TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-jwqp-28gf-p498
Summary: HTTP authentication credentials potentially leaked to target websites 
Aliases: CVE-2021-41125
Severity: MODERATE
CVSS score: 5.7
CWE: CWE-200, CWE-522
Published: 2021-10-06T17:46:22Z

### Impact

If you use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for HTTP authentication, all requests will expose your credentials to the request target.

This includes requests generated by Scrapy components, such as `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`, or as requests reached through redirects.

### Patches

Upgrade to Scrapy 2.5.1 and use the new `http_auth_domain` spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials.

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.5.1 is not an option, you may upgrade to Scrapy 1.8.1 instead.

### Workarounds

If you cannot upgrade, set your HTTP authentication credentials on a per-request basis, using for example the [`w3lib.http.basic_auth_header`](https://w3lib.readthedocs.io/en/latest/w3lib.html#w3lib.http.basic_auth_header) function to convert your credentials into a value that you can assign to the `Authorization` header of your request, instead of defining your credentials globally using [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth).

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
Vulnerability: GHSA-j42v-6wpm-r847
Summary: Data races in thex
Aliases: CVE-2020-35927
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-662
Published: 2021-08-25T20:50:26Z

An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.
Vulnerability: GHSA-pr9q-v585-qv2w
Summary: Improper Privilege Management in Open Web Analytics
Aliases: CVE-2022-24637
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-269
Published: 2022-03-19T00:01:00Z

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Vulnerability: GHSA-7423-5qfm-g648
Summary: Out-of-bounds write
Aliases: CVE-2019-0916
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-03-29T21:00:09Z

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Vulnerability: GHSA-v94v-pxqp-5qgj
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0950
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-434, CWE-79
Published: 2022-03-16T00:00:48Z

The upload feature of ShowDoc prior to version 2.10.4 allows files with the extension `.*html`, which leads to stored cross-site scripting.
Vulnerability: GHSA-rqf8-8c89-mw29
Summary: Cross-site Scripting in curly-bracket-parser
Aliases: CVE-2021-23416
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-08-10T16:08:16Z

This affects all versions of package curly-bracket-parser.
 When used as a template library, it does not properly sanitize the user input.
Vulnerability: GHSA-9frq-f867-hgqc
Summary: Directory Traversal in fast-http-cli
Aliases: CVE-2017-16155
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:46:25Z

`fast-http-cli` is the command line interface for `fast-http`, a simple web server.

`fast-http-cli` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jmgg-wx67-7qfv
Summary: Command Injection in Centreon
Aliases: CVE-2020-13252
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2021-06-22T15:23:33Z

Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
Vulnerability: GHSA-xcvv-84j5-jw9h
Summary: Prototype Pollution in assign-deep
Aliases: CVE-2018-3720
Severity: LOW
CVSS score: 0
CWE: CWE-471
Published: 2018-07-26T15:12:31Z

Versions of `assign-deep` before 0.4.7 are vulnerable to prototype pollution via merging functions.


## Recommendation

Update to version 0.4.7 or later.
Vulnerability: GHSA-c94v-8fff-73ph
Summary: Command Injection in @theia/messages
Aliases: CVE-2021-28162
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-829
Published: 2021-05-10T15:36:55Z

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Vulnerability: GHSA-x5f3-qmwj-4f84
Summary: Authentication bypass by capture-replay in github.com/cosmos/ethermint
Aliases: CVE-2021-25835
Severity: HIGH
CVSS score: 7.5
CWE: CWE-294, CWE-295
Published: 2022-02-15T01:57:18Z

Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. Since ethermint uses the same chainIDEpoch and signature schemes with ethereum for compatibility, a verified signature in ethereum is still valid in ethermint with the same msg content and chainIDEpoch, which enables "cross-chain transaction replay" attack.
Vulnerability: GHSA-49vv-6q7q-w5cf
Summary: OS Command Injection in Strapi
Aliases: CVE-2019-19609
Severity: HIGH
CVSS score: 7.2
CWE: CWE-20, CWE-78
Published: 2021-12-10T17:22:12Z

