TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-x446-3xhq-5xfp
Summary: Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon
Aliases: CVE-2022-27814
Severity: LOW
CVSS score: 3.3
CWE: CWE-668
Published: 2022-04-15T00:00:40Z

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.
Vulnerability: GHSA-458v-4hrf-g3m4
Summary: socket2 invalidly assumes the memory layout of std::net::SocketAddr
Aliases: CVE-2020-35920
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-188
Published: 2021-08-25T20:50:37Z

The socket2 crate has assumed `std::net::SocketAddrV4` and `std::net::SocketAddrV6` have the same memory layout as the system C representation `sockaddr`. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens.
Vulnerability: GHSA-w248-xr37-jx8m
Summary: High severity vulnerability that affects fastreader
Aliases: CVE-2013-2615
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-h7j7-pw3v-3v3x
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2018-10912
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-835
Published: 2018-10-18T16:49:54Z

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
Vulnerability: GHSA-537h-rv9q-vvph
Summary: Access Restriction Bypass
Aliases: CVE-2020-13757
Severity: HIGH
CVSS score: 7.5
CWE: CWE-327
Published: 2021-03-24T18:24:39Z

Python-RSA 4.0 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
Vulnerability: GHSA-mvw8-v767-qhjm
Summary: Moderate severity vulnerability that affects radiant
Aliases: CVE-2018-5216
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2018-01-06T01:11:52Z

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.
Vulnerability: GHSA-7mg7-m5c3-3hqj
Summary: Data races in unicycle
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:39Z

Affected versions of this crate unconditionally implemented `Send` & `Sync` for types `PinSlab<T>` & `Unordered<T, S>`. This allows sending non-Send types to other threads and concurrently accessing non-Sync types from multiple threads.

This can result in a data race & memory corruption when types that provide internal mutability without synchronization are contained within `PinSlab<T>` or `Unordered<T, S>` and accessed concurrently from multiple threads.

The flaw was corrected in commits 92f40b4 & 6a6c367 by adding trait bound `T: Send` to `Send` impls for `PinSlab<T>` & `Unordered<T, S>` and adding `T: Sync` to `Sync` impls for `PinSlab<T>` & `Unordered<T, S>`.
Vulnerability: GHSA-vfrc-ggmc-5jwv
Summary: Cross-site Scripting in django-helpdesk
Aliases: CVE-2021-3950
Severity: HIGH
CVSS score: 8.8
CWE: CWE-79
Published: 2021-11-23T17:55:46Z

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-xpqw-fqpw-35fc
Summary: Directory Traversal in wangguojing123
Aliases: CVE-2017-16150
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T16:57:54Z

Affected versions of `wangguojing123` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jrpg-35hw-m4p9
Summary: Capture-replay in Gitea
Aliases: CVE-2021-45327
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-294
Published: 2022-02-09T00:00:29Z

Gitea is a project to help users set up a self-hosted Git service. Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. This could allow a remote malicious user to execute arbitrary code.
Vulnerability: GHSA-xwhf-g6j5-j5gc
Summary: Float cast overflow undefined behavior
Aliases: CVE-2020-15266
Severity: LOW
CVSS score: 3.7
CWE: CWE-119
Published: 2020-11-13T17:18:29Z

### Impact
When the `boxes` argument of `tf.image.crop_and_resize` has a very large value, the CPU kernel implementation receives it as a C++ `nan` floating point value. Attempting to operate on this is undefined behavior which later produces a segmentation fault.

### Patches

We have patched the issue in c0319231333f0f16e1cc75ec83660b01fedd4182 and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in #42129
Vulnerability: GHSA-cwv3-863g-39vx
Summary: Stack overflow due to looping TFLite subgraph
Aliases: CVE-2021-29591
Severity: HIGH
CVSS score: 7.3
CWE: CWE-835, CWE-674
Published: 2021-05-21T14:26:56Z

### Impact
TFlite graphs must not have loops between nodes. However, this condition was not checked and an attacker could craft models that would result in infinite loop during evaluation. In certain cases, the infinite loop would be replaced by stack overflow due to too many recursive calls.

