TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-rcx2-m7jp-p9wj
Summary: Moderate severity vulnerability that affects notebook
Aliases: CVE-2019-10856
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-601
Published: 2019-04-09T19:47:27Z

In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255.
Vulnerability: GHSA-4xjh-m3qx-49wc
Summary: Jekyll allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file
Aliases: CVE-2018-17567
Severity: HIGH
CVSS score: 7.5
CWE: CWE-59
Published: 2018-09-28T19:29:07Z

Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.
Vulnerability: GHSA-hrxv-694f-22g3
Summary: Exposure of Sensitive Information to an Unauthorized Actor in LemMinX
Aliases: CVE-2022-0672
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-200
Published: 2022-02-19T00:01:28Z

A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.
Vulnerability: GHSA-m75h-cghq-c8h5
Summary: Heap Based Buffer Overflow in libyaml
Aliases: CVE-2013-6393
Severity: CRITICAL
CVSS score: 0
CWE: CWE-119
Published: 2020-08-31T22:51:50Z

Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags.





## Recommendation

- Update to version 0.2.3 that includes a version of LibYAML that contains a fix for this issue.
Vulnerability: GHSA-fmvm-x8mv-47mj
Summary: Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0
Aliases: CVE-2022-23646
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-451
Published: 2022-02-17T17:19:18Z

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.

### Impact
- **Affected**: All of the following must be true to be affected
  - Next.js between version 10.0.0 and 12.0.10
  - The `next.config.js` file has [images.domains](https://nextjs.org/docs/api-reference/next/image#domains) array assigned
  - The image host assigned in [images.domains](https://nextjs.org/docs/api-reference/next/image#domains) allows user-provided SVG
- **Not affected**: The `next.config.js` file has [images.loader](https://nextjs.org/docs/api-reference/next/image#loader-configuration) assigned to something other than default

### Patches
[Next.js 12.1.0](https://github.com/vercel/next.js/releases/tag/v12.1.0)

### Workarounds
Change `next.config.js` to use a different [loader configuration](https://nextjs.org/docs/api-reference/next/image#loader-configuration) other than the default, for example:

```js
module.exports = {
  images: {
    loader: 'imgix',
    path: 'https://example.com/myaccount/',
  },
}
```

Or if you want to use the [`loader`](https://nextjs.org/docs/api-reference/next/image#loader) prop on the component, you can use `custom`:
```js
module.exports = {
  images: {
    loader: 'custom',
  },
}
```
Vulnerability: GHSA-674r-xx4c-gj7x
Summary: Malicious Package in sb58
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:04:05Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qc53-44cj-vfvx
Summary: Denial of Service in Tensorflow
Aliases: CVE-2020-15197
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-20, CWE-617
Published: 2020-09-25T18:28:30Z

### Impact
The `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L185

However, malicious users can pass in tensors of different rank, resulting in a `CHECK` assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)
Vulnerability: GHSA-74cp-qw7f-7hpw
Summary: Path Traversal in statics-server
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2019-06-05T14:10:23Z

All versions of `statics-server` are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-cwp9-956f-vcwh
Summary: Out-of-bounds write
Aliases: CVE-2019-1141
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:57:56Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1140, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
Vulnerability: GHSA-xggx-fx6w-v7ch
Summary: Improper Neutralization of Wildcards or Matching Symbols
Aliases: CVE-2019-3802
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-155
Published: 2019-06-04T15:42:15Z

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.
Vulnerability: GHSA-5mg8-w23w-74h3
Summary: Information Disclosure in Guava
Aliases: CVE-2020-8908
Severity: LOW
CVSS score: 3.3
CWE: CWE-200, CWE-173, CWE-732
Published: 2021-03-25T17:04:19Z

A temp directory creation vulnerability exists in all Guava versions allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava `com.google.common.io.Files.createTempDir()`. The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method
Vulnerability: GHSA-xf8c-3cgx-fcwm
Summary: Improper Access Control in novajoin
Aliases: CVE-2019-10138
Severity: HIGH
CVSS score: 8.8
CWE: CWE-284
Published: 2020-03-12T16:54:06Z

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
Vulnerability: GHSA-x8wj-cqmp-3wmm
Summary: Cross-site Scripting in Zenario CMS
Aliases: CVE-2021-41952
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2022-03-15T00:00:59Z

