TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-24x6-8c7m-hv3f
Summary: Heap OOB read in TFLite's implementation of `Minimum` or `Maximum`
Aliases: CVE-2021-29590
Severity: LOW
CVSS score: 2.5
CWE: CWE-125
Published: 2021-05-21T14:26:53Z

### Impact
The implementations of the `Minimum` and `Maximum` TFLite operators can be used to read data outside of bounds of heap allocated objects, if any of the two input tensor arguments are empty.

This is because [the broadcasting implementation](https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/maximum_minimum.h#L52-L56) indexes in both tensors with the same index but does not validate that the index is within bounds:

```cc
auto maxmin_func = [&](int indexes[N]) {
  output_data[SubscriptToIndex(output_desc, indexes)] =
    op(input1_data[SubscriptToIndex(desc1, indexes)],
        input2_data[SubscriptToIndex(desc2, indexes)]);
};
```

### Patches
We have patched the issue in GitHub commit [953f28dca13c92839ba389c055587cfe6c723578](https://github.com/tensorflow/tensorflow/commit/953f28dca13c92839ba389c055587cfe6c723578).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-xmh9-rg6f-j3mr
Summary: Verification flaw in Solid identity-token-verifier
Severity: MODERATE
CVSS score: 0
CWE: CWE-290
Published: 2021-03-12T22:39:01Z

### Impact
#### Severity
Any Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed Demonstration of Proof-of-Possession (DPoP) token binding. This vulnerability could give total and complete access to a targeted Pod.

#### Summary
A verification flaw in the implementation of the identity token verifier library (https://github.com/solid/identity-token-verifier) allows DPoP proofs to be spoofed. 

DPoP proofs are used to bind access tokens to a private key meant to be in sole possession of a specific user. Instead of verifying against the hash of an embedded public key, the library instead verifies against a field that an attacker can modify to spoof another user’s DPoP. 

A stolen DPoP proof, when used in the right context, therefore allows the rebinding of a DPoP-bound access token. Any attacker in possession of a targeted access token could build an attack environment to replay it on any Pod service with this vulnerability.  


### Patches
A new version 0.5.2 of identity-token-verifier fixes the verification: https://github.com/solid/identity-token-verifier/blob/7e18d86d65ee681e8ae912b6a032a1bae3cae570/src/lib/DPoP.ts#L25-L35

### Workarounds
None

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [identity-token-verifier](https://github.com/solid/identity-token-verifier/) repository.
* Email: info@solidproject.org
Vulnerability: GHSA-8892-84wf-cg8f
Summary: SyncChannel<T> can move 'T: !Send' to other threads
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:16Z

Affected versions of this crate unconditionally implement Send/Sync for `SyncChannel<T>`.
`SyncChannel<T>` doesn't provide access to `&T` but merely serves as a channel that consumes and returns owned `T`.

Users can create UB in safe Rust by sending `T: !Send` to other threads with `SyncChannel::send/recv` APIs. Using `T = Arc<Cell<_>` allows to create data races (which can lead to memory corruption), and using `T = MutexGuard<T>` allows to unlock a mutex from a thread that didn't lock the mutex.
Vulnerability: GHSA-ph87-fvjr-v33w
Summary: CHECK-fail in `tf.raw_ops.RFFT`
Aliases: CVE-2021-29563
Severity: LOW
CVSS score: 2.5
CWE: CWE-617
Published: 2021-05-21T14:25:05Z

### Impact
An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.RFFT`:
    
```python
import tensorflow as tf

inputs = tf.constant([1], shape=[1], dtype=tf.float32)
fft_length = tf.constant([0], shape=[1], dtype=tf.int32)

tf.raw_ops.RFFT(input=inputs, fft_length=fft_length)
```

The above example causes Eigen code to operate on an empty matrix. This triggers on an assertion and causes program termination.
    