For example, the [`While` implementation](https://github.com/tensorflow/tensorflow/blob/106d8f4fb89335a2c52d7c895b7a7485465ca8d9/tensorflow/lite/kernels/while.cc) could be tricked into a scneario where both the body and the loop subgraphs are the same. Evaluating one of the subgraphs means calling the `Eval` function for the other and this quickly exhaust all stack space.
    
### Patches 
We have patched the issue in GitHub commit [9c1dc920d8ffb4893d6c9d27d1f039607b326743](https://github.com/tensorflow/tensorflow/commit/9c1dc920d8ffb4893d6c9d27d1f039607b326743) (for the `While` operator) and in GitHub commit [c6173f5fe66cdbab74f4f869311fe6aae2ba35f4](https://github.com/tensorflow/tensorflow/commit/c6173f5fe66cdbab74f4f869311fe6aae2ba35f4) (in general).
    
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-8fxc-qm65-vpxg
Summary: Temporary urls leaked via logging
Aliases: CVE-2017-8761
Severity: LOW
CVSS score: 0
CWE: CWE-200, CWE-117
Published: 2021-06-08T19:23:22Z

In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.
Vulnerability: GHSA-77q4-m83q-w76v
Summary: Missing Origin Validation in browserify-hmr
Aliases: CVE-2018-14730
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2020-09-01T21:18:20Z

Versions of `browserify-hmr` prior to 0.4.0 are missing origin validation on the websocket server. 

This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation

Upgrade to version 0.4.0 or later.
Vulnerability: GHSA-4hvv-7x94-7vq8
Summary: Null dereference in Grappler's `TrySimplify`
Aliases: CVE-2021-29616
Severity: LOW
CVSS score: 2.5
CWE: CWE-476
Published: 2021-05-21T14:28:47Z

### Impact
The implementation of [`TrySimplify`](https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmetic_optimizer.cc#L390-L401) has undefined behavior due to dereferencing a null pointer in corner cases that
result in optimizing a node with no inputs.

### Patches
We have patched the issue in GitHub commit [e6340f0665d53716ef3197ada88936c2a5f7a2d3](https://github.com/tensorflow/tensorflow/commit/e6340f0665d53716ef3197ada88936c2a5f7a2d3).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-vc5p-j8vw-mc6x
Summary: Permissions bypass in pleaser
Aliases: CVE-2021-31155
Severity: HIGH
CVSS score: 7.8
CWE: CWE-279, CWE-269
Published: 2021-08-25T21:01:47Z

Failure to normalize the umask in pleaser before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at least one command.
Vulnerability: GHSA-rpq8-mmwh-q9hm
Summary: Directory traversal in Eclipse Mojarra
Aliases: CVE-2020-6950
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-09-01T18:23:58Z

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
Vulnerability: GHSA-97x5-cc53-cv4v
Summary: Cross site scripting in froala-editor
Aliases: CVE-2020-22864
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-28T23:14:06Z

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.
Vulnerability: GHSA-4859-gpc7-4j66
Summary: Command Injection in dot
Severity: MODERATE
CVSS score: 0
CWE: CWE-77
Published: 2019-06-05T21:24:29Z

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
Vulnerability: GHSA-x79j-wgqv-g8h2
Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
Aliases: CVE-2021-21358
Severity: MODERATE
CVSS score: 5
CWE: CWE-79
Published: 2021-03-23T01:54:06Z


### Problem
It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 10.4.14 or 11.1.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-004](https://typo3.org/security/advisory/typo3-core-sa-2021-004)
Vulnerability: GHSA-876r-hj45-fw7g
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T21:18:41Z

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system.