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Vulnerability: GHSA-j8cx-j9j2-f29w
Summary: Insecure Storage of Sensitive Information in Microweber
Aliases: CVE-2022-0724
Severity: HIGH
CVSS score: 0
CWE: CWE-922
Published: 2022-02-24T00:00:53Z

Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software.
Vulnerability: GHSA-76wm-422q-92mq
Summary: Code injection in RubyGems
Aliases: CVE-2019-8324
Severity: HIGH
CVSS score: 8.8
CWE: CWE-94
Published: 2019-06-20T16:06:11Z

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
Vulnerability: GHSA-c7pp-g2v2-2766
Summary: DOM-based XSS in gmail-js
Aliases: CVE-2016-1000228
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:32:04Z

Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor.



## Recommendation

Update to version 0.6.5 or later.
Vulnerability: GHSA-5429-pjww-7675
Summary: SQL Injection in Apache Kylin
Aliases: CVE-2021-36774
Severity: MODERATE
CVSS score: 0
CWE: CWE-89, CWE-668
Published: 2022-01-08T00:43:04Z

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.
Vulnerability: GHSA-ffq8-576r-v26g
Summary: High severity vulnerability that affects hpack
Aliases: CVE-2016-6581
Severity: HIGH
CVSS score: 7.5
Published: 2019-07-05T21:11:05Z

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.
Vulnerability: GHSA-m9w8-v359-9ffr
Summary: Moderate severity vulnerability that affects org.apache.activemq:activemq-client
Aliases: CVE-2018-11775
Severity: HIGH
CVSS score: 7.4
CWE: CWE-295
Published: 2018-10-19T16:42:27Z

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client and the ActiveMQ server. This is now enabled by default.
Vulnerability: GHSA-f92j-qf46-p6vm
Summary: Reflected Cross-site Scripting in ACS Commons
Aliases: CVE-2021-21028
Severity: HIGH
CVSS score: 0
CWE: CWE-416, CWE-79
Published: 2021-02-02T15:46:52Z

### Impact

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly.

An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.

### Patches

This issue has been resolved in v4.10.0

### Workarounds

No workaround exist.

### References

N/A

### For more information

If you have any questions or comments about this advisory open an issue in acs-aem-commons.

### Credit

This issue was discovered and reported by Christopher Whipp (Christopher.Whipp@servicesaustralia.gov.au).
Vulnerability: GHSA-qhxx-j73r-qpm2
Summary: Uninitialized memory access in TensorFlow
Aliases: CVE-2020-26266
Severity: LOW
CVSS score: 4.4
CWE: CWE-908
Published: 2020-12-10T19:07:24Z

### Impact
Under certain cases, a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to [default initialize the quantized floating point types in Eigen](https://github.com/tensorflow/tensorflow/blob/f70160322a579144950dff1537dcbe3c7c09d6f5/third_party/eigen3/unsupported/Eigen/CXX11/src/FixedPoint/FixedPointTypes.h#L61-L104):

```cc
struct QUInt8 {
  QUInt8() {}
  // ...
  uint8_t value;
};

struct QInt16 {
  QInt16() {}
  // ...
  int16_t value;
};

struct QUInt16 {
  QUInt16() {}
  // ...
  uint16_t value;
};

struct QInt32 {
  QInt32() {}
  // ...
  int32_t value;
};
```

### Patches
We have patched the issue in GitHub commit [ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2](https://github.com/tensorflow/tensorflow/commit/ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2) and will release TensorFlow 2.4.0 containing the patch. TensorFlow nightly packages after this commit will also have the issue resolved.

