TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-wfjh-3hq2-r276
Summary: Malicious Package in node-spdy
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:56:48Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-g45g-g52h-39rg
Summary: Cross-site Scripting in Chartkick
Aliases: CVE-2019-12732
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-79
Published: 2019-06-07T20:56:42Z

The Chartkick gem through 3.1.0 for Ruby allows XSS.
Vulnerability: GHSA-377f-vvrc-9wgg
Summary: Malicious Package in zemen
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:09:07Z

Version 0.0.5 of `zemen` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-vm5j-vqr6-v7v8
Summary: OS Command Injection in pixl-class
Aliases: CVE-2020-7640
Severity: HIGH
CVSS score: 9.8
CWE: CWE-78
Published: 2021-12-10T20:04:56Z

pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization.
Vulnerability: GHSA-gfm8-g3vm-53jh
Summary: Malicious Package in leetlog
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:21:19Z

Versions 0.1.2 and 0.1.3 of `leetlog` contain malicious code. The package adds an arbitrary hardcoded SSH key identified as `hacker@evilmachine` to the system's `authorized_keys`


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-9448-c9wq-jg9v
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Aliases: CVE-2018-11786
Severity: HIGH
CVSS score: 8.8
CWE: CWE-269
Published: 2018-12-21T17:49:33Z

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.
Vulnerability: GHSA-pcgf-qjx2-qv4q
Summary: Out-of-bounds write
Aliases: CVE-2019-1217
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:56:08Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
Vulnerability: GHSA-5x4f-7xgq-r42x
Summary: Object state limitation has no effect
Severity: CRITICAL
CVSS score: 0
CWE: CWE-281
Published: 2022-04-29T15:39:18Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Vulnerability: GHSA-4x5h-cr29-fhp6
Summary: Local file disclosure in PHPMailer
Aliases: CVE-2017-5223
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-200
Published: 2020-03-05T22:09:10Z

An issue was discovered in PHPMailer before 5.2.22. PHPMailer&#39;s `msgHTML` method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to `/`, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.

### Impact
Arbitrary local files can be attached to email messages.

### Patches
Fixed in 5.2.22

### Workarounds
Validate input before using user-supplied file paths.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-5223

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-vmfg-rjjm-rjrj
Summary: Deserialization of Untrusted Data
Aliases: CVE-2017-5929
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2021-06-07T16:07:36Z

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access allow data to be deserialized over a Java Socket, via an ObjectInputStream, without validating the data beforehand. When data is received from the Socket, to be logged, it is deserialized into Java objects.An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the Socket, which may result in execution of arbitrary code when those objects are deserialized. Note that although logback-core is implicated by the Logback project here, the Sonatype Security Research team discovered that the vulnerability is actually present in the logback-classic and logback-access components. Versions prior to 1.2.0 are vulnerable, as stated in the advisory.
Vulnerability: GHSA-q8xg-8xwf-m598
Summary: Machine-In-The-Middle in lix
Aliases: CVE-2020-10800
Severity: HIGH
CVSS score: 8.1
CWE: CWE-639, CWE-544
Published: 2020-04-16T03:14:59Z

All versions of `lix` are vulnerable to Machine-In-The-Middle. The package accepts downloads with `http` and follows `location` header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-hhr9-7xvh-8xgc
Summary: Server side request forgery in LiveHelperChat
Aliases: CVE-2022-1213
Severity: HIGH
CVSS score: 7.7
CWE: CWE-918
Published: 2022-04-06T00:01:32Z

SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
Vulnerability: GHSA-58v4-qwx5-7f59
Summary: SQL Injection in knex
Aliases: CVE-2019-10757
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-10-21T16:12:13Z

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
Vulnerability: GHSA-xrcv-f9gm-v42c
Summary: Out-of-bounds Read in Pillow
Aliases: CVE-2022-22816
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-125
Published: 2022-01-12T20:07:41Z