## Recommendation

The package is not suited to receive arbitrary user input. Consider using an alternative package.
Vulnerability: GHSA-6phf-73q6-gh87
Summary: Insecure Deserialization in Apache Commons Beanutils
Aliases: CVE-2019-10086
Severity: HIGH
CVSS score: 7.3
CWE: CWE-502
Published: 2020-06-15T20:36:17Z

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Vulnerability: GHSA-g89m-3wjw-h857
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-3865
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:37Z

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Vulnerability: GHSA-35m5-8cvj-8783
Summary: Improper hashing in enrocrypt
Aliases: CVE-2021-39182
Severity: HIGH
CVSS score: 7.5
CWE: CWE-327, CWE-916, CWE-328
Published: 2021-11-10T16:28:46Z

### Impact
The vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginner(and doesn't know about hashes)  can face problems as MD5 is considered a Insecure Hashing Algorithm. 

### Patches
The vulnerability is patched in v1.1.4 of the product, the users can upgrade to version 1.1.4.

### Workarounds
If u specifically want a version and don't want to upgrade, you can remove the `MD5` hashing function from the file `hashing.py` and this vulnerability will be gone

### References
https://www.cybersecurity-help.cz/vdb/cwe/916/
https://www.cybersecurity-help.cz/vdb/cwe/327/
https://www.cybersecurity-help.cz/vdb/cwe/328/
https://www.section.io/engineering-education/what-is-md5/
https://www.johndcook.com/blog/2019/01/24/reversing-an-md5-hash/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [**Enrocrypt's Official Repo**](http://www.github.com/Morgan-Phoenix/EnroCrypt)
* Create a Discussion in  [**Enrocrypt's Official Repo**](http://www.github.com/Morgan-Phoenix/EnroCrypt)
Vulnerability: GHSA-3gpc-w23c-w59w
Summary: Sandbox Breakout / Arbitrary Code Execution in pitboss-ng
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-04T15:02:06Z

All versions of `pitboss-ng` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.
  
## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-qfhg-m6r8-xxpj
Summary: Incorrect Authorization in Drupal core
Aliases: CVE-2020-13676
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-863, CWE-284
Published: 2022-02-12T00:00:46Z

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Vulnerability: GHSA-mrhj-2g4v-39qx
Summary: Moderate severity vulnerability that affects rails-html-sanitizer
Severity: MODERATE
CVSS score: 0
Published: 2018-09-17T21:58:19Z

Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
Vulnerability: GHSA-fxqh-cfjm-fp93
Summary: Division by 0 in `Reverse`
Aliases: CVE-2021-29556
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:24:39Z

### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.Reverse`:

```python
import tensorflow as tf

tensor_input = tf.constant([], shape=[0, 1, 1], dtype=tf.int32)
dims = tf.constant([False, True, False], shape=[3], dtype=tf.bool)

tf.raw_ops.Reverse(tensor=tensor_input, dims=dims)
``` 
    
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/36229ea9e9451dac14a8b1f4711c435a1d84a594/tensorflow/core/kernels/reverse_op.cc#L75-L76) performs a division based on the first dimension of the tensor argument:
    
```cc
const int64 N = input.dim_size(0);
const int64 cost_per_unit = input.NumElements() / N;
```

Since this is controlled by the user, an attacker can trigger a denial of service.

### Patches
We have patched the issue in GitHub commit [4071d8e2f6c45c1955a811fee757ca2adbe462c1](https://github.com/tensorflow/tensorflow/commit/4071d8e2f6c45c1955a811fee757ca2adbe462c1).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-94hh-pjjg-rwmr
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
Aliases: CVE-2021-29444
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-203
Published: 2021-04-19T14:58:49Z

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-xc3p-ff3m-f46v
Summary: Insecure input handling in Flask-Cors
Aliases: CVE-2020-25032
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-06T18:51:48Z