### Patches
We have patched the issue in GitHub commit [31bd5026304677faa8a0b77602c6154171b9aec1](https://github.com/tensorflow/tensorflow/commit/31bd5026304677faa8a0b77602c6154171b9aec1).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-9cg2-2j2h-59v9
Summary: Data races in atom
Aliases: CVE-2020-35897
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362
Published: 2021-08-25T20:49:11Z

An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race.
Vulnerability: GHSA-4f9m-pxwh-68hg
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-79
Published: 2020-09-11T21:20:14Z

Versions of `swagger-ui` prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 3.20.9 or later.
Vulnerability: GHSA-h67m-xg8f-fxcf
Summary: Deadlock in mutually recursive `tf.function` objects
Aliases: CVE-2021-41213
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-667
Published: 2021-11-10T18:59:32Z

### Impact
The [code behind `tf.function` API](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/python/eager/def_function.py#L542) can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive:

```python 
import tensorflow as tf

@tf.function()               
def fun1(num):
    if num == 1:
        return
    print(num)
    fun2(num-1)

@tf.function()
def fun2(num):
    if num == 0:
        return
    print(num)
    fun1(num-1)

fun1(9)
```

This occurs due to using a non-reentrant `Lock` Python object.

Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive `tf.function`, although this is not a frequent scenario.

### Patches
We have patched the issue in GitHub commit [afac8158d43691661ad083f6dd9e56f327c1dcb7](https://github.com/tensorflow/tensorflow/commit/afac8158d43691661ad083f6dd9e56f327c1dcb7).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-v662-xpcc-9xf6
Summary: It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro
Aliases: CVE-2021-21379
Severity: LOW
CVSS score: 0
CWE: CWE-281
Published: 2021-03-23T22:47:26Z

### Impact

The `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights).

Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension.

### Patches

It has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1.

### Workarounds

There is no easy workaround other than disabling the affected macros.
Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.

### References

https://jira.xwiki.org/browse/XWIKI-17759

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-p4v2-r99v-wjc2
Summary: Improper Encoding or Escaping of Output in Nicotine+
Aliases: CVE-2021-45848
Severity: HIGH
CVSS score: 7.5
CWE: CWE-116
Published: 2022-03-16T00:00:38Z

Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
Vulnerability: GHSA-hc9w-4p87-j549
Summary: Prototype Pollution in cached-path-relative
Aliases: CVE-2018-16472
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-11-07T20:46:25Z

Version of `cached-path-relative` before 1.0.2 are vulnerable to prototype pollution.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-h33p-5j96-w8qh
Summary: OS Command Injection in gulkp-styledocco
Aliases: CVE-2020-7607
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-05-07T16:14:48Z

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument &#39;options&#39; of the exports function in &#39;index.js&#39; can be controlled by users without any sanitization.
Vulnerability: GHSA-33p6-fx42-7rf5
Summary: Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)
Aliases: CVE-2020-13788
Severity: LOW
CVSS score: 4
CWE: CWE-918
Published: 2022-02-11T23:17:02Z

# Impact
Matt Hamilton from Soluble has discovered a limited Server-Side Request Forgery (SSRF) that allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server's internal network. 

The vulnerability was immediately fixed by the Harbor team.  

# Issue 
The “Test Endpoint” API, part of the functionality for ensuring a project Webhook is accessible and functional, is vulnerable to a limited SSRF attack. A malicious user that is also a project administrator can use this API for internal port scanning.

# Known Attack Vectors
Successful exploitation of this issue will lead to bad actors identifying open TCP ports on any network that is accessible by the Harbor core services

# Patches
If your product uses the affected releases of Harbor, update to version 2.0.1 to patch this issue immediately.

https://github.com/goharbor/harbor/releases/tag/v2.0.1

# Workarounds
Since only project administrators (the user that created the project) are allowed to test the webhook endpoints configured in Harbor, a Harbor system administrator can control who is a project admin. In addition, Harbor system administrators can enforce a setting where only an administrator is allowed to create new projects instead of the default Everyone. This further restricts who can be a project administrator in Harbor.