Since this issue also impacts TF versions before 2.4, we will patch all releases between 1.15 and 2.3 inclusive.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-7hp2-xwpj-95jq
Summary: Nokogiri, dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash)
Aliases: CVE-2015-8806
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2018-09-17T21:53:42Z

dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an unexpected character immediately after the "<!DOCTYPE html" substring in a crafted HTML document.
Vulnerability: GHSA-65m9-m259-7jqw
Summary: Improper Authorization in react-oauth-flow
Severity: CRITICAL
CVSS score: 0
CWE: CWE-285
Published: 2020-09-03T15:49:29Z

All versions of `react-oauth-flow` fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-3q9x-w53p-jg53
Summary: OS Command Injection in heroku-addonpool
Aliases: CVE-2020-7634
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2021-12-09T19:52:03Z

heroku-addonpool through 0.1.15 is vulnerable to Command Injection.
Vulnerability: GHSA-gr58-j5wh-m333
Summary: Prototype Pollution in nis-utils
Aliases: CVE-2020-7703
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-05-06T17:29:08Z

All versions of package nis-utils up to and including 0.6.10 are vulnerable to Prototype Pollution via the setValue function.
Vulnerability: GHSA-4cpg-3vgw-4877
Summary: Prototype pollution in Plist
Aliases: CVE-2022-22912
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2022-02-18T00:00:33Z

Prototype pollution vulnerability via `.parse()` in Plist allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
Vulnerability: GHSA-9hx4-qm7h-x84j
Summary: Cross-site Scripting in Gogs
Aliases: CVE-2014-8683
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-06-29T18:32:53Z

Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
Vulnerability: GHSA-36r8-9qq7-mh43
Summary: Malicious Package in we3b
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-03T17:02:40Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-2hwx-mjrm-v3g8
Summary: Denial of service attack via .well-known lookups
Aliases: CVE-2021-21274
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-400
Published: 2021-03-01T19:34:54Z

### Impact
A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver.

This affects any server which accepts federation requests from untrusted servers.

### Patches
Issue is resolved by #8950. A bug not affecting the security aspects of this was fixed in #9108.

### Workarounds
The `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
Vulnerability: GHSA-mp28-rq7g-qx62
Summary: Remote code execution in Apache TomEE
Aliases: CVE-2020-13931
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-306
Published: 2022-02-09T22:44:38Z

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.
Vulnerability: GHSA-8w4h-3cm3-2pm2
Summary: Out-of-bounds Read in atob
Aliases: CVE-2018-3745
Severity: MODERATE
CVSS score: 0
CWE: CWE-125
Published: 2018-10-09T00:56:26Z

Versions of `atob` before 2.1.0  uninitialized Buffers when number is passed in input on Node.js 4.x and below.


## Recommendation

Update to version 2.1.0 or later.
Vulnerability: GHSA-qcjv-wfcg-mmpr
Summary: Critical severity vulnerability that affects org.apache.ignite:ignite-core
Aliases: CVE-2018-8018
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2018-10-16T20:53:54Z

Apache Ignite 2.5 and earlier serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to GridClientJdkMarshaller deserialization endpoint.
Vulnerability: GHSA-q7rv-6hp3-vh96
Summary: Improper Input Validation in guzzlehttp/psr7
Aliases: CVE-2022-24775
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2022-03-25T19:26:33Z

### Impact
In proper header parsing. An attacker could sneak in a new line character and pass untrusted values. 

### Patches
The issue is patched in 1.8.4 and 2.1.1

### Workarounds
There are no known workarounds.
Vulnerability: GHSA-2v78-j59h-fmpf
Summary: Heap overflow or corruption in safe-transmute
Aliases: CVE-2018-21000
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2021-08-25T20:43:23Z

An issue was discovered in the safe-transmute crate before 0.10.1 for Rust. A constructor's arguments are in the wrong order, causing heap memory corruption.
Vulnerability: GHSA-h6w6-xmqv-7q78
Summary: High severity vulnerability that affects activerecord
Aliases: CVE-2011-2930
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2017-10-24T18:33:38Z

Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.
Vulnerability: GHSA-2x7h-96h5-rq84
Summary: Path Traversal in SharpZipLib
Aliases: CVE-2021-32841
Severity: MODERATE
CVSS score: 4
CWE: CWE-22
Published: 2022-02-01T16:22:57Z