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Vulnerability: GHSA-pp75-xfpw-37g9
Summary: Prototype pollution in grpc and @grpc/grpc-js
Aliases: CVE-2020-7768
Severity: HIGH
CVSS score: 7.5
CWE: CWE-915
Published: 2021-05-10T19:16:14Z

"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."
Vulnerability: GHSA-f599-5m7p-hcpf
Summary: Moderate severity vulnerability that affects grape
Aliases: CVE-2018-3769
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-08-13T20:45:32Z

The grape rubygem suffers from a cross-site scripting (XSS) vulnerability via "format" parameter.
Vulnerability: GHSA-vqcm-7f7f-r539
Summary: brbackup exposes database password to unauthorized users
Aliases: CVE-2014-5004
Severity: HIGH
CVSS score: 7.8
CWE: CWE-200
Published: 2018-03-05T19:32:06Z

lib/brbackup.rb in the brbackup gem 0.1.1 for Ruby places the database password on the mysql command line, which allows local users to obtain sensitive information by listing the process.
Vulnerability: GHSA-vmp5-c5hp-6c65
Summary: Woodpecker allows cross-site scripting (XSS) via build logs
Aliases: CVE-2022-29947
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-04-30T00:00:33Z

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
Vulnerability: GHSA-f7qw-5pvg-mmwp
Summary: Prototype Pollution in lutils-merge
Severity: MODERATE
CVSS score: 7.3
CWE: CWE-400
Published: 2019-06-13T18:58:44Z

All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

The package is deprecated and no fixes are available. Consider using an alternative package.
Vulnerability: GHSA-wqvq-5m8c-6g24
Summary: CRLF injection
Aliases: CVE-2020-26137
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-74
Published: 2021-06-18T18:46:43Z

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.
Vulnerability: GHSA-r4x2-3cq5-hqvp
Summary: The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
Aliases: CVE-2018-8014
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1188
Published: 2018-10-17T16:32:32Z

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Vulnerability: GHSA-f6f2-3w33-54r9
Summary: Use After Free in rusqlite
Aliases: CVE-2021-45714
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:02:36Z

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_aggregate_function has a use-after-free.
Vulnerability: GHSA-f865-m6cq-j9vx
Summary: ReDOS in Mpmath
Aliases: CVE-2021-29063
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2021-08-09T20:44:51Z

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 when the mpmathify function is called.
Vulnerability: GHSA-26gr-cvq3-qxgf
Summary: Improper Authentication in Apache Shiro
Aliases: CVE-2020-1957
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-05-07T15:53:18Z

Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Vulnerability: GHSA-f768-8pvq-mm6r
Summary: Business Logic Errors in dolibarr/dolibarr
Aliases: CVE-2022-0414
Severity: MODERATE
CVSS score: 4.3
Published: 2022-02-01T22:01:47Z

Dolibarr 14.0.5 and prior versions are vulnerable to Business Logic Errors.
Vulnerability: GHSA-562c-5r94-xh97
Summary: The Pallets Project in flask that can result in large amount of memory usage
Aliases: CVE-2018-1000656
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-08-23T19:10:40Z

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.
Vulnerability: GHSA-362x-34h3-h6h6
Summary: Downloads Resources over HTTP in box2d-native
Aliases: CVE-2016-10617
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:56:48Z

Affected versions of `box2d-native` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `box2d-native`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-h6mq-3cj6-h738
Summary: Reverse Tabnabbing in showdown
Severity: LOW
CVSS score: 3.1
CWE: CWE-1022
Published: 2020-09-03T23:21:16Z

Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.


