TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-44gv-fgcj-w546
Summary: Missing Authorization in DayByDay CRM
Aliases: CVE-2022-22107
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2022-01-08T00:31:55Z

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Vulnerability: GHSA-c5c9-8c6m-727v
Summary: Cross-Site Scripting via Rich-Text Content
Aliases: CVE-2021-32768
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-19T15:53:12Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7)

### Problem
Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality _[HTMLparser](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Htmlparser.html)_ do not consider all potentially malicious HTML tag & attribute combinations per default.

In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction.

In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.

### Solution
Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above.

Custom package _[typo3/html-sanitizer](https://github.com/TYPO3/html-sanitizer)_ - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios.

During the frontend rendering process, sanitization is applied to the default TypoScript path `lib.parseFunc`, which is implicitly used by the Fluid view-helper instruction `f:format.html`. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding [ChangeLog documentation](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/9.5.x/Important-94484-IntroduceHTMLSanitizer.html).

### Credits
Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-013](https://typo3.org/security/advisory/typo3-core-sa-2021-013)
Vulnerability: GHSA-rfh8-25h9-mhgf
Summary: Cross-site Scripting in YII2-CMS
Aliases: CVE-2019-16130
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-10-14T21:12:08Z

YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
Vulnerability: GHSA-c82c-8pjw-6829
Summary: Malicious Package in @impala/bmap
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:41:45Z

Version 1.0.3 of `@impala/bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.3 of this module is found installed you will want to replace it with a version before or after 1.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-6jvm-3j5h-79f6
Summary: Moderate severity vulnerability that affects paperclip
Aliases: CVE-2015-2963
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
Vulnerability: GHSA-m898-h4pm-pqfr
Summary: Arbitrary code execution due to an uncontrolled search path for the git binary
Aliases: CVE-2021-28955
Severity: HIGH
CVSS score: 7.2
CWE: CWE-427
Published: 2021-05-25T18:44:09Z

### Impact

The go language recently addressed a security issue in the way that binaries are found before being executed. Some operating systems like Windows persist to have the current directory being part of the default search path, and having priority over the system-wide path.

This means that it's possible for a malicious user to craft for example a `git.bat` command, commit it and push it in a repository. Later when git-bug search for the git binary, this malicious executable can take priority  and be executed.

### Who is impacted

This issue happen on Windows and some other operating systems with a badly configured PATH.

All version prior to 0.7.2 are vulnerable to this issue.

### Patches

Version 0.7.2 fix this issue. Users should update as soon as possible.

### References

More details about this issue can be found [here](https://blog.golang.org/path-security).
Vulnerability: GHSA-rr6v-h7m8-wc9f
Summary: Cross-site Scripting in Froala WYSIWYG Editor
Aliases: CVE-2021-28114
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-07-19T21:21:33Z

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
Vulnerability: GHSA-fv7x-4hpc-hf9f
Summary: Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3
Aliases: CVE-2017-12631
Severity: MODERATE
CVSS score: 0
CWE: CWE-352
Published: 2018-10-18T16:57:21Z

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a security context that is set up using a malicious client's roles for the given enduser.
Vulnerability: GHSA-fg42-vwxx-xx5j
Summary: Data race in tiny_future
Aliases: CVE-2020-36438
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:58:53Z

An issue was discovered in the tiny_future crate before 0.4.0 for Rust. Future<T> does not have bounds on its Send and Sync traits.
Vulnerability: GHSA-f8cm-364f-q9qh
Summary: Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
Aliases: CVE-2020-15269
Severity: HIGH
CVSS score: 7.4
CWE: CWE-287, CWE-613
Published: 2020-10-20T20:03:52Z

### Impact
The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. 

### Patches
Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. 

### Workarounds
In your project directory create a decorator file `app/controllers/spree/api/v2/base_controller_decotatror.rb` with contents:

```ruby
module Spree
  module Api
    module V2
      module BaseControllerDecorator
        private

        def spree_current_user
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
        end
     end
  end
end

Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)
```

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)
Vulnerability: GHSA-8m73-w2r2-6xxj
Summary: Insecure defaults in UmbracoForms
Aliases: CVE-2020-7685
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1188
Published: 2020-07-29T17:29:51Z