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
Vulnerability: GHSA-8rm6-75mf-7r7r
Summary: Division by zero in TFLite's implementation of hashtable lookup
Aliases: CVE-2021-29604
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:28:19Z

### Impact
The TFLite implementation of hashtable lookup is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/1a8e885b864c818198a5b2c0cbbeca5a1e833bc8/tensorflow/lite/kernels/hashtable_lookup.cc#L114-L115):

```cc
const int num_rows = SizeOfDimension(value, 0); 
const int row_bytes = value->bytes / num_rows; 
```

An attacker can craft a model such that `values`'s first dimension would be 0.

### Patches
We have patched the issue in GitHub commit [5117e0851348065ed59c991562c0ec80d9193db2](https://github.com/tensorflow/tensorflow/commit/5117e0851348065ed59c991562c0ec80d9193db2).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-r3gq-wxqf-q4gh
Summary: Cross-site Scripting in Gitea
Aliases: CVE-2021-45329
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T00:00:32Z

Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
Vulnerability: GHSA-gvm4-h8j3-rjrq
Summary: CHECK-fail in `LoadAndRemapMatrix`
Aliases: CVE-2021-29561
Severity: LOW
CVSS score: 2.5
CWE: CWE-617
Published: 2021-05-21T14:24:59Z

### Impact
An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from `tf.raw_ops.LoadAndRemapMatrix`:
    
```python
import tensorflow as tf

ckpt_path = tf.constant([], shape=[0], dtype=tf.string)
old_tensor_name = tf.constant("")
row_remapping = tf.constant([], shape=[0], dtype=tf.int64)
col_remapping = tf.constant([1], shape=[1], dtype=tf.int64)
initializing_values = tf.constant(1.0)

tf.raw_ops.LoadAndRemapMatrix(
    ckpt_path=ckpt_path, old_tensor_name=old_tensor_name,
    row_remapping=row_remapping, col_remapping=col_remapping,
    initializing_values=initializing_values, num_rows=0, num_cols=1)
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/d94227d43aa125ad8b54115c03cece54f6a1977b/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L219-L222) assumes that the `ckpt_path` is always a valid scalar.
  