## Recommendation

Upgrade to version 1.9.1 or later.
Vulnerability: GHSA-7qm6-9v49-38m9
Summary: Prototype Pollution in record-like-deep-assign
Aliases: CVE-2021-23402
Severity: HIGH
CVSS score: 7.3
CWE: CWE-1321, CWE-915
Published: 2021-12-10T18:55:39Z

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
Vulnerability: GHSA-hgjr-632x-qpp3
Summary: Cross-site scripting vulnerability in file upload
Aliases: CVE-2021-39136
Severity: HIGH
CVSS score: 8.7
CWE: CWE-79
Published: 2021-08-30T16:18:59Z

There is a cross-site scripting vulnerability in file upload on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

### Target
baserCMS 4.5.1 and earlier versions

### Vulnerability
Execution of malicious JavaScript code may alter the display of the page or leak cookie information.

### Countermeasures
Update to the latest version of baserCMS

Please refer to the next page for details.
https://basercms.net/security/JVN_14134801
Vulnerability: GHSA-jm35-h8q2-73mp
Summary: Improper one time password handling in devise-two-factor
Aliases: CVE-2021-43177
Severity: MODERATE
CVSS score: 5.3
Published: 2022-04-07T22:09:03Z

### Impact
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.
 
### Patches
This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.

### Credit for discovery
Benoit Côté-Jodoin
Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106
Vulnerability: GHSA-2473-9hgq-j7xw
Summary: Cross-Site Scripting in Wagtail
Aliases: CVE-2020-15118
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-79
Published: 2020-07-20T17:50:30Z

### Impact
When a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as `form.as_p` ([as directed in the documentation](https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage)), any HTML tags used within a form field's help text will be rendered unescaped in the page. Allowing HTML within help text is [an intentional design decision](https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text) by Django; however, as a matter of policy Wagtail does not allow editors to insert arbitrary HTML by default, as this could potentially be used to carry out cross-site scripting attacks, including privilege escalation. This functionality should therefore not have been made available to editor-level users.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

### Patches
Patched versions have been released as Wagtail 2.7.4 (for the LTS 2.7 branch) and Wagtail 2.9.3 (for the current 2.9 branch). In these versions, help text will be escaped to prevent the inclusion of HTML tags. Site owners who wish to re-enable the use of HTML within help text (and are willing to accept the risk of this being exploited by editors) may set `WAGTAILFORMS_HELP_TEXT_ALLOW_HTML = True` in their configuration settings.

### Workarounds
Site owners who are unable to upgrade to the new versions can secure their form page templates by [rendering forms field-by-field as per Django's documentation](https://docs.djangoproject.com/en/3.0/topics/forms/#looping-over-the-form-s-fields), but omitting the `|safe` filter when outputting the help text.

### Acknowledgements
Many thanks to Timothy Bautista for reporting this issue.

### For more information
If you have any questions or comments about this advisory:
* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at [security@wagtail.io](mailto:security@wagtail.io) (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)
Vulnerability: GHSA-9j9m-8wjc-ff96
Summary:  Insufficient Session Expiration in apostrophe
Aliases: CVE-2021-25979
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-613
Published: 2021-11-10T17:02:44Z

Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions.
Vulnerability: GHSA-x9j7-x98r-r4w2
Summary: Segmentation fault in tensorflow-lite
Aliases: CVE-2020-15210
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20, CWE-787
Published: 2020-09-25T18:28:51Z

### Impact
If a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption.

### Patches
We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that no operator reuses tensors as both inputs and outputs. Care should be taken to check all types of inputs (i.e., constant or variable tensors as well as optional tensors).

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered from a variant analysis of [GHSA-cvpc-8phh-8f45](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cvpc-8phh-8f45).
Vulnerability: GHSA-8vh8-vc28-m2hf
Summary: Potential to access user credentials from the log files when debug logging enabled
Aliases: CVE-2019-10212
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-532
Published: 2019-11-20T01:33:54Z

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
Vulnerability: GHSA-rcv7-4w2m-gj9v
Summary: Malicious Package in sj-tw-test-security
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:24:26Z

All versions of `sj-tw-test-security` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4pm3-f52j-8ggh
Summary: Improper Input Validation in GeoServer
Aliases: CVE-2022-24847
Severity: HIGH
CVSS score: 7.2
CWE: CWE-20
Published: 2022-04-22T20:39:10Z

### Impact
The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism.
In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API.