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.
Vulnerability: GHSA-6cw3-g6wv-c2xv
Summary: Infinite Loop in Django
Aliases: CVE-2022-23833
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2022-02-04T00:00:26Z

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Vulnerability: GHSA-37pf-w9ff-gqvm
Summary: Out-of-bounds write
Aliases: CVE-2019-0927
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:58:59Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-h4mf-75hf-67w4
Summary: Information disclosure in parse-server
Aliases: CVE-2020-5251
Severity: HIGH
CVSS score: 7.7
CWE: CWE-200, CWE-285
Published: 2020-03-04T20:20:27Z

1. you can fetch all the users' objects, by using regex in the NoSQL query.
Using the NoSQL, you can use a regex on sessionToken `("_SessionToken":{"$regex":"r:027f"}}` and find valid accounts this way.

Using this method, it's possible to retrieve accounts without interaction from the users.

GET /parse/users/me HTTP/1.1
```
{
  "_ApplicationId": "appName",
  "_JavaScriptKey": "javascriptkey",
  "_ClientVersion": "js2.10.0",
  "_InstallationId": "ca713ee2-6e60-d023-a8fe-14e1bfb2f300",
  "_SessionToken": {
    "$regex": "r:5"
  }
}
```
When trying it with an update query the same thing luckily doesn't seem to work:
POST /parse/classes/_User/PPNk59jPPZ

2. There is another similar vulnerability in verify email and the request password reset.

If you sign up with someone else's email address, you can simply use regex in the token param to verify the account: `http://localhost:1337/parse/apps/kickbox/verify_email?token[$regex]=a&username=some@email.com`

The same thing can be done for reset password: `http://localhost:1337/parse/apps/kickbox/request_password_reset?token[$regex]=a&username=some@email.com`

You may need to do it a few times with a different letter/number, but as long as the tokens contain the character it will succeed.
Vulnerability: GHSA-9x7m-9hpg-xxmw
Summary: Prototype Pollution in putil-merge
Aliases: CVE-2021-25953
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-12-10T17:24:16Z

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-c6f3-3c98-2j2f
Summary: Malicious Package in jquerz
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:39:46Z

Version 1.0.1 of `jquerz` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-94hm-8q65-rmxm
Summary: High severity vulnerability that affects omniauth-saml
Aliases: CVE-2017-11430
Severity: HIGH
CVSS score: 7.7
CWE: CWE-287
Published: 2019-07-05T21:11:43Z

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Vulnerability: GHSA-7gc6-qh9x-w6h8
Summary: Incorrect Authorization in cross-fetch
Aliases: CVE-2022-1365
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-863, CWE-359
Published: 2022-04-17T00:00:32Z

When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty.
Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .
Vulnerability: GHSA-q4v7-4rhw-9hqm
Summary: Code Execution through IIFE in node-serialize
Aliases: CVE-2017-5941
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-07-18T18:27:56Z

Affected versions of `node-serialize` can be abused to execute arbitrary code via an [immediately invoked function expression](https://en.wikipedia.org/wiki/Immediately-invoked_function_expression) (IIFE) if untrusted user input is passed into `unserialize()`.


## Recommendation

There is no direct patch for this issue. The package author has reviewed this advisory, and provided the following recommendation:

```
To avoid the security issues, at least one of the following methods should be taken:

1. Make sure to send serialized strings internally, isolating them from potential hackers. For example, only sending the strings from backend to fronend and always using HTTPS instead of HTTP.

2. Introduce public-key cryptosystems (e.g. RSA) to ensure the strings not being tampered with.
```
Vulnerability: GHSA-gvxv-5fp2-358q
Summary: Incorrect Resource Transfer Between Spheres in eclipse-wtp
Aliases: CVE-2019-10753
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-669
Published: 2019-09-11T23:08:57Z

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
Vulnerability: GHSA-fpff-384j-vxq7
Summary: Data leakage via SQL Injection in Pimcore
Aliases: CVE-2019-10763
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-89
Published: 2019-12-02T18:05:13Z

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.
Vulnerability: GHSA-w64w-qqph-5gxm
Summary: HTTP Smuggling via Transfer-Encoding Header in Puma
Aliases: CVE-2020-11077
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-444
Published: 2020-05-22T14:55:09Z

### Impact
This is a similar but different vulnerability to the one patched in 3.12.5 and 4.3.4.

A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. 

