCHA values, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force approach.
Vulnerability: GHSA-3ww4-cp53-6g2x
Summary: Cross Site Request Forgery in kindeditor
Aliases: CVE-2021-42228
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-10-18T19:44:06Z

Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.
Vulnerability: GHSA-vx3p-948g-6vhq
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-27290
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-19T21:24:36Z

npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Vulnerability: GHSA-3h4r-pjv6-cph9
Summary: Escape sequence injection in RubyGems
Aliases: CVE-2019-8323
Severity: HIGH
CVSS score: 7.5
CWE: CWE-74
Published: 2019-06-20T16:05:57Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
Vulnerability: GHSA-j6x7-42x2-hpcf
Summary: Malicious Package in buffer-xoz
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:14:20Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-pq64-v7f5-gqh8
Summary: Regular Expression Denial of Service (ReDoS) in Pygments
Aliases: CVE-2021-27291
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-29T16:33:03Z

In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
Vulnerability: GHSA-jr9c-h74f-2v28
Summary: Improper Authorization in Gitea
Aliases: CVE-2022-0905
Severity: MODERATE
CVSS score: 7.1
CWE: CWE-863, CWE-285
Published: 2022-03-11T00:02:35Z

Gitea 1.16.3 and prior is vulnerable to improper authorization. A patch is available and is anticipated to be part of the 1.16.4 release.
Vulnerability: GHSA-4x2f-54wr-4hjg
Summary: Potential Zip Slip Vulnerability in baserCMS
Aliases: CVE-2021-41279
Severity: HIGH
CVSS score: 7.7
CWE: CWE-22
Published: 2021-12-01T18:29:32Z

There is a OS Command Injection Vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

Target
baserCMS 4.5.3 and earlier versions

Vulnerability
OS Command Injection Vulnerability.

Countermeasures
Update to the latest version of baserCMS

Credits
Daniele Scanu @SoterItSecurity
Vulnerability: GHSA-2m7g-9q74-9m3q
Summary: Improper Certificate Validation in Apache Beam
Aliases: CVE-2020-1929
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2020-05-06T20:49:04Z

The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.
Vulnerability: GHSA-c72p-9xmj-rx3w
Summary: Archive package allows chmod of file outside of unpack target directory
Aliases: CVE-2021-32760
Severity: MODERATE
CVSS score: 5
CWE: CWE-668
Published: 2021-07-26T21:17:45Z

## Impact

A bug was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem.  Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky.  This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.

## Patches

This bug has been fixed in containerd 1.5.4 and 1.4.8.  Users should update to these versions as soon as they are released.  Running containers do not need to be restarted.

## Workarounds

Ensure you only pull images from trusted sources.

Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with unexpected files.

## For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io if you think you’ve found a security bug.
Vulnerability: GHSA-4q2f-8g74-qm56
Summary: Cross-Site Scripting in takeapeek
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T17:18:05Z

All versions of `takeapeek` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-543v-gj2c-r3ch
Summary: Moderate severity vulnerability that affects activemodel
Aliases: CVE-2016-0753
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2017-10-24T18:33:35Z

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
Vulnerability: GHSA-c7vm-f5p4-8fqh
Summary: Open redirect in Jupyter Notebook
Aliases: CVE-2020-26215
Severity: MODERATE
CVSS score: 4.4
CWE: CWE-601
Published: 2020-11-18T21:06:36Z

[localhost](http://localhost:8888)

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability - a maliciously crafted link to a notebook server could redirect the browser to a different website.

All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may *appear* safe, but ultimately redirect to a spoofed server on the public internet.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

Patched in notebook 6.1.5


### References

[OWASP page on open redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: zhuonan li of Alibaba Application Security Team
Vulnerability: GHSA-5xg3-j2j6-rcx4
Summary: Relative Path Traversal in git-delta
Aliases: CVE-2021-36376
Severity: HIGH
CVSS score: 7.8
CWE: CWE-427, CWE-23
Published: 2021-08-25T21:01:39Z

git-delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.
Vulnerability: GHSA-33vf-4xgg-9r58
Summary: HTTP Response Splitting (Early Hints) in Puma
Aliases: CVE-2020-5249
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-113
Published: 2020-03-03T23:33:16Z

### Impact
If an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as [HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to [CVE-2020-5247](https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v), which fixed this vulnerability but only for regular responses.

### Patches
This has been fixed in 4.3.3 and 3.12.4.

### Workarounds
Users can not allow untrusted/user input in the Early Hints response header.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [puma](https://github.com/puma/puma)
* Email us a project maintainer. [Email addresses are listed in our Code of Conduct](https://github.com/puma/puma/blob/master/CODE_OF_CONDUCT.md#enforcement).
Vulnerability: GHSA-8278-88vv-x98r
Summary: Execution of untrusted code through config file
Aliases: CVE-2021-21371
Severity: MODERATE
CVSS score: 0
CWE: CWE-502
Published: 2021-03-10T21:51:17Z

### Impact
It is possible to run arbitrary commands through the yaml.load() method.  This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file.