### Patches
The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 2.19.6.

### Workarounds
Protection can be achieved by making the GUI (``geoserver/web``), the REST configuration (``geoserver/rest``) and the embedded GeoWebCache configuration (``geoserver/gwc/rest``) unreachable from remote hosts, in addition to protecting access to the file system where the GeoServer configuration is stored.
Vulnerability: GHSA-8f4m-hccc-8qph
Summary: Insertion of Sensitive Information into Log File in ansible
Aliases: CVE-2021-20191
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-532
Published: 2021-06-01T21:38:33Z

A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.
Vulnerability: GHSA-jgmr-wrwx-mgfj
Summary: Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA
Aliases: CVE-2019-3797
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-89, CWE-200
Published: 2019-05-14T04:02:35Z

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Vulnerability: GHSA-97mg-3cr6-3x4c
Summary: Remote Code Execution in mongodb-query-parser
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-04T17:27:23Z

Versions of `mongodb-query-parser` prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system.  Parsing the following payload executes `touch test-file`: 

```'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'```



## Recommendation

Upgrade to version 2.0.0 or later.
Vulnerability: GHSA-jf55-rgpx-p6rx
Summary: Malicious Package in iie-viz
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:12:22Z

Version 1.0.4 of `iie-viz` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-mc84-pj99-q6hh
Summary: Improper Handling of Length Parameter Inconsistency in Compress
Aliases: CVE-2021-36090
Severity: HIGH
CVSS score: 7.5
CWE: CWE-130
Published: 2021-08-02T16:55:53Z

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Vulnerability: GHSA-qwwr-qc2p-6283
Summary: Out-of-bounds write in libpng
Aliases: CVE-2018-14550
Severity: HIGH
CVSS score: 8.8
CWE: CWE-787
Published: 2021-03-22T16:57:07Z

An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c in pnm2png.
Vulnerability: GHSA-hfmf-q43v-2ffj
Summary: Improper Key Verification in openpgp
Aliases: CVE-2019-9154
Severity: HIGH
CVSS score: 7.5
CWE: CWE-347
Published: 2019-08-23T21:42:18Z

Versions of `openpgp` prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The `openpgp` package does not verify whether a subpacket is hashed. Furthermore, due to the order of parsing a signature packet information from unhashed subpackets overwrites information from hashed subpackets. This may allow an attacker to modify the contents of a key certification signature or revocation signature. Doing so could convince a victim to use an obsolete key for encryption. An attack require a victim to import a manipulated key or update an existing key with a manipulated version.


## Recommendation

Upgrade to version 4.2.0 or later. 
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Vulnerability: GHSA-mc9x-v9xg-25pm
Summary: Exfiltrates data on installation in coffescript
Aliases: CVE-2017-16205
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-08-06T20:12:54Z

The `coffescript` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.



## Recommendation

If you have found `coffescript` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-3j7m-hmh3-9jmp
Summary: Cross-Site Scripting in sanitize-html
Aliases: CVE-2016-1000237
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-04-16T03:14:47Z

Affected versions of `sanitize-html` do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript.


## Recommendation

Update to version 1.4.3 or later.
Vulnerability: GHSA-3358-4f7f-p4j4
Summary: Use after free in generic-array
Aliases: CVE-2020-36465
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2021-08-25T20:56:12Z

An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes.
Vulnerability: GHSA-9cq5-xgg4-x477
Summary: SQL Injection in showdoc
Aliases: CVE-2022-0362
Severity: MODERATE
CVSS score: 6.7
CWE: CWE-89
Published: 2022-01-27T00:01:15Z

Showdoc verions 2.10.2 and prior is vulnerable to SQL injection. A patch is available in the `master` branch of the repository.
Vulnerability: GHSA-3f5c-4qxj-vmpf
Summary: High severity vulnerability that affects next
Aliases: CVE-2017-16877
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2017-12-05T02:04:14Z

ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
Vulnerability: GHSA-29mw-wpgm-hmr9
Summary: Regular Expression Denial of Service (ReDoS) in lodash
Aliases: CVE-2020-28500
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-01-06T20:30:46Z

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Steps to reproduce (provided by reporter Liyuan Chen): var lo = require('lodash'); function build_blank (n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0) var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1) var time2 = Date.now(); lo.trimEnd(s) var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2)
Vulnerability: GHSA-vvjc-q5vr-52q6
Summary: Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks
Aliases: CVE-2016-8749
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-16T23:13:00Z

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
Vulnerability: GHSA-25mp-g6fv-mqxx
Summary: Unexpected server crash in Next.js.
Aliases: CVE-2021-43803
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-12-07T21:12:09Z

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package `next` hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.
Vulnerability: GHSA-jvfv-hrrc-6q72
Summary: Improper Restriction of XML External Entity Reference in Liquibase
Aliases: CVE-2022-0839
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2022-03-05T00:00:45Z

The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.
Vulnerability: GHSA-fp5r-v3w9-4333
Summary: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
Aliases: CVE-2021-4104
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-14T19:49:31Z

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Vulnerability: GHSA-q3w9-g74q-vp5f
Summary: Denial of Service in express-fileupload
Severity: LOW
CVSS score: 0
Published: 2020-09-03T21:14:12Z

Versions of `express-fileupload` prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed (up to 30s in internal testing) if the request contains a large `filename` of `.` characters.




## Recommendation

Upgrade to version 1.1.6-alpha.6 or later.
Vulnerability: GHSA-w2j5-3rcx-vx7x
Summary: Sysctls applied to containers with host IPC or host network namespaces can affect the host
Severity: MODERATE
CVSS score: 0
Published: 2022-03-15T20:02:54Z

### Impact
Before setting the sysctls for a pod, the pods namespaces must be unshared (created). However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool [pinns](https://github.com/cri-o/cri-o/tree/main/pinns/) to configure the sysctls of the host. This allows a malicious user to set sysctls on the host, assuming they have access to hostNetwork and hostIPC.

Any CRI-O cluster after CRI-O 1.18 that drops the infra container
1.22 and 1.23 clusters drop infra container by default, and are thus vulnerable by default.

### Patches
CRI-O versions 1.24.0, 1.23.1, 1.22.2, 1.21.5, 1.20.6, 1.19.5 all have the patches.

### Workarounds
Users can set `manage_ns_lifecycle` to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.
An admission webhook could also be created to deny pods that use host IPC or network namespaces and also attempt to configure sysctls related to that namespace.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)
* To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).
Vulnerability: GHSA-hjm9-576q-399p
Summary: Moderate severity vulnerability that affects org.esigate:esigate-core
Aliases: CVE-2018-1000854
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2018-12-21T17:46:23Z

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.
Vulnerability: GHSA-w6j4-3gh2-9f5j
Summary: High severity vulnerability that affects apache-airflow
Aliases: CVE-2019-0229
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2019-04-18T14:27:40Z

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
Vulnerability: GHSA-h39g-q63v-4h9p
Summary: Exposure of sensitive information to an unauthorized actor
Aliases: CVE-2021-33038
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-06-01T21:56:23Z

An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.
Vulnerability: GHSA-cwcp-6c48-fm7m
Summary: Unsafe eval() in summit
Aliases: CVE-2017-16020
Severity: MODERATE
CVSS score: 0
CWE: CWE-94
Published: 2020-09-01T16:39:38Z

Affected versions of `summit` allow attackers to execute arbitrary commands via collection names when using the `PouchDB` driver.



## Recommendation

No direct patch is available at this time.

Currently, the best option to mitigate the issue is to avoid using the `PouchDB` driver, as the package author has abandoned this feature entirely.