# For more information
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://nvd.nist.gov/vuln/detail/CVE-2020-13788
https://www.soluble.ai/blog/harbor-ssrf-cve-2020-13788
Vulnerability: GHSA-jhjh-ghwx-6h7r
Summary: Low severity vulnerability that affects modulemd
Aliases: CVE-2017-1002157
Severity: LOW
CVSS score: 0
CWE: CWE-242
Published: 2019-01-17T13:56:18Z

modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
Vulnerability: GHSA-p43x-xfjf-5jhr
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-9548
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2020-05-15T18:59:01Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
Vulnerability: GHSA-rw53-q8x7-ccx8
Summary: Malicious Package in buffer-xkr
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:55:17Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-f3fg-5j9p-vchc
Summary: File exposure in pleaser
Aliases: CVE-2021-31153
Severity: MODERATE
CVSS score: 0
CWE: CWE-200, CWE-668
Published: 2021-08-25T21:01:41Z

pleaser before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the search_path function, the --check option, or the -d option.
Vulnerability: GHSA-vj54-cjrx-x696
Summary: Observable Discrepancy in Argo
Aliases: CVE-2020-11576
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-203
Published: 2021-12-09T19:59:24Z

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts within Argo.
Vulnerability: GHSA-mh6f-8j2x-4483
Summary: Critical severity vulnerability that affects event-stream and flatmap-stream
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2018-11-26T23:58:21Z

The NPM package `flatmap-stream` is considered malicious.  A malicious actor added this package as a dependency to the NPM `event-stream` package in version `3.3.6`.  Users of `event-stream` are encouraged to downgrade to the last non-malicious version, `3.3.4`, or upgrade to the latest  4.x version. 

Users of `flatmap-stream` are encouraged to remove the dependency entirely.
Vulnerability: GHSA-j8r2-2x94-2q67
Summary: Cross-Site Scripting in diagram-js-direct-editing
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-09-11T21:19:09Z

Versions of `diagram-js-direct-editing` prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.4.3 or later.
Vulnerability: GHSA-8m5v-f2wp-wqr9
Summary: Malicious Package in ali-contributors
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:30:36Z

All versions of `ali-contributors` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qcff-ffx3-m25c
Summary: Command Injection in meta-git
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T17:31:44Z

All versions of `meta-git` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `clone` command is vulnerable through the branch name.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6gg3-pmm7-97xc
Summary: DOM-based XSS in auth0-lock
Aliases: CVE-2020-15119
Severity: LOW
CVSS score: 6.4
CWE: CWE-79
Published: 2020-08-19T21:05:03Z

### Overview
Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.

- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input.  
- For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.

When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using auth0-lock
- You are using Passwordless or Enterprise connection mode

### How to fix that?
Upgrade to version `11.26.3`

### Will this update impact my users?
The fix provided in patch will not affect your users.

### Credit
https://github.com/mvisat
Vulnerability: GHSA-w9hw-v97w-g5f5
Summary: Malicious Package in bitconi-ops
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:43:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4g53-vp7q-gfjv
Summary: constructEvent does not verify header
Severity: HIGH
CVSS score: 0
Published: 2021-05-28T19:18:28Z

### Impact
Anyone verifying a Stripe webhook request via this library's `constructEvent` function.

### Patches
Upgrade to 1.1.4. 

### Workarounds
Use `await verifyHeader(...)` directly instead of `constructEvent`.

### References
https://github.com/worker-tools/stripe-webhook/issues/1
Vulnerability: GHSA-3233-rgx3-c2wh
Summary: Moderate severity vulnerability that affects mustache
Severity: MODERATE
CVSS score: 0
Published: 2018-10-09T00:38:09Z

Withdrawn, accidental duplicate publish.

mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
Vulnerability: GHSA-j377-2x76-558h
Summary: Improper Input Validation in is-email
Aliases: CVE-2021-36716
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-400
Published: 2021-12-10T17:25:21Z

is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.
Vulnerability: GHSA-x7q3-67vc-wvcf
Summary: Downloads Resources over HTTP in grunt-images
Aliases: CVE-2016-10645
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2018-08-15T19:05:14Z