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.
Vulnerability: GHSA-pvgf-mrr4-cw7r
Summary: Cross-Site Request Forgery in ForkCMS
Aliases: CVE-2020-23960
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2021-05-06T18:53:09Z

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
Vulnerability: GHSA-8mr5-h28g-36qx
Summary: Moderate severity vulnerability that affects org.apache.struts:struts2-core
Aliases: CVE-2017-9787
Severity: HIGH
CVSS score: 7.5
Published: 2018-10-16T19:37:07Z

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
Vulnerability: GHSA-7r94-xv9v-63jw
Summary: A use of uninitialized value vulnerability in Tensorflow
Aliases: CVE-2021-41225
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-908
Published: 2021-11-10T18:44:11Z

### Impact
TensorFlow's Grappler optimizer has a [use of unitialized variable](https://github.com/tensorflow/tensorflow/blob/3457a2b122e50b4d44ceaaed5a663d635e5c22df/tensorflow/core/grappler/optimizers/auto_parallel.cc#L155-L164):

```cc
  const NodeDef* dequeue_node;
  for (const auto& train_node : train_nodes) {
    if (IsDequeueOp(*train_node)) {
      dequeue_node = train_node;
      break;
    }
  }

  if (dequeue_node) {
    ...
  }
```

If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized.

### Patches
We have patched the issue in GitHub commit [68867bf01239d9e1048f98cbad185bf4761bedd3](https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Qian Feng from Baidu Security Team.
Vulnerability: GHSA-fxwv-953p-7qpf
Summary: Phusion Passenger allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header
Aliases: CVE-2015-7519
Severity: LOW
CVSS score: 3.7
CWE: CWE-20
Published: 2018-10-10T17:29:13Z

agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.
Vulnerability: GHSA-8r6h-7x9g-xmw9
Summary: Moderate severity vulnerability that affects will_paginate
Aliases: CVE-2013-6459
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.
Vulnerability: GHSA-mg69-6j3m-jvgw
Summary: HTML Injection in marky-markdown
Severity: HIGH
CVSS score: 7.3
CWE: CWE-79
Published: 2020-09-03T15:45:08Z

All versions of `marky-markdown` are vulnerable to HTML Injection. The package fails to sanitize `style` attributes in `img` tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.


## Recommendation

This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`
Vulnerability: GHSA-p8ww-vv84-c2rm
Summary: Moderate severity vulnerability that affects com.orientechnologies:orientdb-studio
Aliases: CVE-2015-2912
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2018-10-18T17:41:13Z

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.
Vulnerability: GHSA-4mq5-mj59-qq9c
Summary: Allocation of Resources Without Limits or Throttling in Apache Tika
Aliases: CVE-2019-10093
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-770
Published: 2019-08-06T01:43:38Z

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
Vulnerability: GHSA-vq2r-5xvm-3hc3
Summary: Segfault in `CTCBeamSearchDecoder`
Aliases: CVE-2021-29581
Severity: LOW
CVSS score: 2.5
CWE: CWE-908
Published: 2021-05-21T14:26:30Z

### Impact
Due to lack of validation in `tf.raw_ops.CTCBeamSearchDecoder`, an attacker can trigger denial of service via segmentation faults:

```python
import tensorflow as tf

inputs = tf.constant([], shape=[18, 8, 0], dtype=tf.float32)
sequence_length = tf.constant([11, -43, -92, 11, -89, -83, -35, -100],
shape=[8], dtype=tf.int32)
beam_width = 10
top_paths = 3
merge_repeated = True

tf.raw_ops.CTCBeamSearchDecoder(
  inputs=inputs, sequence_length=sequence_length, beam_width=beam_width,
  top_paths=top_paths, merge_repeated=merge_repeated)
``` 

The [implementation](https://github.com/tensorflow/tensorflow/blob/a74768f8e4efbda4def9f16ee7e13cf3922ac5f7/tensorflow/core/kernels/ctc_decoder_ops.cc#L68-L79) fails to detect cases when the input tensor is empty and proceeds to read data from a null buffer.
  
### Patches
We have patched the issue in GitHub commit [b1b323042264740c398140da32e93fb9c2c9f33e](https://github.com/tensorflow/tensorflow/commit/b1b323042264740c398140da32e93fb9c2c9f33e).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-hq5m-mqmx-fw6m
Summary: Privilege escalation via form generator
Aliases: CVE-2021-37627
Severity: HIGH
CVSS score: 8
CWE: CWE-269
Published: 2021-08-23T19:41:22Z

### Impact

It is possible for untrusted users to gain administrator rights with the form generator.

Installations are only affected if there are untrusted back end users with access to the form generator.

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7.

### Workarounds

Disable the form generator or disable the login for untrusted back end users.

### References

https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-c9g6-9335-x697
Summary: Improper Input Validation in SocksJS-Node
Aliases: CVE-2020-7693
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-20
Published: 2021-04-13T15:27:51Z

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Vulnerability: GHSA-7qw5-pqhc-xm4g
Summary: Users with SCRIPT right can execute arbitrary code in XWiki
Aliases: CVE-2020-15171
Severity: LOW
CVSS score: 6.6
CWE: CWE-94, CWE-74
Published: 2020-09-10T19:19:27Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

### Patches

It has been patched in both version XWiki 12.2.1 and XWiki 11.10.5.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-17141
https://jira.xwiki.org/browse/XWIKI-17266

It's been reported by the GitHub Security Lab under #GHSL-2020-046.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-pg53-56cg-4m8q
Summary: Token verification bug in next-auth
Aliases: CVE-2021-21310
Severity: LOW
CVSS score: 0
CWE: CWE-290
Published: 2021-02-11T21:36:24Z

### Impact

Implementations using the **Prisma database adapter** with the **Email provider** **are impacted**.

Implementations using the Prisma database adapter that are not using the Email provider are not impacted.
Implementations using the default database adapter (TypeORM) with the Email provider are not impacted.
Implementations not using a database are not impacted.

### Patches

This issue is fixed in 3.3.0 and newer versions.

### Workarounds

Those not able to upgrade can alternatively disable the Email provider as a workaround.

### Description

The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM).

*Note:  The current community-supported adapter was not developed by Prisma.*

The defect was a problem in the implementation of verification function the adapter and is not directly related to Prisma.

The flaw may exist in other third party database adapters that do not check both the identifier and token values.

The design of the database adapter API may be revised in future to help reduce the likelyhood of similar defects.

### Timeline

On Monday (2021-02-08) we were notified via responsible disclosure by Alessandro Angelino (@AlessandroA) of a flaw in the implementation of the Prisma database adapter included with NextAuth.js. A detailed write up and proof of concept were provided.

The following day (2021-02-09) we published a fix in v3.3.0 and confirmed through internal testing, and with Alessandro, that the issue was resolved in the new release and prompted users to upgrade.

On 2021-02-10 we received a CVE ID and published this advisory within a few hours of notification.

We would like to thank Alessandro for using responsible disclose to allow us to address the issue promptly and publish this advisory once an update was available that resolved the issue and Balázs Orbán (@balazsorban44) for facilitating a timely release of the fix.
Vulnerability: GHSA-qwh6-xwj4-9cjg
Summary: Remote code execution in net.mingsoft:ms-mcms
Aliases: CVE-2021-46384
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2022-03-05T00:00:41Z

net.mingsoft:ms-mcms <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.
Vulnerability: GHSA-pwhf-39xg-4rxw
Summary: Script injection
Aliases: CVE-2021-32660
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-434, CWE-77
Published: 2021-06-04T19:09:35Z

### Impact

A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data.

The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store.

### Patches

The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-hxfw-jm98-v4mq
Summary: Divide By Zero in OpenCV.
Aliases: CVE-2019-15939
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-369
Published: 2021-10-12T22:21:56Z

An issue was discovered in OpenCV 4.1.0 (OpenCV-Python 4.1.0.25). There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
Vulnerability: GHSA-36fm-v9wv-56jf
Summary: Cross-site Scripting in OpenCart
Aliases: CVE-2020-10596
Severity: LOW
CVSS score: 5.4
CWE: CWE-79
Published: 2021-05-06T18:54:04Z

OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.
Vulnerability: GHSA-766v-7gjx-55hf
Summary: Malicious Package in js-shq3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:08:34Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-qpvx-gpqm-g98j
Summary: Critical severity vulnerability that affects Auth0-WCF-Service-JWT
Aliases: CVE-2019-7644
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-209
Published: 2019-04-18T14:28:03Z

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application.
Vulnerability: GHSA-wjfq-88q2-r34j
Summary: Unhandled exception when decoding form response JSON
Severity: HIGH
CVSS score: 7.5
Published: 2022-01-21T23:02:14Z

### Impact
When handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.

An `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.

### Patches
56fe71d939c38fe14e18a31a673a9331bcc0e4ca

### Workarounds
A plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.

Note that this requires copying the body of the function to a plugin, since the function is currently private.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-rcjj-h6gh-jf3r
Summary: Information Disclosure in Apache Groovy
Aliases: CVE-2020-17521
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-379
Published: 2020-12-09T19:03:03Z

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Users not using the extension methods mentioned in the advisory are not affected, but may wish to read the advisory for further details. Versions Affected: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Vulnerability: GHSA-3fhf-6939-qg8p
Summary: High severity vulnerability that affects rest-client
Aliases: CVE-2015-1820
Severity: HIGH
CVSS score: 9.8
CWE: CWE-384
Published: 2018-08-13T20:47:22Z

REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Vulnerability: GHSA-2rmp-fw5r-j5qv
Summary: Improper Authentication in InfluxDB
Aliases: CVE-2019-20933
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-05-18T18:22:05Z

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
Vulnerability: GHSA-m45g-f45x-vv22
Summary: Improper input validation in CNCF Cortex
Aliases: CVE-2021-31232
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-20
Published: 2021-06-23T17:20:38Z

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
Vulnerability: GHSA-p239-93f7-h6xf
Summary: Cross-Site Scripting in swagger-ui
Aliases: CVE-2016-5682
Severity: CRITICAL
CVSS score: 0
CWE: CWE-79
Published: 2020-09-01T15:30:58Z

Affected versions of `swagger-ui` contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document.


## Proof of Concept
The vulnerable object structure is:
```
{
    "definitions": {
        "arbitraryVal": {
            "properties": {
                "<INJECTABLE_KEY_NAME>": "LoremIpsum"
                }
            }
        }
}
```
Malicious JSON documents can be loaded in by providing a URL to them in the `url` query string parameter.



## Recommendation

Update to version 2.2.1 or later.
Vulnerability: GHSA-w6v7-w58j-pg5r
Summary: Improper Verification of Communication Channel in @theia/plugin-ext
Aliases: CVE-2021-41038
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-940
Published: 2021-11-15T17:40:51Z

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Vulnerability: GHSA-7r7m-5h27-29hp
Summary: Potential infinite loop in Pillow
Aliases: CVE-2021-28676
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2021-06-08T18:48:53Z

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Vulnerability: GHSA-88g8-f5mf-f5rj
Summary: Improper Initialization in OpenZeppelin
Aliases: CVE-2021-46320
Severity: HIGH
CVSS score: 7.5
CWE: CWE-665
Published: 2022-02-05T00:00:31Z

In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.
Vulnerability: GHSA-q3j3-w37x-hq2q
Summary: Webcache Poisoning in symfony/http-kernel
Aliases: CVE-2021-41267
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-444
Published: 2021-11-24T20:04:25Z

Description
-----------

When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the `X-Forwarded-*` HTTP headers. HTTP headers that are not part of the "trusted_headers" allowed list are ignored and protect you from "Cache poisoning" attacks. 

In Symfony 5.2, we've added support for the `X-Forwarded-Prefix` header, but this header was accessible in sub-requests, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` HTTP header, leading to a web cache poisoning issue.

Resolution
----------

Symfony now ensures that the `X-Forwarded-Prefix` HTTP header is not forwarded to sub-requests when it is not trusted.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487) for branch 5.3.

Credits
-------

We would like to thank Soner Sayakci for reporting the issue and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-p8jx-x2vw-wm33
Summary: High severity vulnerability that affects org.apache.storm:storm-core
Aliases: CVE-2018-1331
Severity: HIGH
CVSS score: 8.8
Published: 2018-10-17T19:48:06Z

In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.
Vulnerability: GHSA-qm57-vhq3-3fwf
Summary: Header injection possible in Django
Aliases: CVE-2021-32052
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-88, CWE-79
Published: 2021-06-09T17:14:51Z

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.
Vulnerability: GHSA-rj44-gpjc-29r7
Summary: [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
Aliases: CVE-2021-21412
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-78
Published: 2021-04-06T17:22:41Z

### Impact

Potential for arbitrary code execution in `#gpg`-tagged property values (only if `decrypt: true` option is enabled)

### Patches

[A fix](https://github.com/thi-ng/umbrella/commit/3e14765d6bfd8006742c9e7860bc7d58ae94dfa5) has already been released as v0.4.0

### Workarounds

By default, EGF parse functions do NOT attempt to decrypt values (since GPG is only available in non-browser env).

However, if GPG encrypted values are used/required:

1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\`) chars in the encrypted value string
2. Replace/remove them or skip parsing if present...

### References

https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7#advisory-comment-65261

### For more information

If you have any questions or comments about this advisory, please open an issue in the [thi.ng/umbrella repo](https://github.com/thi-ng/umbrella/issues), of which this package is part of.
Vulnerability: GHSA-rhm9-p9w5-fwm7
Summary: Symmetrically encrypting large values can lead to integer overflow
Aliases: CVE-2020-36242
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-787, CWE-190
Published: 2021-02-10T01:32:27Z

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. When certain sequences of `update()` calls with large values (multiple GBs) for symetric encryption or decryption occur, it's possible for an integer overflow to happen, leading to mishandling of buffers. This is patched in version 3.3.2 and newer.
Vulnerability: GHSA-wjx8-cgrm-hh8p
Summary: Unrestricted file uploads in Contao
Aliases: CVE-2019-19745
Severity: HIGH
CVSS score: 8.8
CWE: CWE-434
Published: 2019-12-17T22:53:10Z

### Impact

A back end user with access to the form generator can upload arbitrary files and execute them on the server.

### Patches

Update to Contao 4.4.46 or 4.8.6.

### Workarounds

Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.

### References

https://contao.org/en/security-advisories/unrestricted-file-uploads.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-92px-q4w8-hrr5
Summary: Malicious Package in impala
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:56:52Z

Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.1.7 of this module is found installed you will want to replace it with a version before or after 1.1.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-p4pj-mg4r-x6v4
Summary: Denial of Service in uap-core
Aliases: CVE-2021-21317
Severity: HIGH
CVSS score: 5.3
CWE: CWE-400
Published: 2021-02-02T15:46:38Z

## Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

## Patches

Please update uap-core to >= v0.11.0

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
Vulnerability: GHSA-qfc9-x7gv-27jr
Summary: Malicious Package in deasyncp
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T18:12:36Z

All versions of `deasyncp ` contain malicious code. The package shuts down the machine upon installation as a preinstall script.


## Recommendation

Remove the package from your environment. There is no further compromise.
Vulnerability: GHSA-2fw4-mgq9-39cx
Summary: Code Injection in oauth2-server
Aliases: CVE-2017-18924
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94
Published: 2021-04-22T15:53:45Z

"oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'"