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

The problem has been fixed in Puma 3.12.6 and Puma 4.3.5.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Vulnerability: GHSA-mcxr-fx5f-96qq
Summary: Server-Side Request Forgery in Concrete CMS
Aliases: CVE-2021-22969
Severity: MODERATE
CVSS score: 0
CWE: CWE-918
Published: 2021-11-23T18:18:35Z

Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer.
Vulnerability: GHSA-fv38-4c3m-25v8
Summary: High severity vulnerability that affects Microsoft.ChakraCore
Aliases: CVE-2019-0592
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2019-04-09T19:43:56Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0611.
Vulnerability: GHSA-23vw-mhv5-grv5
Summary: Denial of Service in @hapi/hapi
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:48:43Z

Versions of `@hapi/hapi` prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to versions 18.4.1, 19.1.1 or later.
Vulnerability: GHSA-x27w-qxhg-343v
Summary: Access Restriction Bypass in go-ldap
Aliases: CVE-2017-14623
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287
Published: 2022-02-15T01:57:18Z

In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
Vulnerability: GHSA-hwqc-pgjw-vjqp
Summary: Cross-Site Request Forgery in GilaCMS
Aliases: CVE-2020-20693
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-09-30T17:13:11Z

A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.
Vulnerability: GHSA-9cp3-fh5x-xfcj
Summary: Regular Expression Denial of Service in charset
Aliases: CVE-2017-16098
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2018-08-09T20:55:46Z

Affected versions of `charset` are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.


If node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.


## Recommendation

Update to version 1.0.1 or later.
Vulnerability: GHSA-545q-3fg6-48m7
Summary: Regular expression denial of service (ReDoS)
Aliases: CVE-2021-23346
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-03-18T19:39:31Z

This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
Vulnerability: GHSA-g2qj-pmxm-9f8f
Summary: User enumeration in authentication mechanisms
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2021-05-17T20:52:32Z

Description
-----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.

Resolution
----------

We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011) for branch 3.4.

Credits
-------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Vulnerability: GHSA-9qq2-xhmc-h9qr
Summary: Access Control Bypass
Aliases: CVE-2018-20321
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-288, CWE-668
Published: 2021-06-23T17:57:10Z

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a pod, and then use that pod to execute administrative privileged commands against the k8s cluster. This could be mitigated by isolating the default namespace in a separate project, where only cluster admins can be given permissions to access. As of 2018-12-20, this bug affected ALL clusters created or imported by Rancher.
Vulnerability: GHSA-68q3-7wjp-7q3j
Summary: The filename of uploaded files vulnerable to stored XSS
Aliases: CVE-2020-4041
Severity: MODERATE
CVSS score: 7.4
CWE: CWE-79
Published: 2020-06-09T00:25:34Z

### Impact

The filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. 

Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented.

### Patches

This is fixed in Bolt 3.7.1.

### References

Related issue: https://github.com/bolt/bolt/pull/7853
Vulnerability: GHSA-qhxh-9hhx-6p7v
Summary: Prototype Pollution in GraphHopper
Aliases: CVE-2021-23408
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-1321
Published: 2021-08-02T16:59:35Z

This affects the package `com.graphhopper:graphhopper-web-bundle` before 3.2, from 4.0-pre1 and before 4.0. The URL parser could be tricked into adding or modifying properties of Object.prototype using a constructor or __proto__ payload.
Vulnerability: GHSA-hgpp-pp89-4fgf
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2012-2660
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:38Z

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
Vulnerability: GHSA-82v2-mx6x-wq7q
Summary: Incorrect Default Permissions in log4js
Aliases: CVE-2022-21704
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-276
Published: 2022-01-21T18:53:27Z

### Impact
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.

### Patches
Fixed by:
* https://github.com/log4js-node/log4js-node/pull/1141
* https://github.com/log4js-node/streamroller/pull/87