Affected versions of `grunt-images` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `grunt-images`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-v9p9-535w-4285
Summary: Prototype Pollution in litespeed.js and appwrite/server-ce
Aliases: CVE-2021-23682
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-02-17T00:00:32Z

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Vulnerability: GHSA-vwhq-49r4-gj9v
Summary: Reference binding to `nullptr` in `tf.ragged.cross`
Aliases: CVE-2021-41214
Severity: HIGH
CVSS score: 7.8
CWE: CWE-824
Published: 2021-11-10T18:58:16Z

### Impact
The [shape inference code for `tf.ragged.cross`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/ops/ragged_array_ops.cc#L64) has an undefined behavior due to binding a reference to `nullptr`. In the following scenario, this results in a crash:

```python
import tensorflow as tf
  
@tf.function                 
def test():     
  y = tf.ragged.cross([tf.ragged.constant([['1']]),'2'])
  return y                   
                             
test()        
```                          
             
### Patches
We have patched the issue in GitHub commit [fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8](https://github.com/tensorflow/tensorflow/commit/fa6b7782fbb14aa08d767bc799c531f5e1fb3bb8).
  
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-vh5c-jqfg-mhrh
Summary: Cross-Site Request Forgery in xwiki-platform
Aliases: CVE-2021-32732
Severity: HIGH
CVSS score: 7.5
CWE: CWE-352
Published: 2022-02-10T22:42:46Z

### Impact
It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tight to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests.

### Patches
This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided:
  - a first one to fix the CSRF problem
  - a more complex one that now relies on sending an email for the Forgot username process.

### Workarounds
It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123

In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here.

### References
  * https://jira.xwiki.org/browse/XWIKI-18384
  * https://jira.xwiki.org/browse/XWIKI-18408

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-c2h6-7gm8-cv4w
Summary: XSS in MITREid Connect
Aliases: CVE-2020-5497
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-04-01T16:35:44Z

The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.
Vulnerability: GHSA-9rwj-8mh9-4876
Summary: Malicious Package in carloprojectdiscord
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:19:37Z

All versions of `carloprojectdiscord` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-9qrg-h9g8-c65q
Summary: Prototype Pollution in deep-setter
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-04T15:14:26Z

All versions of `deep-setter` are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-h2xm-2p6w-mj2v
Summary: Out-of-bounds Write in ChakraCore
Aliases: CVE-2020-0831
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-07-28T18:58:14Z

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Vulnerability: GHSA-99qr-9cc9-fv2x
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2017-3166
Severity: MODERATE
CVSS score: 7.8
CWE: CWE-732
Published: 2018-12-21T17:50:03Z

In Apache Hadoop versions 2.6.1 to 2.6.5, 2.7.0 to 2.7.3, and 3.0.0-alpha1, if a file in an encryption zone with access permissions that make it world readable is localized via YARN's localization mechanism, that file will be stored in a world-readable location and can be shared freely with any application that requests to localize that file.
Vulnerability: GHSA-grmf-4fq6-2r79
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in aubio
Aliases: CVE-2018-19800
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2019-07-26T16:10:28Z

aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.
Vulnerability: GHSA-23xp-j737-282v
Summary: Path Traversal in takeapeek
Aliases: CVE-2018-16473
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-11-06T23:12:30Z

All versions of `takeapeek` are vulnerable to path traversal exposing files and directories.