### Workarounds
Manually adjust yaml.load() to yaml.safe_load()

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [tenable/integration-jira-cloud](https://github.com/tenable/integration-jira-cloud/issues)
* Email us at [vulnreport@tenable.com](mailto:vulnreport@tenable.com)
Vulnerability: GHSA-p62j-hrxm-xcxf
Summary: Book page text, count, and author/title length is not limited in PocketMine-MP
Severity: MODERATE
CVSS score: 6.5
Published: 2022-01-06T23:53:35Z

### Impact
Players can fill book pages with as many characters as they like; the server does not check this.
In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs".

This causes a variety of problems:
- Oversized NBT on the wire costing excess bandwidth for server and client
- Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific)
- Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)

This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.

### Patches
The bug has been fixed in 3.26.5 and 4.0.5.

### Workarounds
Ban writable books, or use a plugin to cancel `PlayerEditBookEvent` to cancel the event if `strlen(text) > 1024 || mb_strlen(text) > 256`.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-9mmw-3fmh-96g3
Summary: Malicious Package in calk
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T20:23:38Z

All versions of `calk` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-h352-g5vw-3926
Summary: Improper Input Validation in fruity
Aliases: CVE-2021-43620
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-11-16T17:26:47Z

An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\0' byte, which might not be the end of the string.
Vulnerability: GHSA-gww7-p5w4-wrfv
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2019-20330
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-03-04T20:52:11Z

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
Vulnerability: GHSA-qc8j-m8j3-rjq6
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:57:58Z

Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
Vulnerability: GHSA-hhm3-48h2-597v
Summary: Insufficiently Protected Credentials in Apache Superset
Aliases: CVE-2021-44451
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-522
Published: 2022-02-02T00:01:46Z

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.
Vulnerability: GHSA-43f8-2h32-f4cj
Summary: Regular Expression Denial of Service in hosted-git-info
Aliases: CVE-2021-23362
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-05-06T16:10:39Z

The npm package `hosted-git-info` before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity
Vulnerability: GHSA-67mq-h2r9-rh2m
Summary: Prototype pollution in multi-ini
Aliases: CVE-2020-28460
Severity: HIGH
CVSS score: 5.6
CWE: CWE-1321
Published: 2021-04-13T15:23:41Z

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.
Vulnerability: GHSA-95q3-8gr9-gm8w
Summary: Denial of Service by Uncontrolled Resource Consumption
Aliases: CVE-2021-27923
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-18T19:54:43Z

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
Vulnerability: GHSA-x28w-hvwc-mp75
Summary: Static Code Injection in Microweber
Aliases: CVE-2022-0895
Severity: HIGH
CVSS score: 7.7
CWE: CWE-94, CWE-96
Published: 2022-03-11T00:02:35Z

Microweber is a new generation CMS with drag and drop. Prior to version 1.3, Microweber is vulnerable to static code injection.
Vulnerability: GHSA-mw6q-98mp-g8g8
Summary: Cross-site Scripting in bootstrap-table
Aliases: CVE-2021-23472
Severity: LOW
CVSS score: 3.1
CWE: CWE-79, CWE-843
Published: 2021-11-08T17:54:46Z

This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
Vulnerability: GHSA-gff3-739c-gxfq
Summary: Reflected cross-site scripting issue in Datasette
Aliases: CVE-2021-32670
Severity: HIGH
CVSS score: 7.2
CWE: CWE-79
Published: 2021-06-10T17:22:59Z

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.
Vulnerability: GHSA-2frx-j9hj-6c65
Summary: User enumeration in authentication mechanisms
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2021-05-17T20:52:21Z

Description
-----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. 

Resolution
----------

We now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.

Credits
-------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Vulnerability: GHSA-xcqr-9h24-vrgw
Summary: Improper Restriction of Excessive Authentication Attempts in Argo API
Aliases: CVE-2020-8827
Severity: HIGH
CVSS score: 7.5
CWE: CWE-307
Published: 2021-07-26T21:19:37Z

As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
Vulnerability: GHSA-qvxv-pmq9-4q7g
Summary: High severity vulnerability that affects org.scala-lang:scala-compiler
Aliases: CVE-2017-15288
Severity: HIGH
CVSS score: 7.8
CWE: CWE-732
Published: 2018-10-19T16:51:11Z

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, which allows local users to write to arbitrary class files and consequently gain privileges.
Vulnerability: GHSA-9j2c-x8qm-qmjq
Summary: SQL injection in Tortoise ORM
Aliases: CVE-2020-11010
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-89
Published: 2020-04-20T21:31:23Z

### Impact
Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.
SQLite & PostgreSQL was only affected when filtering with ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts)


### Patches
Please upgrade to 0.15.23+ or 0.16.6+

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Github](https://github.com/tortoise/tortoise-orm/issues)
* Chat to us on [Gitter](https://gitter.im/tortoise/community)