Released to NPM in log4js@6.4.0

### Workarounds
Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.

### References

Thanks to [ranjit-git](https://www.huntr.dev/users/ranjit-git) for raising the issue, and to @peteriman for fixing the problem.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [logj4s-node](https://github.com/log4js-node/log4js-node)
* Ask a question in the [slack channel](https://join.slack.com/t/log4js-node/shared_invite/enQtODkzMDQ3MzExMDczLWUzZmY0MmI0YWI1ZjFhODY0YjI0YmU1N2U5ZTRkOTYyYzg3MjY5NWI4M2FjZThjYjdiOGM0NjU2NzBmYTJjOGI)
* Email us at [gareth.nomiddlename@gmail.com](mailto:gareth.nomiddlename@gmail.com)
Vulnerability: GHSA-7xc5-ggpp-g249
Summary: Server-Side Template Injection in pwntools
Aliases: CVE-2020-28468
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2021-04-20T16:13:24Z

This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution.
Vulnerability: GHSA-fvx3-g627-phm2
Summary: Moderate severity vulnerability that affects com.ctrip.framework.apollo:apollo
Aliases: CVE-2019-10686
Severity: CRITICAL
CVSS score: 10
CWE: CWE-918
Published: 2019-04-18T14:27:42Z

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
Vulnerability: GHSA-c2h3-6mxw-7mvq
Summary: Insufficiently restricted permissions on plugin directories
Aliases: CVE-2021-41103
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-22
Published: 2021-10-04T20:14:47Z

### Impact
A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.

### Patches
This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability.

### Workarounds
Limit access to the host to trusted users. Update directory permission on container bundles directories. 

### For more information
If you have any questions or comments about this advisory: 
* Open an issue in [github.com/containerd/containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Vulnerability: GHSA-3wvg-mj6g-m9cv
Summary: Uncontrolled Resource Consumption
Aliases: CVE-2021-27922
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-18T19:55:21Z

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
Vulnerability: GHSA-pqrv-8r2f-7278
Summary: Crash due to erroneous `StatusOr` in TensorFlow
Aliases: CVE-2022-23590
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-754
Published: 2022-02-09T23:29:38Z

### Impact
A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering [a `StatusOr` value that is an error and forcibly extracting the value from it](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/graph/graph.cc#L560-L567):

```cc
  if (op_reg_data->type_ctor != nullptr) {
    VLOG(3) << "AddNode: found type constructor for " << node_def.name();
    const auto ctor_type =
        full_type::SpecializeType(AttrSlice(node_def), op_reg_data->op_def);
    const FullTypeDef ctor_typedef = ctor_type.ValueOrDie();
    if (ctor_typedef.type_id() != TFT_UNSET) {
      *(node_def.mutable_experimental_type()) = ctor_typedef;
    }
  }
```   
      
If `ctor_type` is an error status, `ValueOrDie` results in a crash.
        
### Patches
We have patched the issue in GitHub commit [955059813cc325dc1db5e2daa6221271406d4439](https://github.com/tensorflow/tensorflow/commit/955059813cc325dc1db5e2daa6221271406d4439).
  
We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-gx3f-hq7p-8fxv
Summary: Code injection in spring-cloud-netflix-hystrix-dashboard
Aliases: CVE-2021-22053
Severity: HIGH
CVSS score: 7.6
CWE: CWE-94
Published: 2021-11-23T17:53:33Z

Applications using the `spring-cloud-netflix-hystrix-dashboard` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
Vulnerability: GHSA-8qp3-pvwc-2g4p
Summary: Hijacked Environment Variables in nodefabric
Aliases: CVE-2017-16054
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2018-07-23T20:49:58Z

The `nodefabric` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-vmf5-924f-25f2
Summary: Out-of-bounds write
Aliases: CVE-2019-1103
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:12Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1062, CVE-2019-1092, CVE-2019-1106, CVE-2019-1107.
Vulnerability: GHSA-jrh2-hc4r-7jwx
Summary: Directory-traversal in Django
Aliases: CVE-2021-45452
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2022-01-12T19:21:04Z

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
Vulnerability: GHSA-h7v4-7xg3-hxcc
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39147
Severity: HIGH
CVSS score: 8.5
CWE: CWE-502
Published: 2021-08-25T14:47:46Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39147](https://x-stream.github.io/CVE-2021-39147.html).