```cc
const string& ckpt_path = ckpt_path_t->scalar<tstring>()();
```

However, an attacker can send any other tensor as the first argument of `LoadAndRemapMatrix`. This would cause the rank `CHECK` in `scalar<T>()()` to trigger and terminate the process.

### Patches
We have patched the issue in GitHub commit [77dd114513d7796e1e2b8aece214a380af26fbf4](https://github.com/tensorflow/tensorflow/commit/77dd114513d7796e1e2b8aece214a380af26fbf4).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-8hc4-xxm3-5ppp
Summary: Regular Expression Denial-of-Service
Aliases: CVE-2021-22880
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-02T03:44:14Z

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Vulnerability: GHSA-cxx2-fp39-rf3r
Summary: Cross-Site Scripting in JSPWiki
Aliases: CVE-2019-10076
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-06-06T15:29:22Z

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Vulnerability: GHSA-773q-5334-5gf9
Summary: Memory over-allocation in evm-core
Severity: MODERATE
CVSS score: 0
CWE: CWE-789
Published: 2021-08-25T20:55:36Z

Prior to the patch, when executing specific EVM opcodes related
to memory operations that use `evm_core::Memory::copy_large`, the
crate can over-allocate memory when it is not needed, making it
possible for an attacker to perform denial-of-service attack.

The flaw was corrected in commit `19ade85`.
Vulnerability: GHSA-2h3h-q99f-3fhc
Summary: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
Aliases: CVE-2021-39134
Severity: MODERATE
CVSS score: 8.2
CWE: CWE-61, CWE-59
Published: 2021-08-31T16:04:03Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.

This is, in part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies with a specific name, and nesting folders to resolve conflicting dependencies.

When multiple dependencies differ only in the case of their name, Arborist's internal data structure saw them as separate items that could coexist within the same level in the `node_modules` hierarchy.  However, on case-insensitive file systems (such as macOS and Windows), this is not the case.  Combined with a symlink dependency such as `file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be written to any location on the filesystem.

For example, a package `pwn-a` could define a dependency in their `package.json` file such as `"foo": "file:/some/path"`.  Another package, `pwn-b` could define a dependency such as `FOO: "file:foo.tgz"`.  On case-insensitive file systems, if `pwn-a` was installed, and then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any existing contents of `/some/path` would be removed.

Anyone using npm v7.20.6 or earlier on a case-insensitive filesystem is potentially affected.

### Patches

2.8.2 (included in npm v7.20.7 and above)

### Fix and Caveats

There are two parts to the fix:

1. Immediately prior to extraction, if the target folder is not a directory, it is moved aside.  (If the installation fails, filesystem entries moved aside in this manner are moved back as part of the rollback process.)
2. The `children` map that represents child nodes in the tree is replaced with a case-insensitive map object, such that `node.children.get('foo')` and `node.children.get('FOO')` will return the same object, enabling Arborist to detect and handle this class of tree collision.

This second item imposes a caveat on case _sensitive_ filesystems where two packages with names which differ only in case may already exist at the same level in the tree, causing unpredictable behavior in this rare edge case.  Note that in such cases, the `package-lock.json` already creates a situation which is hazardous to use on case-sensitive filesystems, and will likely lead to other problems.

If affected by this caveat, please run `npm update` to rebuild your tree and generate a new `package-lock.json` file.
Vulnerability: GHSA-m7mf-vm62-7x3q
Summary: Insecure template handling in haml-coffee
Aliases: CVE-2021-32818
Severity: HIGH
CVSS score: 7.7
CWE: CWE-79
Published: 2021-05-17T20:58:21Z

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user controlled request objects to the haml-coffee template engine may introduce RCE vulnerabilities. Additionally control over the escapeHtml parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs that may result in reflected Cross Site Scripting attacks against downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of haml-coffee is currently 1.14.1. For complete details refer to the referenced GHSL-2021-025.