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.
Vulnerability: GHSA-7q5g-gph2-4rc6
Summary: Upload of file to arbitrary path in Apache Flink
Aliases: CVE-2020-17518
Severity: HIGH
CVSS score: 7.5
CWE: CWE-23, CWE-22
Published: 2022-02-09T22:29:52Z

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.
Vulnerability: GHSA-q9qc-pp5x-mc8c
Summary: Improper Neutralization of Special Elements Used in a Template Engine in microweber
Aliases: CVE-2022-0896
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94, CWE-1336
Published: 2022-03-10T00:00:40Z

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
Vulnerability: GHSA-v5r6-6r3c-wqxc
Summary: Memory exhaustion in asn1_der
Aliases: CVE-2019-15549
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-08-25T20:44:56Z

An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a length field.
Vulnerability: GHSA-896r-f27r-55mw
Summary: json-schema is vulnerable to Prototype Pollution
Aliases: CVE-2021-3918
Severity: MODERATE
CVSS score: 9.8
CWE: CWE-1321, CWE-915
Published: 2021-11-19T20:16:17Z

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-w8f3-pvx4-4c3h
Summary: Prototype Pollution in arr-flatten-unflatten
Aliases: CVE-2020-7713
Severity: CRITICAL
CVSS score: 0
CWE: CWE-1321
Published: 2021-05-06T18:11:39Z

All versions of package arr-flatten-unflatten up to and including version 1.1.4 are vulnerable to Prototype Pollution via the constructor.
Vulnerability: GHSA-fm68-89m8-4gjj
Summary: JavaScript injection possible via html comments
Aliases: CVE-2019-8233
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-11-12T22:59:47Z

In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments.
Vulnerability: GHSA-prff-6j8q-vrv7
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0379
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-28T22:15:33Z

There is a persistent XSS Vulnerability exsists in the checkout page where we can able to execute any javascription in the last name field
Vulnerability: GHSA-j383-35pm-c5h4
Summary: Path Traversal in Grunt
Aliases: CVE-2022-0436
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-22
Published: 2022-04-13T00:00:16Z

Grunt prior to version 1.5.2 is vulnerable to path traversal.
Vulnerability: GHSA-rhf5-f553-xg82
Summary: Password exposure in concrete5/core
Aliases: CVE-2021-22951
Severity: MODERATE
CVSS score: 0
CWE: CWE-200, CWE-639
Published: 2021-11-23T18:18:16Z

Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.
Vulnerability: GHSA-6vc5-v7hw-h5h2
Summary: Cross-site Scripting in RosarioSIS
Aliases: CVE-2020-15721
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T22:26:10Z

RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
Vulnerability: GHSA-5ff8-jcf9-fw62
Summary: Cross-Site Scripting in markdown-it-katex
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-04T17:55:35Z

All versions of `markdown-it-katex` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gjc9-932x-c59p
Summary: Malicious Package in leaflet-gpx
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T00:34:33Z

Version 1.0.1 of `leaflet-gpx` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-ggmr-44cv-24pm
Summary: Code injection via unsafe YAML loading
Aliases: CVE-2021-43811
Severity: MODERATE
CVSS score: 7.8
CWE: CWE-94
Published: 2021-12-09T18:35:22Z

### Impact
Sockeye uses YAML to store model and data configurations on disk.  Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files.

An attacker can add malicious code to the config file of a trained model and attempt to convince users to download and run it.  If users run the model, the embedded code will run locally.

### Patches
The issue is fixed in version 2.3.24 and above by #964.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [awslabs/sockeye](https://github.com/awslabs/sockeye)
* Email us at [sockeye-dev](mailto:sockeye-dev@amazon.com)

### Attribution
This vulnerability was reported by Masatoshi Yoshizawa of yamory Security Team.
Vulnerability: GHSA-35rg-466w-77h3
Summary: Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Aliases: CVE-2021-33507
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-18T18:44:50Z

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
Vulnerability: GHSA-743r-5g92-5vgf
Summary: Improper certificate management in AWS IoT Device SDK v2
Aliases: CVE-2021-40829
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-295
Published: 2021-11-24T21:11:16Z

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
Vulnerability: GHSA-qpfq-ph7r-qv6f
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21347
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-434, CWE-502
Published: 2021-03-22T23:29:00Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21347](https://x-stream.github.io/CVE-2021-21347.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-rf4j-j272-fj86
Summary: Django allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive
Aliases: CVE-2018-6188
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2018-10-03T21:13:54Z

django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive.
Vulnerability: GHSA-cmh5-qc8w-xvcq
Summary: Cross-Site Scripting in i18next
Aliases: CVE-2017-16010
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-07-24T19:58:33Z

Affected versions of `i18next` may fail to sanitize user input when certain configuration options are used. When using the `.init` method, passing interpolation options without passing an `escapeValue` will default to `undefined` rather than the assumed `true`. 

## Proof of Concept

```
var init = i18n.init({
  interpolation: {
    prefix: "__",
    suffix: "__",
    escapeValue: true
  }
}, function(){
  var test = i18n.t('__firstName__ __lastName__', {
        firstName: 'Bob',
        lastName: '["foo","bar"]',
  });
  console.log(test);
});
```
When `escapeValue` is explicitly passed, the result of `test` is: 

```
&lt;script&gt;alert(1)&lt;&#x2F;script&gt; Johnson
```

This is supposed to be the default. However, if `escapeValue` is not included, the result is the unescaped string: 
 
```
<script>alert(1)</script> Johnson
```


## Recommendation

Update to version 3.4.4 or later.
Vulnerability: GHSA-h746-rm5q-8mgq
Summary: Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node
Aliases: CVE-2021-27098
Severity: HIGH
CVSS score: 8.1
CWE: CWE-284, CWE-295
Published: 2021-05-21T14:31:11Z

#### Summary
In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to distribute. Proper controls are in place to require that the caller presents a valid agent certificate that is already authorized to issue at least one SPIFFE ID, and the requested SPIFFE ID belongs to the same trust domain, prior to being able to trigger this vulnerability. This issue has been fixed in SPIRE versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1.

#### What are the changes introduced by the patched versions?
The changes introduced to address this issue are related to enforcing that the FetchX509SVID RPC of SPIRE Server’s Legacy Node API only issues X.509 certificates with SPIFFE IDs that the agent is authorized to distribute.

The patched version also includes a back-ported change that improves the handling of file descriptors related to workload attestation in SPIRE Agent.

There are no changes in the expected behavior of SPIRE.

#### Should I upgrade SPIRE?
All SPIRE users running affected versions are advised to upgrade to the corresponding patched version.

#### Workarounds
No workarounds have been identified for this vulnerability.
Vulnerability: GHSA-pc58-wgmc-hfjr
Summary: Prototype Pollution in mout
Aliases: CVE-2020-7792
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2022-02-09T22:49:10Z

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.
Vulnerability: GHSA-6528-wvf6-f6qg
Summary: Pycrypto generates weak key parameters
Aliases: CVE-2018-6594
Severity: HIGH
CVSS score: 7.5
CWE: CWE-326
Published: 2018-07-12T20:29:26Z

lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
Vulnerability: GHSA-gp2f-254m-rh32
Summary: Unauthorized access to data in @sap-cloud-sdk/core
Aliases: CVE-2021-41251
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2021-11-10T16:51:41Z

### Impact
This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations.
In some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions.
By default, destination caching is disabled. If it is enabled the maximum lifetime is 5 minutes which limits the attack vector.

### Patches
The problem was fixed by #1769 and #1770. The security for caching has been increased. The changes are released in version 1.52.0.

### Workarounds
Disable destination caching (it is disabled by default).

### References
[destination cache API docs](https://sap.github.io/cloud-sdk/api/1.51.0/modules/sap_cloud_sdk_core#destinationCache)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/SAP/cloud-sdk-js
Vulnerability: GHSA-pv39-qp28-4mgh
Summary: Improper Restriction of XML External Entity Reference in soa-model
Aliases: CVE-2021-43090
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2022-03-26T00:00:32Z

Soa-model is a toolkit and Java API for WSDL, WADL and XML Schema. An XML External Entity (XXE) vulnerability exists in versions of soa-model prior to 1.6.4 in the WSDLParser function. This issue has been fixed in version 1.6.4.
Vulnerability: GHSA-rqff-837h-mm52
Summary: Authorization bypass in url-parse
Aliases: CVE-2022-0512
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-639
Published: 2022-02-15T00:02:46Z

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
Vulnerability: GHSA-pf38-v6qj-j23h
Summary: Malfunction of CSRF token validation in Shopware
Aliases: CVE-2022-24879
Severity: HIGH
CVSS score: 7.5
CWE: CWE-352
Published: 2022-04-28T21:01:53Z

### Impact
The CSRF tokens were not renewed after login and logout.
An attacker could impersonate the victim if the attacker is able to use the same device as the victim used beforehand.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Vulnerability: GHSA-7mq6-cp5m-f4j5
Summary: Cross-site Scripting in Anchor CMS
Aliases: CVE-2021-44116
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-05T14:54:36Z

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.
Vulnerability: GHSA-fmmc-742q-jg75
Summary: Polymorphic typing issue
Aliases: CVE-2019-16943
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2019-11-13T00:32:27Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Vulnerability: GHSA-h6pr-c536-6rjg
Summary: Prototype Pollution in object-path-set
Aliases: CVE-2021-23507
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2022-02-05T00:00:31Z

The package object-path-set before 1.0.2 are vulnerable to Prototype Pollution via the setPath method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-OBJECTPATHSET-607908
Vulnerability: GHSA-7p6h-3fmw-539q
Summary: Downloads Resources over HTTP in selenium-chromedriver
Aliases: CVE-2016-10624
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:27Z

Affected versions of `selenium-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-chromedriver`.


## Recommendation

No patch is currently available for this vulnerability, and the author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo
Vulnerability: GHSA-8q2c-2396-hf7j
Summary: Malicious Package in appx-compiler
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:34:55Z

All versions of `appx-compiler` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xf96-32q2-9rw2
Summary: High severity vulnerability that affects rails
Aliases: CVE-2008-4094
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Vulnerability: GHSA-x462-89pf-6r5h
Summary: Crash due to malformed relay protocol message
Aliases: CVE-2021-21404
Severity: LOW
CVSS score: 7.5
CWE: CWE-20
Published: 2021-05-21T16:23:17Z

### Impact

1. `syncthing` can be caused to crash and exit if sent a malformed relay
   protocol message message with a negative length field.

2. The relay server `strelaysrv` can be caused to crash and exit if sent
   a malformed relay protocol message with a negative length field.

At no point is sensitive data exposed or liable to be altered due to this
issue. Sensitive data is never exposed to relay operators. Syncthing itself
would need to be lured to connect to a malicious relay server in order to
exploit the issue.

### Patches

Fixed in version 1.15.0.

### Workarounds

1. No known workaround for `strelaysrv`.

2. `syncthing` can be configured to not use relays, or to only use specific,
   trusted relays. If Syncthing is used in a closed environment or with
   relaying disabled, i.e., it does not communicate with unknown relays,
   Syncthing is not vulnerable.

### For more information

If you have any questions or comments about this advisory, please discuss it [on the forum](https://forum.syncthing.net/).

Thanks to Wojciech Paciorek for discovering and reporting this issue.
Vulnerability: GHSA-52q8-877j-gghq
Summary: remote code execution via cache action in MoinMoin
Aliases: CVE-2020-25074
Severity: CRITICAL
CVSS score: 0
CWE: CWE-22
Published: 2020-11-11T15:54:51Z

### Impact
The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to
the wiki can use this to achieve remote code execution.

### Patches
Users are strongly advised to upgrade to a patched version.

MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.

### Workarounds
It is not advised to work around this, but to upgrade MoinMoin to a patched version.

That said, a work around via disabling the `cache` or the `AttachFile` action might be possible.

Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.

### Credits

This vulnerability was discovered by Michael Chapman.

### For more information
If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).
Vulnerability: GHSA-g4gg-9f62-jfph
Summary: Moderate severity vulnerability that affects com.orientechnologies:orientdb-studio
Aliases: CVE-2015-2918
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-20
Published: 2018-10-18T17:41:40Z

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Vulnerability: GHSA-r23f-c2j5-rx2f
Summary: Local File read vulnerability in OctoberCMS
Aliases: CVE-2020-5295
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-98
Published: 2020-06-03T21:58:16Z

### Impact
An attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-03-31 at 2 37 53 PM" src="https://user-images.githubusercontent.com/7253840/78072989-44b3ac80-735d-11ea-8676-09c69f0409c4.png">
Vulnerability: GHSA-6cw8-7j6c-hccp
Summary: Moderate severity vulnerability that affects io.vertx:vertx-core
Aliases: CVE-2018-12537
Severity: MODERATE
CVSS score: 0
CWE: CWE-93
Published: 2018-10-19T17:43:36Z

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
Vulnerability: GHSA-qh36-44jv-c8xj
Summary: Potential proxy IP restriction bypass in Kubernetes
Aliases: CVE-2020-8562
Severity: LOW
CVSS score: 3.1
CWE: CWE-367
Published: 2022-02-02T00:01:58Z

As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.
Vulnerability: GHSA-c7fw-cr3w-wvfc
Summary: Data races in arr
Aliases: CVE-2020-35886
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-362
Published: 2021-08-25T20:49:04Z

An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race.
Vulnerability: GHSA-f294-27fc-wgj7
Summary: Malicious Package in buffer-zor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:16:31Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-cjc7-49v2-jp64
Summary: Incomplete validation in `SparseAdd`
Aliases: CVE-2021-29609
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-665, CWE-787
Published: 2021-05-21T14:28:29Z

### Impact
Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

```python
import tensorflow as tf

a_indices = tf.zeros([10, 97], dtype=tf.int64)
a_values = tf.zeros([10], dtype=tf.int64)
a_shape = tf.zeros([0], dtype=tf.int64)

b_indices = tf.zeros([0, 0], dtype=tf.int64)
b_values = tf.zeros([0], dtype=tf.int64)
b_shape = tf.zeros([0], dtype=tf.int64)
  
thresh = 0

tf.raw_ops.SparseAdd(a_indices=a_indices,
                    a_values=a_values,
                    a_shape=a_shape,
                    b_indices=b_indices,
                    b_values=b_values,
                    b_shape=b_shape,
                    thresh=thresh)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/sparse_add_op.cc) has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of `*_indices` matches the size of corresponding `*_shape`. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

### Patches
We have patched the issue in GitHub commit [6fd02f44810754ae7481838b6a67c5df7f909ca3](https://github.com/tensorflow/tensorflow/commit/6fd02f44810754ae7481838b6a67c5df7f909ca3) followed by GitHub commit  [41727ff06111117bdf86b37db198217fd7a143cc](https://github.com/tensorflow/tensorflow/commit/41727ff06111117bdf86b37db198217fd7a143cc).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-phrq-v4q2-hmq6
Summary: Code injection vulnerability in allSelectors()
Aliases: CVE-2020-13756
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2022-03-26T00:15:22Z

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Vulnerability: GHSA-8vf3-4w62-m3pq
Summary: XSS in Keycloak
Aliases: CVE-2020-1697
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2020-04-15T21:09:09Z

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.
Vulnerability: GHSA-vcph-57hv-89c4
Summary: Downloads Resources over HTTP in serc.js
Aliases: CVE-2016-10678
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:42:11Z

Affected versions of `serc.js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `serc.js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-c8wh-6jw4-2h79
Summary: Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar
Aliases: CVE-2020-11094
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-532
Published: 2020-06-03T23:19:12Z

### Impact
The debugbar contains a perhaps little known feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed.

### Patches
Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.

### Workarounds
Apply https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 to your installation manually if unable to upgrade to v3.1.0.

### For more information
If you have any questions or comments about this advisory:
* Email us at [octobercms@luketowers.ca](mailto:octobercms@luketowers.ca) & [hello@octobercms.com](mailto:hello@octobercms.com)

### Acknowledgements

Thanks to [Freddie Poser](https://twitter.com/vogonjeltz101) for reporting the issue to the RainLab team.
Vulnerability: GHSA-rhwp-9vm9-547q
Summary: Command Injection in onion-oled-js
Aliases: CVE-2021-23377
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-05-07T16:06:16Z

This affects all versions up to and including version 0.0.2 of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-vpq5-4rc8-c222
Summary: Denial of Service in canvas
Severity: MODERATE
CVSS score: 0
Published: 2019-06-05T14:10:45Z

Versions of `canvas` prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.


## Recommendation

Upgrade to version 1.6.10
Vulnerability: GHSA-4q97-fh3f-j294
Summary: Prototype Pollution in tiny-conf
Aliases: CVE-2020-7724
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-10T15:59:24Z

All versions of package tiny-conf up to and including version 1.1.0 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-6mqr-q86q-6gwr
Summary: Authentication Bypass by CSRF Weakness
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-352
Published: 2021-11-18T20:15:09Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Vulnerability: GHSA-84qj-9qf2-q92r
Summary: Malicious Package in pm-controls
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T00:32:30Z

Version 1.1.8 of `pm-controls` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-63xm-rx5p-xvqr
Summary: Heap buffer overflow in Tensorflow
Aliases: CVE-2020-15195
Severity: HIGH
CVSS score: 8.5
CWE: CWE-119, CWE-122, CWE-787
Published: 2020-09-25T18:28:29Z

### Impact
The implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L263-L269

It is possible for `reverse_index_map(i)` to be an index outside of bounds of `grad_values`, thus resulting in a heap buffer overflow.

### Patches
We have patched the issue in 390611e0d45c5793c7066110af37c8514e6a6c54 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-vrcc-g6vj-mh5w
Summary: Denial of service in go-ethereum
Aliases: CVE-2021-42219
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-03-18T00:01:13Z

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
Vulnerability: GHSA-6fvx-r7hx-3vh6
Summary: JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
Aliases: CVE-2018-15531
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-611
Published: 2018-10-17T18:28:00Z

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
Vulnerability: GHSA-g785-775g-f2g8
Summary: Downloads Resources over HTTP in haxe
Aliases: CVE-2016-10602
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:50:21Z

Affected versions of `haxe` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe`.


## Recommendation

Update to version 5.0.10 or later.
Vulnerability: GHSA-36mj-6r7r-mqhf
Summary: User can obtain JWT token even if account is disabled
Severity: HIGH
CVSS score: 0
CWE: CWE-284
Published: 2021-09-29T17:09:23Z

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. (Someone who never had an account cannot exploit this vulnerability.) The fix ensures tokens are generated only for enabled user accounts, and is distributed via Composer as ezsystems/ezplatform-rest v1.3.8
Vulnerability: GHSA-hpv4-7p9c-mvfr
Summary: Heap buffer overflow in `FractionalAvgPoolGrad`
Aliases: CVE-2021-37651
Severity: HIGH
CVSS score: 7.1
CWE: CWE-787, CWE-125
Published: 2021-08-25T14:43:21Z

### Impact
The implementation for `tf.raw_ops.FractionalAvgPoolGrad` can be tricked into accessing data outside of bounds of heap allocated buffers:

```python
import tensorflow as tf

tf.raw_ops.FractionalAvgPoolGrad(
  orig_input_tensor_shape=[0,1,2,3],
  out_backprop = np.array([[[[541],[541]],[[541],[541]]]]),
  row_pooling_sequence=[0, 0, 0, 0, 0],
  col_pooling_sequence=[-2, 0, 0, 2, 0],
  overlapping=True)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/fractional_avg_pool_op.cc#L205) does not validate that the input tensor is non-empty. Thus, code constructs an empty `EigenDoubleMatrixMap` and then accesses this buffer with indices that are outside of the empty area.

### Patches
We have patched the issue in GitHub commit [0f931751fb20f565c4e94aa6df58d54a003cdb30](https://github.com/tensorflow/tensorflow/commit/0f931751fb20f565c4e94aa6df58d54a003cdb30).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.