### Credits
wh1t3p1g from TSRC (Tencent Security Response Center) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-fhjf-83wg-r2j9
Summary: Prototype Pollution in mixin-deep
Aliases: CVE-2019-10746
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-88
Published: 2019-08-27T17:42:33Z

Versions of `mixin-deep` prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The `mixinDeep` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

If you are using `mixin-deep` 2.x, upgrade to version 2.0.1 or later.
If you are using `mixin-deep` 1.x, upgrade to version 1.3.2 or later.
Vulnerability: GHSA-h97f-5258-5593
Summary: Incorrect Authorization in serverless-offline
Aliases: CVE-2021-38384
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-863
Published: 2021-09-01T18:32:22Z

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Vulnerability: GHSA-cqp5-m4pq-gfgp
Summary: Prototype Pollution in defaults-deep
Aliases: CVE-2018-3723
Severity: LOW
CVSS score: 0
CWE: CWE-471
Published: 2018-07-26T15:18:43Z

Versions of `default-deep` before 0.2.4 are vulnerable to prototype pollution


## Recommendation

Update to version 0.2.4 or later.
Vulnerability: GHSA-5f9h-9pjv-v6j7
Summary: Directory traversal in Rack::Directory app bundled with Rack
Aliases: CVE-2020-8161
Severity: MODERATE
CVSS score: 0
CWE: CWE-548
Published: 2020-07-06T21:31:02Z

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
Vulnerability: GHSA-h3vq-wv8j-36gw
Summary: Cross-site Scripting in Scratch-Svg-Renderer
Aliases: CVE-2020-27428
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-01-08T00:44:33Z

A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
Vulnerability: GHSA-qr9h-vr5p-pwwx
Summary: Denial of Service (DoS) in restify-paginate
Aliases: CVE-2020-27543
Severity: HIGH
CVSS score: 7.5
CWE: CWE-755
Published: 2021-04-12T18:59:11Z

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception.
Vulnerability: GHSA-9wcm-rrvh-qjc8
Summary: High severity vulnerability that affects colorscore
Severity: HIGH
CVSS score: 0
Published: 2018-08-15T20:03:53Z

Withdrawn, accidental duplicate publish.

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
Vulnerability: GHSA-5rq8-3wvf-wrfg
Summary: Out-of-bounds write
Aliases: CVE-2019-0933
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T20:59:01Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0937.
Vulnerability: GHSA-4365-fhm5-qcrx
Summary: Maliciously Crafted Model Archive Can Lead To Arbitrary File Write
Aliases: CVE-2021-41127
Severity: HIGH
CVSS score: 7.3
CWE: CWE-23, CWE-22
Published: 2021-10-22T16:19:13Z

### Impact
An Archive Extraction (Zip Slip) vulnerability in the functionality that allows a user to load a trained model archive in Rasa 2.8.9 and older allows an attacker arbitrary write capability within specific directories using a malicious crafted archive file.

### Patches
The vulnerability is fixed in Rasa 2.8.10

### Workarounds
Mitigating steps for vulnerable end users are to ensure that they do not upload untrusted model files, and restrict CLI or API endpoint access where a malicious actor could target a deployed Rasa instance.

### For more information
If you have any questions or comments about this advisory:
* Email [the Rasa Security Team](mailto:security@rasa.com)
Vulnerability: GHSA-wh77-3x4m-4q9g
Summary: Moderate severity vulnerability that affects bootstrap and bootstrap-sass
Aliases: CVE-2019-8331
Severity: MODERATE
CVSS score: 0
Published: 2019-02-22T20:54:27Z

In Bootstrap 4 before 4.3.1 and Bootstrap 3 before 3.4.1, XSS is possible in the tooltip or popover data-template attribute. For more information, see: https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/
Vulnerability: GHSA-r23g-3qw4-gfh2
Summary: Moderate severity vulnerability that affects redcloth
Aliases: CVE-2012-6684
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.
Vulnerability: GHSA-624f-cqvr-3qw4
Summary: URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder
Aliases: CVE-2021-32805
Severity: HIGH
CVSS score: 7.2
CWE: CWE-601
Published: 2021-09-08T21:11:14Z

### Impact
If using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability 

### Patches
Install Flask-AppBuilder 3.2.2 or above

### Workarounds
Filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting
Vulnerability: GHSA-cpp2-q66x-fq44
Summary: Directory Traversal in jikes
Aliases: CVE-2017-16139
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2018-08-06T21:39:12Z