Vulnerability: GHSA-wh37-37xw-54hr
Summary: Improper Authentication in requests-kerberos
Aliases: CVE-2014-8650
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2020-03-10T18:02:31Z

python-requests-Kerberos through 0.5 does not handle mutual authentication
Vulnerability: GHSA-72w9-fcj5-3fcg
Summary: Improper Authentication in Apache Shiro
Aliases: CVE-2020-11989
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-05-07T15:53:10Z

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Vulnerability: GHSA-q42p-pg8m-cqh6
Summary: Prototype Pollution in handlebars
Severity: HIGH
CVSS score: 7.3
CWE: CWE-471
Published: 2019-06-05T14:07:48Z

Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.


## Recommendation

For handlebars 4.1.x upgrade to 4.1.2 or later.
For handlebars 4.0.x upgrade to 4.0.14 or later.
Vulnerability: GHSA-6pq3-928q-x6w6
Summary: Prototype Pollution
Aliases: CVE-2020-8147
Severity: HIGH
CVSS score: 0
CWE: CWE-471
Published: 2020-09-03T15:51:28Z

All versions of `utils-extend` are vulnerable to prototype pollution. The `extend` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-w32g-5hqp-gg6q
Summary: Cross-Site Scripting in mermaid
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T15:41:41Z

Versions of `mermaid` prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input  such as `A["<img src=invalid onerror=alert('XSS')></img>"] ` is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding.


## Recommendation

Upgrade to version 8.2.3 or later
Vulnerability: GHSA-q8wc-9xvp-g3c3
Summary: Cross-site scripting in Sakai
Aliases: CVE-2019-16148
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-09-23T18:33:18Z

Sakai through 12.6 allows XSS via a chat user name.
Vulnerability: GHSA-pc7q-c837-3wjq
Summary: Malicious Package in wallet-address-validtaor
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:02:58Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-8695-fr6h-9fq8
Summary: Command Injection in nuance-gulp-build-common
Aliases: CVE-2020-28430
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77, CWE-78
Published: 2021-04-13T15:19:23Z

All versions of package nuance-gulp-build-common are vulnerable to Command Injection via the index.js file. PoC: /var a = require("nuance-gulp-build-common") a.run("touch JHU")
Vulnerability: GHSA-26cm-qrc6-mfgj
Summary: Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker
Aliases: CVE-2021-41232
Severity: HIGH
CVSS score: 8.1
CWE: CWE-74, CWE-90
Published: 2021-11-08T18:16:21Z

### Impact
LDAP injection vulnerability, only affects instances with LDAP authentication enabled.

### Patches
Patch for vulnerability released with v1.16.3.

### Workarounds
Disable LDAP feature if in use

### References
[OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Thunderdome Github Repository](https://github.com/StevenWeathers/thunderdome-planning-poker)
* Email us at [steven@weathers.me](mailto:steven@weathers.me)
Vulnerability: GHSA-2vqv-hp3p-fmv8
Summary: Downloads Resources over HTTP in webdriver-launcher
Aliases: CVE-2016-10651
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:03Z

Affected versions of `webdriver-launcher` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webdriver-launcher`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2011.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-9652-78hp-w58c
Summary: Stored cross-site scripting in PressBooks
Aliases: CVE-2021-3271
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-03-29T20:07:39Z

PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.
Vulnerability: GHSA-65cv-r6x7-79hv
Summary: Possible XSS vulnerability in ActionView
Aliases: CVE-2020-5267
Severity: MODERATE
CVSS score: 4
CWE: CWE-80
Published: 2020-03-19T17:30:29Z

There is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers.  Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.

### Impact

There is a possible XSS vulnerability in the `j` and `escape_javascript` methods in ActionView.  These methods are used for escaping JavaScript string literals.  Impacted code will look something like this:

```erb
<script>let a = `<%= j unknown_input %>`</script>
```

or

```erb
<script>let a = `<%= escape_javascript unknown_input %>`</script>
```

### Releases

The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.

### Workarounds

For those that can't upgrade, the following monkey patch may be used:

```ruby
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
  {
    "`" => "\\`",
    "$" => "\\$"
  }
)

module ActionView::Helpers::JavaScriptHelper
  alias :old_ej :escape_javascript
  alias :old_j :j

  def escape_javascript(javascript)
    javascript = javascript.to_s
    if javascript.empty?
      result = ""
    else
      result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
    end
    javascript.html_safe? ? result.html_safe : result
  end

  alias :j :escape_javascript
end
```

### Patches

To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.

* [5-2-js-helper-xss.patch](https://gist.github.com/tenderlove/c042ff49f0347c37e99183a6502accc6#file-5-2-js-helper-xss-patch) - Patch for 5.2 series
* [6-0-js-helper-xss.patch](https://gist.github.com/tenderlove/c042ff49f0347c37e99183a6502accc6#file-6-0-js-helper-xss-patch) - Patch for 6.0 series

Please note that only the 5.2 and 6.0 series are supported at present. Users
of earlier unsupported releases are advised to upgrade as soon as possible as we
cannot guarantee the continued availability of security fixes for unsupported
releases.

### Credits

Thanks to Jesse Campos from Chef Secure
Vulnerability: GHSA-9xv2-548x-5h79
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7648
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2020-06-03T22:02:19Z

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
Vulnerability: GHSA-v2r9-c84j-v7xm
Summary: Moderate severity vulnerability that affects rdoc
Aliases: CVE-2013-0256
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Vulnerability: GHSA-w4vp-3mq7-7v82
Summary: Cross-Site Scripting in lazysizes
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-03T15:49:48Z

Versions of `lazysizes` prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting.  The `video-embed` plugin fails to sanitize the following attributes: data-vimeo, `data-vimeoparams`, `data-youtube` and `data-ytparams`. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes.


## Recommendation

Upgrade to version 5.2.1-rc1 or later.
Vulnerability: GHSA-gfx6-ph4q-q54q
Summary: Moderate severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
Aliases: CVE-2017-1000118
Severity: HIGH
CVSS score: 7.5
CWE: CWE-119
Published: 2018-10-22T20:53:02Z

Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
Vulnerability: GHSA-r28h-x6hv-2fq3
Summary: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Aliases: CVE-2021-43570
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2021-11-10T20:48:00Z

The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Vulnerability: GHSA-6qcc-whgp-pjj2
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0832
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
Vulnerability: GHSA-3w73-fmf3-hg5c
Summary: Policies not properly enforced in OWASP Java HTML Sanitizer
Aliases: CVE-2021-42575
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2021-10-19T20:15:50Z

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the `SELECT`, `STYLE`, and `OPTION` elements.
Vulnerability: GHSA-8wp2-vxpg-xcvp
Summary: Cross site scripting in facturascripts
Aliases: CVE-2022-1457
Severity: CRITICAL
CVSS score: 9
CWE: CWE-79
Published: 2022-04-26T00:00:43Z

facturasripts is an open source ERP software. Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Vulnerability: GHSA-2rq5-68hm-h4j8
Summary: Cross-Site Request Forgery in OpenNMS Horizon
Aliases: CVE-2021-25931
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-05-25T18:46:55Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
Vulnerability: GHSA-cc94-3v9c-7rm8
Summary: Apache ActiveMQ webconsole admin GUI is open to XSS
Aliases: CVE-2020-1941
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-05-21T21:08:56Z

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
Vulnerability: GHSA-8qvx-f5gf-g43v
Summary: Logic error in dolibarr
Aliases: CVE-2022-0174
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-20
Published: 2022-01-12T22:54:50Z

The application does not check the input of price number lead to Business Logic error through negative price amount.
Vulnerability: GHSA-g4xj-wcq6-qwx5
Summary: Code injection in mock2easy
Aliases: CVE-2020-7697
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-05-06T18:25:58Z

This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType);
Vulnerability: GHSA-mpp5-2x55-49xw
Summary: XSS in svg2png (NPM package)
Aliases: CVE-2020-11887
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-06T19:45:13Z

svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
Vulnerability: GHSA-jmqm-f2gx-4fjv
Summary: Sensitive information exposure through logs in npm-registry-fetch
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-352
Published: 2020-07-07T18:59:10Z

Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.
Vulnerability: GHSA-w3w8-37jv-2c58
Summary: Cross-Site Scripting in mustache
Aliases: CVE-2015-8862
Severity: HIGH
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Versions of `mustache` prior to 2.2.1 are affected by a cross-site scripting vulnerability when attributes in mustache templates are not quoted.



### Example
Template:
```<a href={{foo}}/>```

Input:
```{ 'foo' : 'test.com onload=alert(1)'}```

Rendered result:
```<a href=test.com onload=alert(1)/>```


## Recommendation

Update to version 2.2.1 or later.
Alternatively, ensure that all attributes in hmustache templates are encapsulated with quotes.
Vulnerability: GHSA-pqpp-2363-649v
Summary: Cross-Site Scripting in buttle
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T18:22:30Z

All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-8p9r-f949-699g
Summary: Path Traversal in browserless-chrome
Aliases: CVE-2020-7758
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-05-10T18:46:48Z

This affects all versions of browserless-chrome before 1.43.0. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.
Vulnerability: GHSA-4h9c-v5vg-5m6m
Summary: Access to restricted PHP code by dynamic static class access in smarty
Aliases: CVE-2021-21408
Severity: HIGH
CVSS score: 8.8
CWE: CWE-20
Published: 2022-01-12T22:43:42Z

### Impact
Template authors could run restricted static php methods.

### Patches
Please upgrade to 3.1.40 or higher.

### References
See the [documentation on Smarty security features](https://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security) on the static_classes access filter.

### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Vulnerability: GHSA-p737-p57g-4cpr
Summary: Insertion of Sensitive Information into Log File in Jupyter notebook
Aliases: CVE-2022-24757
Severity: HIGH
CVSS score: 7.5
CWE: CWE-532
Published: 2022-03-25T19:20:39Z

### Impact
_What kind of vulnerability is it?_

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Upgrade to Jupyter Server version 1.15.4

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: @3coins for reporting. Thank you!
Vulnerability: GHSA-jwcc-j78w-j73w
Summary: High severity vulnerability that affects ansible
Aliases: CVE-2018-10855
Severity: HIGH
CVSS score: 5.9
CWE: CWE-532
Published: 2018-10-10T17:23:20Z

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.
Vulnerability: GHSA-xqqr-p362-6rmc
Summary: Directory Traversal in hostr
Aliases: CVE-2017-16029
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2018-11-09T17:44:20Z

Affected versions of `hostr` are vulnerable to directory traversal which allows attackers to read files outside the current directory by sending `../` in the url path for GET requests.


## Recommendation

Upgrade to version 2.3.6 or later.
Vulnerability: GHSA-4gq5-ch57-c2mg
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14719
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-01-04T19:09:49Z

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Vulnerability: GHSA-fxph-q3j8-mv87
Summary: Deserialization of Untrusted Data in Log4j
Aliases: CVE-2017-5645
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-01-06T18:43:38Z

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Vulnerability: GHSA-j4mm-7pj3-jf7v
Summary: HTTP Method Spoofing
Aliases: CVE-2021-43807
Severity: HIGH
CVSS score: 7.5
CWE: CWE-290
Published: 2021-12-14T21:43:00Z

Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows  attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible.

### Impact

The vulnerability allows attackers to craft links or forms which may change the server state. For example, the following GET request would create a new user:

```sh
% curl -i -u admin:opencast \
  'https://legacy.opencast.org/admin-ng/users/test.json?_method=PUT&username=test&password=attack'
HTTP/2 200
…
```

If an admin is logged in to legacy.opencast.org and accidentally clicks this link, a user will silently be created.


### Patches

This issue is fixed in Opencast 9.10 and 10.0.

### Workarounds

You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.

### References

- [Fix for 10.0](https://github.com/opencast/opencast/commit/59cb6731067283e54f15462be38b6117d8b9ea8b#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8)
- [Fix for 9.10](https://github.com/opencast/opencast/commit/8f8271e1085f6f8e306c689d6a56b0bb8d076444)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
Vulnerability: GHSA-h5f5-rj4r-42f6
Summary: Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication
Aliases: CVE-2018-18389
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2018-10-17T17:31:26Z

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.
Vulnerability: GHSA-6c8f-qphg-qjgp
Summary: Validation Bypass in kind-of
Aliases: CVE-2019-20149
Severity: HIGH
CVSS score: 7.5
CWE: CWE-668
Published: 2020-03-31T15:59:54Z

Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. 


## Recommendation

Upgrade to versions 6.0.3 or later.
Vulnerability: GHSA-c7v4-m269-4995
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Moodle
Aliases: CVE-2020-25703
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200
Published: 2021-10-21T17:49:08Z

The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
Vulnerability: GHSA-3mvg-rrrw-m7ph
Summary: Ability to change order address without triggering address validations in solidus
Aliases: CVE-2020-15109
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-862, CWE-20
Published: 2020-08-04T22:17:57Z

### Impact

This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment.

All stores with at least two shipping zones and different costs of shipment per zone are impacted. 

E.g.
1. Store admin configured the store so that there are two zones in US:
-  East Cost Zone - Shipping Method cost: $1
- West Cost Zone - Shipping Method cost: $10

The attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout.

2. The attacker user enters any NY shipping address in the address step
3. The attacker user chooses the $1 delivery option
4. The attacker user crafts a request with their real LA address, similar to:

```
// POST #checkout/update:

{
  state: 'payment',
  order: {
    ship_address_attributes: {
      city: 'Los Angeles',
      ...
    }
  }
}
```
5. The attacker user proceeds with checking out with a new address and the $1 shipment costs.

Another scenario where this could be dangerous is:

> You cannot ship products in some zones and you are relying on Solidus Shipping Method building only to filter out unwanted zones. Malicious users can enter an allowed zone's address and change back to an unwanted one in the payment step by crafting a request with some proper ship_address_attributes.

This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted.

### Patches

A PR has been attached to fix the security concern for each of all the Solidus supported versions following the rules of the [Solidus Security Policy](https://solidus.io/security).

### Workarounds

When it's not possible to upgrade to a supported patched version, please use this gist to patch the store:

https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d
Vulnerability: GHSA-92v7-pq4h-58j5
Summary: Moderate severity vulnerability that affects facter, hiera, mcollective-client, and puppet
Aliases: CVE-2014-3248
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:36Z

Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.
Vulnerability: GHSA-rqjw-p5vr-c695
Summary: Basic-auth app bundle credential exposure in gatsby-source-wordpress
Aliases: CVE-2021-32770
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-522
Published: 2021-07-19T15:21:41Z

### Impact
The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time.  Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected.

Example affected gatsby-config.js:
```
      resolve: 'gatsby-source-wordpress',
        auth: {
          htaccess: {
            username: leaked_username
            password: leaked_password,
          },
        },
```

### Patches
A patch has been introduced in gatsby-source-wordpress@4.0.8 and gatsby-source-wordpress@5.9.2 which mitigates the issue by filtering all variables specified in the `auth: { }` section.  Users that depend on this functionality are advised to upgrade to the latest release of gatsby-source-wordpress, run `gatsby clean` followed by a `gatsby build`.


### Workarounds
There is no known workaround at this time, other than manually editing the app.js file post-build.


### For more information
Email us at [security@gatsbyjs.com](mailto:security@gatsbyjs.com)
Vulnerability: GHSA-6f93-xj8r-jp82
Summary: Malicious Package in bunfer-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:28:21Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-3hq4-f2v6-q338
Summary: Kotti has demonstrated permission change via document view
Aliases: CVE-2018-9856
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2018-07-12T20:30:30Z

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@@share request.
Vulnerability: GHSA-q2qr-3c2p-9235
Summary: Denial of Service (DoS) in HashiCorp Consul
Aliases: CVE-2020-12758
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2022-02-15T01:57:18Z

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.
Vulnerability: GHSA-5h9g-x5rv-25wg
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-22T16:24:02Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the schema validation logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or editor APIs. This malicious content could then end up in content published outside the editor, if no server-side sanitization was performed. This impacts all users who are using TinyMCE 5.8.2 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.9.0 by ensuring schema validation was still performed after unwrapping invalid elements.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.9.0 or higher
- Manually sanitize the content using the `BeforeSetContent` event (see below)

#### Example: Manually sanitize content
```js
editor.on('BeforeSetContent', function(e) {
  var sanitizedContent = ...; // Manually sanitize content here
  e.content = sanitizedContent;
});
```

### Acknowledgements
Tiny Technologies would like to thank William Bowling for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
Vulnerability: GHSA-v3xw-c963-f5hc
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11111
Severity: HIGH
CVSS score: 8.8
CWE: CWE-502
Published: 2020-05-15T18:58:50Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
Vulnerability: GHSA-r86j-2gc6-2cq9
Summary: High severity vulnerability that affects org.apache.hbase:hbase-thrift
Aliases: CVE-2018-8025
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362
Published: 2018-10-18T18:05:02Z

An issue in Apache HBase affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.