## Recommendation

As no fix is currently available for this vulnerability is it is our recommendation to use another static file server.
Vulnerability: GHSA-h43v-26r7-7j4c
Summary: Allocation of Resources Without Limits or Throttling in HashiCorp Nomad
Aliases: CVE-2020-7218
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400, CWE-770
Published: 2021-05-18T18:20:19Z

HashiCorp Nomad and Nomad Enterprise before 0.10.3 allow unbounded resource usage.
Vulnerability: GHSA-rq96-qhc5-vm4r
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi
Aliases: CVE-2021-44145
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-200
Published: 2022-01-05T17:33:32Z

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
Vulnerability: GHSA-fxh6-w476-hgr4
Summary: Directory Traversal in SharpCompress
Aliases: CVE-2018-1002206
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-22
Published: 2019-09-11T22:59:57Z

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.
Vulnerability: GHSA-f72h-wf57-7xwh
Summary: Malicious Package in buffer-xo2
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:58:34Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-mvvp-gwgc-5hrp
Summary: Path Traversal in elFinder.Net.Core
Aliases: CVE-2021-23407
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-08-02T17:30:27Z

This affects the package elFinder.Net.Core from 0 and before 1.2.4. The user-controlled file name is not properly sanitized before it is used to create a file system path.
Vulnerability: GHSA-25gf-8qrr-g78r
Summary: Missing SSL Certificate Validation in Hashicorp Consul
Aliases: CVE-2021-32574
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2021-07-19T21:21:03Z

HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Vulnerability: GHSA-q3j5-32m5-58c2
Summary: Privilege Elevation in runc
Aliases: CVE-2016-3697
Severity: HIGH
CVSS score: 7.8
Published: 2021-12-20T18:21:34Z

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Vulnerability: GHSA-fg5w-w99f-rj6w
Summary: Command Injection in @ronomon/opened
Aliases: CVE-2021-29300
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-06-08T23:15:35Z

The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.
Vulnerability: GHSA-5rpc-gwh9-q9fg
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
Aliases: CVE-2017-12862
Severity: HIGH
CVSS score: 8.8
CWE: CWE-119, CWE-787
Published: 2021-10-12T22:02:21Z

In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
Vulnerability: GHSA-qr4m-jcvc-3382
Summary: Prototype Pollution in dot-notes
Aliases: CVE-2020-7717
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:12:00Z

All versions of package dot-notes up to and including version 3.2.0 are vulnerable to Prototype Pollution via the create function.
Vulnerability: GHSA-chwr-hf3w-c984
Summary: Regular Expression Denial of Service in dat.gui
Aliases: CVE-2020-7755
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-05-10T18:44:38Z

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
Vulnerability: GHSA-ghq2-m3pq-qf3p
Summary: Stored XSS in Jenkins CVS Plugin
Aliases: CVE-2022-29037
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-04-13T00:00:18Z

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-wrvr-8mpx-r7pp
Summary: Regular Expression Denial of Service in mime
Aliases: CVE-2017-16138
Severity: MODERATE
CVSS score: 0
CWE: CWE-400
Published: 2018-07-20T16:20:52Z

Affected versions of `mime` are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.


## Recommendation

Update to version 2.0.3 or later.
Vulnerability: GHSA-7p6w-x2gr-rrf8
Summary: Cross-Site Scripting in ag-grid-community
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-02T21:28:05Z

Versions of `ag-grid-community` prior to 14.0.0 are vulnerable to Cross-Site Scripting (XSS). Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. 


## Recommendation

Upgrade to version 14.0.0 or later
Vulnerability: GHSA-x2j7-6hxm-87p3
Summary: Remote code injection
Aliases: CVE-2021-27903
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-74
Published: 2021-07-02T18:36:41Z

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
Vulnerability: GHSA-xv7v-rf6g-xwrc
Summary: Directory Traversal in typo3/phar-stream-wrapper
Aliases: CVE-2019-11831
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502, CWE-22
Published: 2021-09-30T17:10:14Z

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
Vulnerability: GHSA-6fc8-4gx4-v693
Summary: ReDoS in Sec-Websocket-Protocol header
Aliases: CVE-2021-32640
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400, CWE-345
Published: 2021-05-28T19:19:03Z

### Impact

A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.

### Proof of concept

```js
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}
```

### Patches

The vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to ws@6.2.2 (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and ws@5.2.3 (https://github.com/websockets/ws/commit/76d47c1479002022a3e4357b3c9f0e23a68d4cd2).

### Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

### Credits

The vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.
Vulnerability: GHSA-h3p9-wrgx-82cm
Summary: Use of a Broken or Risky Cryptographic Algorithm in Terraform
Aliases: CVE-2019-19316
Severity: HIGH
CVSS score: 3.7
CWE: CWE-327, CWE-20
Published: 2021-05-18T18:18:50Z

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP.
Vulnerability: GHSA-3892-2r52-p65m
Summary: HTTP Request Smuggling in goliath
Aliases: CVE-2020-7671
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-444
Published: 2021-05-24T18:20:07Z

goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.
Vulnerability: GHSA-w2fr-65vp-mxw3
Summary: Deserialization of untrusted data in Symfony
Aliases: CVE-2019-10912
Severity: HIGH
CVSS score: 7.1
CWE: CWE-502
Published: 2020-02-12T18:44:50Z

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
Vulnerability: GHSA-r679-m633-g7wc
Summary: Improper input validation in Apache Shiro
Aliases: CVE-2019-12422
Severity: MODERATE
CVSS score: 0
Published: 2020-02-04T22:36:36Z

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
Vulnerability: GHSA-xq98-5rcf-5wqh
Summary: Directory Traversal in badjs-sourcemap-server
Aliases: CVE-2017-16036
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T15:43:02Z

Affected versions of `badjs-sourcemap-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8xv9-qcr9-ww9j
Summary: Authenticated XML External Entity Processing
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-611
Published: 2020-10-19T21:32:18Z

### Impact
Authenticated XML External Entity Processing

### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
Vulnerability: GHSA-j85q-whc9-g4p9
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc
Aliases: CVE-2021-3678
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-338
Published: 2021-09-02T17:07:48Z

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Vulnerability: GHSA-vq9j-jh62-5hmp
Summary: Apache Camel using an outdated vulnerable JSON-lib library
Aliases: CVE-2017-5643
Severity: HIGH
CVSS score: 7.4
CWE: CWE-918
Published: 2018-10-16T23:13:11Z

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.
Vulnerability: GHSA-jxx8-v83v-rhw3
Summary: Moderate severity vulnerability that affects spree
Aliases: CVE-2013-1656
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:37Z

Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
Vulnerability: GHSA-9x64-5r7x-2q53
Summary: Malicious Package in flatmap-stream
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T21:21:32Z

Version 0.1.1 of `flatmap-stream` is considered malicious.

This module runs an encrypted payload targeting a very specific application, `copay` and because they shared the same description it would have likely worked for `copay-dash`.

The injected code:

- Read in AES encrypted data from a file disguised as a test fixture
- Grabbed the npm package description of the module that imported it, using an automatically set environment variable
- Used the package description as a key to decrypt a chunk of data pulled in from the disguised file

The decrypted data was part of a module, which was then compiled in memory and executed.

This module performed the following actions:

- Decrypted another chunk of data from the disguised file
- Concatenated a small, commented prefix from the first decrypted chunk to the end of the second decrypted chunk
- Performed minor decoding tasks to transform the concatenated block of code from invalid JS to valid JS (we believe this was done to evade detection by dynamic analysis tools)
- Wrote this processed block of JS out to a file stored in a dependency that would be packaged by the build scripts: 

The chunk of code that was written out was the actual malicious code, intended to be run on devices owned by the end users of Copay.

This code would do the following:

- Detect the current environment: Mobile/Cordova/Electron
- Check the Bitcoin and Bitcoin Cash balances on the victim's copay account
- If the current balance was greater than 100 Bitcoin, or 1000 Bitcoin Cash:
  - Harvest the victim's account data in full
  - Harvest the victim's copay private keys
  - Send the victim's account data/private keys off to a collection


## Recommendation

If you find this module in your environment it's best to remove it. The malicious version of event-stream and flatmap-stream have been removed from the npm Registry.
Vulnerability: GHSA-hmq6-frv3-4727
Summary: High severity vulnerability that affects com.fasterxml.jackson.dataformat:jackson-dataformat-xml
Aliases: CVE-2016-3720
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2018-10-18T17:43:16Z

XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
Vulnerability: GHSA-rhvc-x32h-5526
Summary: No CSRF Validation in droppy
Aliases: CVE-2016-10529
Severity: HIGH
CVSS score: 0
CWE: CWE-352
Published: 2019-02-18T23:39:32Z

Affected versions of `droppy`  are vulnerable to cross-site socket forgery. The package does not perform verification for cross-domain websocket requests, and as a result, an attacker can create a web page that opens up a websocket connection on behalf of the user visiting the page. The attacker can then perform any action that the target user could, including adding a new admin account under their control, or deleting others.


## Recommendation

Update to version 3.5.0 or later.
Vulnerability: GHSA-m428-jqc4-2p5j
Summary: Prototype Pollution in phpjs
Aliases: CVE-2020-7700
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T17:28:46Z

All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised to use Locutus as a replacement (https://github.com/locutusjs/locutus)
Vulnerability: GHSA-46fh-8fc5-xcwx
Summary: Prototype Pollution in lodash.defaultsdeep
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2020-09-03T18:09:16Z

Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to Prototype Pollution. The function 'defaultsDeep' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-6wj2-g87r-pm62
Summary: Cross-site Scripting in comrak
Aliases: CVE-2021-38186
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-25T20:55:43Z

An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.
Vulnerability: GHSA-cwp3-834g-x79g
Summary: Moderate severity vulnerability that affects archive-tar-minitar and minitar
Severity: MODERATE
CVSS score: 0
Published: 2018-08-21T17:07:36Z

Withdrawn, accidental duplicate publish.

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
Vulnerability: GHSA-v62j-fcxq-j239
Summary: Stored XSS in Apache Atlas
Aliases: CVE-2019-10070
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-01-08T17:26:53Z

Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality
Vulnerability: GHSA-3m6r-39p3-jq25
Summary: Doorkeeper is vulnerable to replay attacks
Aliases: CVE-2016-6582
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-1254
Published: 2017-10-24T18:33:35Z

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Vulnerability: GHSA-m5ff-3wj3-8ph4
Summary: HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
Severity: HIGH
CVSS score: 0
CWE: CWE-444
Published: 2019-12-26T16:34:38Z

### Impact

If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling.

```
Content-Length: 10
Transfer-Encoding: [\x0b]chunked
```

For clarity:

```
0x0b == vertical tab
```

Would get parsed by Waitress as being a `chunked` request, but a front-end server would use the `Content-Length` instead as the `Transfer-Encoding` header is considered invalid due to containing invalid characters.

If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure.

### Patches

Please upgrade to Waitress 1.4.1 which fixes this issue with stricter HTTP field validation.

Waitress 1.4.1 due to this change has become much more strict in what is allowed in header values, while the maintainers don't believe that these changes will cause any issues, it may cause failures with non-conformist reverse proxies or clients, and it is highly recommend that users validate the changes in their environment and make sure it won't cause any unacceptable failures.

### Workarounds

You may enable additional protections on front-end servers, those that follow RFC7230 correctly would drop the request with a 400 Bad Request.

Waitress will now correctly responds to the request with a 400 Bad Request, and will drop the connection to avoid any potential HTTP pipelining issues.

### References

This was mentioned in https://portswigger.net/research/http-desync-attacks-what-happened-next and was specifically mentioned as being an issue in HAProxy which did not properly filter it in this article: https://nathandavison.com/blog/haproxy-http-request-smuggling

### Thanks

The Pylons Project would like to thank ZeddYu Lu for doing extended testing against Waitress 1.4.0 and bringing this to our attention!

### For more information

If you have any questions or comments about this advisory:

* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)
* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)
Vulnerability: GHSA-q643-w9jp-q2qg
Summary: Hardcoded Initialization Vector in parsel
Severity: HIGH
CVSS score: 0
Published: 2020-09-04T17:34:59Z

All versions of `parsel` have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.