Affected versions of `jikes` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-w23f-f3c5-r9qh
Summary: Downloads Resources over HTTP in ikst
Aliases: CVE-2017-16041
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2018-07-24T15:56:19Z

Affected versions of `ikst` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Upgrade to version 1.1.2 or greater.
Vulnerability: GHSA-58mj-pw57-4vm2
Summary: Cross-site scripting in PHPMailer
Aliases: CVE-2017-11503
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-03-05T22:09:13Z

PHPMailer versions prior to 5.2.24 (released July 26th 2017) have an XSS vulnerability in one of the code examples, CVE-2017-11503. The code_generator.phps example did not filter user input prior to output. This file is distributed with a `.phps` extension, so it it not normally executable unless it is explicitly renamed, and the file is not included when PHPMailer is loaded through composer, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.

### Impact
PHPMailer 5.2.23 has XSS in the &quot;From Email Address&quot; and &quot;To Email Address&quot; fields of code_generator.php.

### Patches
Fixed in 5.2.24

### Workarounds
None.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-11503

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-4w23-c97g-fq5v
Summary: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4130
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-01-05T20:33:16Z

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-h6h5-6fmq-rh28
Summary: Path traversal allows leaking out-of-bound files from Argo CD repo-server
Aliases: CVE-2022-24731
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-284, CWE-22
Published: 2022-03-24T00:12:46Z

### Impact

All unpatched versions of Argo CD starting with v1.5.0 are vulnerable to a path traversal vulnerability allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server.

A malicious Argo CD user who has been granted [`create` or `update` access to Applications](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file.

Sensitive files which could be leaked include files from other Application's source repositories (potentially decrypted files, if you are using a decryption plugin) or any secrets which have been mounted as files on the repo-server.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.6
* v2.1.11

### Workarounds

The only certain way to avoid the vulnerability is to upgrade. 

To mitigate the problem, you can 
* avoid storing secrets in git
* avoid mounting secrets as files on the repo-server
* avoid decrypting secrets into files on the repo-server
* carefully [limit who can `create` or `update` Applications](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions)

### References

* [Security documentation for the repo-server component](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#git-helm-repositories)
* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#)

### For more information

Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Vulnerability: GHSA-m8gw-hjpr-rjv7
Summary: Prototype Pollution in dojo
Aliases: CVE-2021-23450
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2022-01-05T15:01:46Z

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
Vulnerability: GHSA-pv4c-p2j5-38j4
Summary: Open Redirect in url-parse
Aliases: CVE-2018-3774
Severity: HIGH
CVSS score: 0
CWE: CWE-425
Published: 2018-08-13T15:02:15Z

Versions of `url-parse` before 1.4.3 returns the wrong hostname which could lead to Open Redirect, Server Side Request Forgery (SSRF), or Bypass Authentication Protocol vulnerabilities.


## Recommendation

Update to version 1.4.3 or later.
Vulnerability: GHSA-phwq-j96m-2c2q
Summary: Template injection in ejs
Aliases: CVE-2022-29078
Severity: HIGH
CVSS score: 0
CWE: CWE-74
Published: 2022-04-26T00:00:40Z

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Vulnerability: GHSA-xw79-hhv6-578c
Summary: Cross-Site Scripting in serve
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:16:59Z

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered.


## Recommendation

Upgrade to version 10.0.2 or later.
Vulnerability: GHSA-4m3j-h8f2-4xh4
Summary: Malicious Package in coinstrig
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T19:41:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3qpr-7rmg-73v8
Summary: Moderate severity vulnerability that affects Plone and Zope2
Aliases: CVE-2012-5507
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2018-07-23T19:51:02Z

AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
Vulnerability: GHSA-xrpj-f9v6-2332
Summary: CSV injection in Craft CMS
Severity: HIGH
CVSS score: 8.8
CWE: CWE-1236, CWE-74
Published: 2021-10-04T20:12:45Z

# Withdrawn 

Duplicate of GHSA-h7vq-5qgw-jwwq
Vulnerability: GHSA-2r2w-jrh2-p4gr
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-31274
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-09-09T17:08:55Z

In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed.