TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-5m9c-634g-47vq
Summary: Downloads Resources over HTTP in steroids
Aliases: CVE-2016-10581
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:35:01Z

Affected versions of `steroids` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `steroids`.


## Recommendation

This vulnerability was discovered and reported in 2016, yet has not seen a patch issued as of 3/2018. 

The best path forward for mitigating this issue is to attempt to use an alternative module that is actively maintained and which provides similar functionality, such as the native PhoneGap API.
Vulnerability: GHSA-p3w3-4ppm-c3f6
Summary: Cross site scripting in FacturaScripts
Aliases: CVE-2022-1514
Severity: CRITICAL
CVSS score: 9
CWE: CWE-79
Published: 2022-04-29T00:00:23Z

FacturaScripts prior to version 2022.06 is vulnerable to stored cross-site scripting via upload plugin functionality in zip format.
Vulnerability: GHSA-gjh4-fcv3-whpq
Summary: Cross-Site Scripting in webtorrent
Aliases: CVE-2019-15782
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-09-04T10:02:50Z

Versions of `webtorrent` prior to 0.107.6 are vulnerable to Cross-Site Scripting. `webtorrent` servers started with `torrent.createServer()` lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent.


## Recommendation

Upgrade to version 0.107.6 or later.
Vulnerability: GHSA-cg3q-j54f-5p7p
Summary: Uncontrolled Resource Consumption in promhttp
Aliases: CVE-2022-21698
Severity: HIGH
CVSS score: 7.5
CWE: CWE-772, CWE-400
Published: 2022-02-16T22:26:35Z

This is the Go client library for Prometheus. It has two separate parts, one for instrumenting application code, and one for creating clients that talk to the Prometheus HTTP API. client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

### Impact

HTTP server susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods.

###  Affected Configuration

In order to be affected, an instrumented software must

* Use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`.
* Do not filter any specific methods (e.g GET) before middleware.
* Pass metric with `method` label name to our middleware.
* Not have any firewall/LB/proxy that filters away requests with unknown `method`.

### Patches

* https://github.com/prometheus/client_golang/pull/962
* https://github.com/prometheus/client_golang/pull/987

### Workarounds

If you cannot upgrade to [v1.11.1 or above](https://github.com/prometheus/client_golang/releases/tag/v1.11.1), in order to stop being affected you can:

* Remove `method` label name from counter/gauge you use in the InstrumentHandler.
* Turn off affected promhttp handlers.
* Add custom middleware before promhttp handler that will sanitize the request method given by Go http.Request.
* Use a reverse proxy or web application firewall, configured to only allow a limited set of methods.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in https://github.com/prometheus/client_golang
* Email us at `prometheus-team@googlegroups.com`
Vulnerability: GHSA-rwvj-jgc4-fqq5
Summary: Downloads Resources over HTTP in cobalt-cli
Aliases: CVE-2016-10597
Severity: HIGH
CVSS score: 0
CWE: CWE-311, CWE-269
Published: 2019-02-18T23:34:05Z

Affected versions of `cobalt-cli` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cobalt-cli`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-h56g-v4vp-q9q6
Summary: Cross-site Scripting in calibreweb
Aliases: CVE-2022-0352
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-01-29T00:00:41Z

calibreweb prior to version 0.6.16 contains a cross-site scripting vulnerability.
Vulnerability: GHSA-qrpm-p2h7-hrv2
Summary: Exposure of Sensitive Information to an Unauthorized Actor in nanoid
Aliases: CVE-2021-23566
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-200
Published: 2022-01-21T23:57:06Z

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Vulnerability: GHSA-44c6-4v22-4mhx
Summary: Regular Expression Denial of Service (ReDOS)
Aliases: CVE-2021-3795
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-400
Published: 2021-09-20T20:42:25Z

npm `semver-regex` is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-2v7p-f4qm-r5pc
Summary: SQL Injection found in Pimcore
Aliases: CVE-2022-1429
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2022-04-23T00:03:03Z

Pimcore is an open source data & experience management platform. A SQL injection was discovered in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.
Vulnerability: GHSA-p6h9-hpcg-c6gm
Summary: High severity vulnerability that affects Plone and Zope2
Aliases: CVE-2011-2528
Severity: HIGH
CVSS score: 0
Published: 2018-07-23T19:52:02Z

Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.
Vulnerability: GHSA-4c7m-vv47-7c69
Summary: Insecure Permissions in Gogs
Aliases: CVE-2020-14958
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-281
Published: 2021-05-18T20:33:05Z

In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.
Vulnerability: GHSA-67j6-xv27-w6ww
Summary: Moderate severity vulnerability that affects web-console
Aliases: CVE-2015-3224
Severity: MODERATE
CVSS score: 0
CWE: CWE-284
Published: 2017-10-24T18:33:36Z

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Vulnerability: GHSA-mh5c-679w-hh4r
Summary: Denial of Service in mongodb
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T21:12:01Z

Versions of `mongodb` prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.


## Recommendation

Upgrade to version 3.1.13 or later.
Vulnerability: GHSA-523c-xh4g-mh5m
Summary: Denial of Service in Apache POI
Aliases: CVE-2017-12626
Severity: HIGH
CVSS score: 7.5
CWE: CWE-835
Published: 2021-01-14T19:18:22Z

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks:
  - Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294)
  - Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295)
Vulnerability: GHSA-wc9v-mj63-m9g5
Summary: Remote Code Execution in pg
Aliases: CVE-2017-16082
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2018-07-24T19:44:42Z

Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. 

There are two specific scenarios in which it is likely for an application to be vulnerable:
1. The application executes unsafe, user-supplied sql which contains malicious column names.
2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.

## Proof of Concept
```
const { Client } = require('pg')
const client = new Client()
client.connect()

const sql = `SELECT 1 AS "\\'/*", 2 AS "\\'*/\n + console.log(process.env)] = null;\n//"`

client.query(sql, (err, res) => {
  client.end()
})
```


## Recommendation

* Version 2.x.x: Update to version 2.11.2 or later.
* Version 3.x.x: Update to version 3.6.4 or later.
* Version 4.x.x: Update to version 4.5.7 or later.
* Version 5.x.x: Update to version 5.2.1 or later.
* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )
* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )
Vulnerability: GHSA-53xv-c2hx-5w6q
Summary: Command Injection in node-windows
Aliases: CVE-2021-45459
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2022-01-05T20:39:21Z

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
Vulnerability: GHSA-gp4j-w3vj-7299
Summary: Information Exposure in RunC
Aliases: CVE-2016-9962
Severity: MODERATE
CVSS score: 6.4
CWE: CWE-200
Published: 2021-12-20T18:21:43Z

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.
Vulnerability: GHSA-jc87-6vpp-7ff3
Summary: Heap buffer overflow in Tensorflow
Aliases: CVE-2020-15198
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-119, CWE-122
Published: 2020-09-25T18:28:22Z

### Impact
The `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has the same shape as the `values` one. The values in these tensors are always accessed in parallel:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L193-L195

Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)
Vulnerability: GHSA-mf4f-j588-5xm8
Summary: Apache Log4j Remote Code Execution
Severity: CRITICAL
CVSS score: 0
Published: 2021-12-14T21:07:14Z

### Impact

Opencast uses an Apache Log4j2 version which, combined with older JDK versions, can be used for remote code execution attacks which have been found to be actively exploited.

Apache Log4j2 <=2.14.1 JNDI features is not sufficiently protected. An attacker who can control log messages or log message parameters can execute arbitrary code when message lookup substitution is enabled.

### Who is affected

- Opencast before 9.10 or 10.6 are affected
    - Log4j version: all 2.x versions before 2.15.0 are affected

### Patches

The issue has been fixed in Opencast 9.10 and 10.6.

### Workarounds

The vulnerability can be mitigated by setting system property `log4j2.formatMsgNoLookups` to `true`.

### References

- [Opencast pull request mitigating the vulnerability](https://github.com/opencast/opencast/pull/3253)
- [CVE-2021-44228 Detail](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
- [Analysis and Remediation Guidance to the Log4j Zero-Day RCE (CVE-2021-44228) Vulnerability](https://www.veracode.com/blog/security-news/urgent-analysis-and-remediation-guidance-log4j-zero-day-rce-cve-2021-44228)
- [VE-2021-44228 – Log4j 2 Vulnerability Analysis](https://www.randori.com/blog/cve-2021-44228/)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)


### Note about dependencies

This issue affects many Java applications. Please also verify these are not vulnerable.
Vulnerability: GHSA-vjv6-gq77-3mjw
Summary: XXE attack in Mapfish Print
Aliases: CVE-2020-15232
Severity: LOW
CVSS score: 9.3
CWE: CWE-611
Published: 2020-07-07T16:32:45Z

### Impact
A user can do to an XML External Entity (XXE) attack with the provided SDL style.

### Patches
Use version >= 3.24

### Workarounds
No

### References
* https://cwe.mitre.org/data/definitions/611.html
* https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e

### For more information
If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397
Vulnerability: GHSA-wfxp-4qgw-qp3c
Summary: XML external entity (XXE) attacks in Jenkins Xcode integration Plugin
Aliases: CVE-2021-21656
Severity: HIGH
CVSS score: 7.1
CWE: CWE-611
Published: 2022-03-18T17:52:43Z

Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-x2p8-rgfm-qw3v
Summary: Access Control vulnerability within CoreNLP
Aliases: CVE-2021-44550
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-863
Published: 2022-02-25T00:01:07Z

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
Vulnerability: GHSA-jf66-3q76-h5p5
Summary: Tenant and Verifier might not use the same registrar data
Aliases: CVE-2022-1053
Severity: MODERATE
CVSS score: 0
Published: 2022-05-05T15:59:35Z

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1. At this time, there are no known workaround.
Vulnerability: GHSA-c9rj-pgxv-84jc
Summary: Exfiltrates data on installation in cofee-script
Aliases: CVE-2017-16206
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2018-08-06T20:12:46Z

The `cofee-script` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

If you have found `cofee-script` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-rrpm-pj7p-7j9q
Summary: Remote code execution affecting org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2018-1260
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2018-10-18T18:05:34Z

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contain a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.

This vulnerability exposes applications that meet all of the following requirements:
- Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer)
- Use the default Approval Endpoint

This vulnerability does not expose applications that:
- Act in the role of an Authorization Server but override the default Approval Endpoint
- Act in the role of a Resource Server only (e.g. @EnableResourceServer)
- Act in the role of a Client only (e.g. @EnableOAuthClient)
Vulnerability: GHSA-8gf4-pcj6-54rp
Summary: Downloads Resources over HTTP in strider-sauce
Aliases: CVE-2016-10611
Severity: HIGH
CVSS score: 8.1
CWE: CWE-311
Published: 2019-02-18T23:47:53Z

Affected versions of `strider-sauce` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `strider-sauce`.



## Recommendation

While the package author has created a patch for this vulnerability, they have not yet published it to npm or bumped the version number.

In order to resolve the vulnerability, you will need to install the module manually from github:
```
npm install github:Strider-CD/strider-sauce#5ff6d65
```

As this vulnerability does not have a version bump included with the patch, it is possible that you have received a report for a vulnerable package, yet have installed the patched version and are no longer vulnerable. If that is the case, this advisory can be disregarded.
Vulnerability: GHSA-f3pp-32qc-36w4
Summary: Prototype Pollution in jointjs
Aliases: CVE-2021-23444
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-843, CWE-1321
Published: 2021-09-22T20:36:34Z

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
Vulnerability: GHSA-rc9v-h28f-jcmf
Summary: There is a XML external entity expansion (XXE) vulnerability in Apache Solr  config files
Aliases: CVE-2018-8010
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-611
Published: 2018-10-17T19:56:04Z

This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerability can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. Users are advised to upgrade to either Solr 6.6.4 or Solr 7.3.1 releases both of which address the vulnerability. Once upgrade is complete, no other steps are required. Those releases only allow external entities and Xincludes that refer to local files / zookeeper resources below the Solr instance directory (using Solr's ResourceLoader); usage of absolute URLs is denied. Keep in mind, that external entities and XInclude are explicitly supported to better structure config files in large installations. Before Solr 6 this was no problem, as config files were not accessible through the APIs.
Vulnerability: GHSA-98hv-qff3-8793
Summary: Unrestricted Upload of File with Dangerous Type in django-widgy
Aliases: CVE-2020-18704
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-434
Published: 2021-08-30T16:24:08Z

Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.
Vulnerability: GHSA-69rr-wvh9-6c4q
Summary: Directory Traversal in st
Aliases: CVE-2014-3744
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2020-08-31T22:58:04Z

Versions of `st` prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused `%2e` to be interpreted as `.` by the filesystem, resulting the potential for an attacker to read sensitive files on the server.


## Recommendation

Update to version 0.2.5 or later.
Vulnerability: GHSA-2mvq-xp48-4c77
Summary: Denial of Service in subtext
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2020-09-03T20:35:29Z

All versions of `subtext` are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

This package is not actively maintained and has been moved to `@hapi/subtext` where version 6.1.2.
Vulnerability: GHSA-cq76-mxrc-vchh
Summary: Crash in `tf.math.segment_*` operations
Aliases: CVE-2021-41195
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-190
Published: 2021-11-10T19:36:50Z

### Impact
The implementation of `tf.math.segment_*` operations results in a `CHECK`-fail related abort (and denial of service) if a segment id in `segment_ids` is large.

```python
import tensorflow as tf

tf.math.segment_max(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
tf.math.segment_min(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
tf.math.segment_mean(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])    
tf.math.segment_sum(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
tf.math.segment_prod(data=np.ones((1,10,1)), segment_ids=[1676240524292489355])
```

This is similar to [CVE-2021-29584](https://github.com/tensorflow/tensorflow/blob/3a74f0307236fe206b046689c4d76f57c9b74eee/tensorflow/security/advisory/tfsa-2021-071.md) (and similar other reported vulnerabilities in TensorFlow, localized to specific APIs): the [implementation](https://github.com/tensorflow/tensorflow/blob/dae66e518c88de9c11718cd0f8f40a0b666a90a0/tensorflow/core/kernels/segment_reduction_ops_impl.h) (both on CPU and GPU) computes the output shape using [`AddDim`](https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/framework/tensor_shape.cc#L395-L408). However, if the number of elements in the tensor overflows an `int64_t` value, `AddDim` results in a `CHECK` failure which provokes a `std::abort`. Instead, code should use [`AddDimWithStatus`](https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/framework/tensor_shape.cc#L410-L440).


### Patches
We have patched the issue in GitHub commit [e9c81c1e1a9cd8dd31f4e83676cab61b60658429](https://github.com/tensorflow/tensorflow/commit/e9c81c1e1a9cd8dd31f4e83676cab61b60658429) (merging [#51733](https://github.com/tensorflow/tensorflow/pull/51733)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.      

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.     

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46888).
Vulnerability: GHSA-hpw4-m59j-9p52
Summary: Directory Traversal in dylmomo
Aliases: CVE-2017-16163
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:29:13Z

Affected versions of `dylmomo` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6wf9-jmg9-vxcc
Summary: XStream can cause a Denial of Service
Aliases: CVE-2021-39140
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-835, CWE-502
Published: 2021-08-25T14:48:39Z

### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39140](https://x-stream.github.io/CVE-2021-39140.html).

### Credits
The vulnerability was discovered and reported by Lai Han of nsfocus security team.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-j9cf-pr2x-5273
Summary: Prototype Pollution in dot-object
Aliases: CVE-2019-10793
Severity: MODERATE
CVSS score: 6.3
CWE: CWE-74
Published: 2022-02-09T22:33:31Z

dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Vulnerability: GHSA-hf79-8hjp-rrvq
Summary: Use After Free in lucet
Aliases: CVE-2021-43790
Severity: HIGH
CVSS score: 8.5
CWE: CWE-416
Published: 2021-11-30T22:20:36Z

### Impact
There is a bug in the main branch of Lucet's `lucet-runtime` that allows a use-after-free in an `Instance` object that could result in memory corruption, data race, or other related issues.  This bug was introduced early in the development of Lucet and is present in all releases.  As a result of this bug, and dependent on the memory backing for the `Instance` objects, it is possible to trigger a use-after-free when the `Instance` is dropped.

### Patches
Users should upgrade to the `main` branch of the Lucet repository. Lucet does not provide versioned releases on crates.io.

### Workarounds
There is no way to remediate this vulnerability without upgrading.

### Description
Lucet uses a "pool" allocator for new WebAssembly instances that are created. This pool allocator manages everything from the linear memory of the wasm instance, the runtime stack for async switching, as well as the memory behind the Instance itself. `Instances` are referred to via an `InstanceHandle` type which will, on drop, release the memory backing the Instance back to the pool.

When an Instance is dropped, the fields of the `Instance` are destructed top-to-bottom, however when the `alloc: Alloc` field is destructed, the memory backing the `Instance` is released back to the pool before the destructors of the remaining fields are run. If another thread allocates the same memory from the pool while these destructors are still running, a race condition occurs that can lead to use-after-free errors.

The bug was corrected by changing how the `InstanceHandle` destructor operates to ensure that the memory backing an Instance is only returned to the pool once the `Instance` has been completely destroyed.

This security advisory has been assigned CVE-2021-43790.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [lucet repository](https://github.com/bytecodealliance/lucet)
* Email [the lucet team](mailto:lucet@fastly.com)
* See the [Bytecode Alliance security policy](https://bytecodealliance.org/security)
Vulnerability: GHSA-3vfw-7rcp-3xgm
Summary: Moderate severity vulnerability that affects actionpack
Aliases: CVE-2011-3187
Severity: MODERATE
CVSS score: 0
CWE: CWE-20
Published: 2017-10-24T18:33:38Z

The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Vulnerability: GHSA-5jq3-8437-x35p
Summary: Multiple cross-site scripting (XSS) vulnerabilities in Roundup
Aliases: CVE-2012-6133
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-04-23T00:40:39Z

Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.
Vulnerability: GHSA-5x5w-v4xq-p64r
Summary: Directory Traversal in ewgaddis.lab6
Aliases: CVE-2017-16175
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-23T20:44:52Z

Affected versions of `ewgaddis.lab6` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6gm7-j668-w6h9
Summary: SQL Injection in Pimcore
Aliases: CVE-2022-1219
Severity: HIGH
CVSS score: 7.5
CWE: CWE-89
Published: 2022-04-09T00:00:30Z

Pimcore prior to version 10.3.5 is vulnerable SQL injection in RecyclebinController.php. This vulnerability affects data confidentiality.
Vulnerability: GHSA-r8hp-5m7c-jhv4
Summary: Cross-site Scripting OrchardCore.Application.Cms.Targets
Aliases: CVE-2022-0274
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2022-01-21T23:08:50Z

Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
Vulnerability: GHSA-8hw9-22v6-9jr9
Summary: Any logged in user could edit any other logged in user.
Aliases: CVE-2021-29452
Severity: HIGH
CVSS score: 8.1
CWE: CWE-269
Published: 2021-04-19T15:14:33Z

### Impact
Everyone who is running a12n-server. 

A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.

### Patches
Patched in v0.18.2
Vulnerability: GHSA-v24h-pjjv-mcp6
Summary: Denial of service in Tendermint
Aliases: CVE-2020-5303
Severity: LOW
CVSS score: 3.1
CWE: CWE-789, CWE-787
Published: 2021-05-27T18:44:09Z

### Description

**Denial of Service 1**

Tendermint 0.33.2 and earlier does not limit the number of P2P connection requests. For each p2p connection, Tendermint allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. 

Tendermint 0.33.3 (and 0.32.10) limits the total number of P2P incoming connection requests to to `p2p.max_num_inbound_peers + len(p2p.unconditional_peer_ids)`.

Notes:

- Tendermint does not rate limit P2P connection requests per IP (an attacker can saturate all the inbound slots);
- Tendermint does not rate limit HTTP(S) requests. If you expose any RPC endpoints to the public, please make sure to put in place some protection (https://www.nginx.com/blog/rate-limiting-nginx/). We may implement this in the future (https://github.com/tendermint/tendermint/issues/1696).

**Denial of Service 2**

Tendermint 0.33.2 and earlier does not reclaim `activeID` of a peer after it's removed in `Mempool` reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the `Peer` is created and added to all reactors. `RemovePeer` is therefore called before `AddPeer`, which leads to always growing memory (`activeIDs` map). The `activeIDs` map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting Denial of Service 1), which ultimately will lead to the node panicking.

Tendermint 0.33.3 (and 0.32.10) claims `activeID` for a peer in `InitPeer`, which is executed before `MConnection` is started.

Notes: 

- `InitPeer` function was added to all reactors to combat a similar issue - https://github.com/tendermint/tendermint/issues/3338;
- Denial of Service 2 is independent of Denial of Service 1 and can be executed without it.

### Impact

- All full nodes (except for validators who are behind closed networks)
- Node's memory usage increases, then it panics either in the mempool or due to OOM.

### Patches

- v0.33.3
- v0.32.10
- v0.31.12

### Workarounds

No workarounds.

### References

- https://hackerone.com/reports/820317 (not disclosed yet)
- https://github.com/tendermint/tendermint/issues/3338
- https://github.com/tendermint/tendermint/issues/1696

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [tendermint/tendermint](https://github.com/tendermint/tendermint)
* Email us at [security@tendermint.com](mailto:security@tendermint.com)

More information can be found [here](https://tendermint.com/security/).

### Credits

- [fudongbai](https://hackerone.com/fudongbai) for discovering and reporting Denial of Service 2
- Ethan Buchman (@ebuchman) for writing a test case for Denial of Service 2 and Tess Rinearson (@tessr) for fixing it
- Anton Kaliaev (@melekes) for fixing Denial of Service 1
Vulnerability: GHSA-hf23-9pf7-388p
Summary: Deserialization of Untrusted Data and Code Injection in xstream
Aliases: CVE-2019-10173
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94, CWE-502
Published: 2019-07-26T16:09:47Z

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Vulnerability: GHSA-vc6r-4x6g-mmqc
Summary: Path Traversal in m-server
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2019-06-11T16:16:23Z

Versions of `m-server` before 1.4.2 are vulnerable to path traversal allowing a remote attacker to display content of arbitrary files from the server.


## Recommendation

Update to version 1.4.2 or later.
Vulnerability: GHSA-wqhw-frpx-5mmp
Summary: Command Injection in tomato
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-02T16:01:33Z

All versions of `tomato` are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-6qh5-wx38-q92g
Summary: Directory Traversal in ltt.js
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2019-05-30T17:15:59Z

Affected versions of `ltt.js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cx4j-fxr7-jxg8
Summary: Double free in glsl-layout
Aliases: CVE-2021-25902
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:53:01Z

An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, map_array can perform a double drop.
Vulnerability: GHSA-m4hj-wg2r-qpcr
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3776
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-352
Published: 2021-11-15T23:13:34Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-9m6f-7xcq-8vf8
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36183
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:34Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
Vulnerability: GHSA-vfp9-gwrh-wq9g
Summary: Path Traversal in crud-file-server
Aliases: CVE-2018-3733
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-18T21:20:19Z

Versions of `crud-file-server` prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 0.9.0 or later.
Vulnerability: GHSA-w4xf-2pqw-5mq7
Summary: Reference binding to nullptr in `RaggedTensorToVariant`
Aliases: CVE-2021-37666
Severity: HIGH
CVSS score: 7.8
CWE: CWE-824
Published: 2021-08-25T14:42:13Z

### Impact
An attacker can cause undefined behavior via binding a reference to null pointer in `tf.raw_ops.RaggedTensorToVariant`:

```python
import tensorflow as tf

tf.raw_ops.RaggedTensorToVariant(
  rt_nested_splits=[],
  rt_dense_values=[1,2,3],
  batched_input=True)
```
  
The [implementation](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty.

### Patches
We have patched the issue in GitHub commit [be7a4de6adfbd303ce08be4332554dff70362612](https://github.com/tensorflow/tensorflow/commit/be7a4de6adfbd303ce08be4332554dff70362612).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-r2rg-683g-ff96
Summary: Malicious Package in axios-http
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T19:40:12Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-4q96-9f63-p7jj
Summary: Path Traversal in ImpressCMS
Aliases: CVE-2021-26601
Severity: HIGH
CVSS score: 8.1
CWE: CWE-22
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.
Vulnerability: GHSA-jf7h-7m85-w2v2
Summary: Integer overflow in TFLite memory allocation
Aliases: CVE-2021-29605
Severity: HIGH
CVSS score: 7.1
CWE: CWE-190
Published: 2021-05-21T14:28:22Z

### Impact
The TFLite code for allocating `TFLiteIntArray`s is [vulnerable to an integer overflow issue](https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L24-L27):

```cc
int TfLiteIntArrayGetSizeInBytes(int size) {
  static TfLiteIntArray dummy;
  return sizeof(dummy) + sizeof(dummy.data[0]) * size;
}   
```

An attacker can craft a model such that the `size` multiplier is so large that the return value overflows the `int` datatype and becomes negative. In turn, this results in [invalid value being given to `malloc`](https://github.com/tensorflow/tensorflow/blob/4ceffae632721e52bf3501b736e4fe9d1221cdfa/tensorflow/lite/c/common.c#L47-L52):

```cc
TfLiteIntArray* TfLiteIntArrayCreate(int size) {
  TfLiteIntArray* ret = (TfLiteIntArray*)malloc(TfLiteIntArrayGetSizeInBytes(size));
  ret->size = size; 
  return ret;
}
``` 

In this case, `ret->size` would dereference an invalid pointer.

### Patches
We have patched the issue in GitHub commit [7c8cc4ec69cd348e44ad6a2699057ca88faad3e5](https://github.com/tensorflow/tensorflow/commit/7c8cc4ec69cd348e44ad6a2699057ca88faad3e5).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-gf8j-v8x5-h9qp
Summary: XSS in enshrined/svg-sanitize due to mishandled script and data values in attributes
Aliases: CVE-2019-18857
Severity: HIGH
CVSS score: 7.5
CWE: CWE-79
Published: 2020-01-08T17:15:37Z

enshrined/svg-sanitize before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript&#9;:alert substring.
Vulnerability: GHSA-g9xh-3w5g-229r
Summary: SQL Injection in LibreNMS
Aliases: CVE-2019-10671
Severity: HIGH
CVSS score: 8.8
CWE: CWE-89
Published: 2019-10-11T18:43:33Z

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
Vulnerability: GHSA-hr52-f9vp-582c
Summary: Use of Uninitialized Resource in messagepack-rs.
Aliases: CVE-2021-45692
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:12:28Z

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
Vulnerability: GHSA-mf79-f657-47ww
Summary: Insufficient Session Expiration in Admidio
Aliases: CVE-2022-0991
Severity: HIGH
CVSS score: 8.2
CWE: CWE-613
Published: 2022-03-20T00:00:29Z

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.
Vulnerability: GHSA-v86x-f47q-f7f4
Summary: Unauthorized File Access in atompm
Severity: HIGH
CVSS score: 0
CWE: CWE-200
Published: 2020-09-11T21:09:24Z

Versions of `atompm` prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system.


## Recommendation

Upgrade to version 0.8.2 or later.
Vulnerability: GHSA-vrgh-5w3c-ggf8
Summary: showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Aliases: CVE-2021-3990
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-338
Published: 2021-12-03T20:38:50Z

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG).
Vulnerability: GHSA-vhm6-gw82-6f8j
Summary: Cross site scripting in LibreNMS
Aliases: CVE-2022-0772
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2022-02-28T00:00:34Z

LibreNMS prior to version 22.2.2 is vulnerable to cross-site scripting.
Vulnerability: GHSA-7rjr-3q55-vv33
Summary: Incomplete fix for Apache Log4j vulnerability
Aliases: CVE-2021-45046
Severity: CRITICAL
CVSS score: 9
CWE: CWE-502
Published: 2021-12-14T18:01:28Z

# Impact

The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. 

## Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

# Mitigation

Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).

Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.
Vulnerability: GHSA-3f97-rj68-2pjf
Summary: Malicious Package in buffe2-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:48:35Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.