TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-q62h-jw38-24vh
Summary: Uncaught Exception in zip4j
Aliases: CVE-2022-24615
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-248, CWE-755
Published: 2022-02-25T00:01:04Z

zip4j up to 2.9.1 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
Vulnerability: GHSA-mr4x-c4v9-x729
Summary: Moderate severity vulnerability that affects aiohttp-session
Aliases: CVE-2018-1000814
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-613
Published: 2018-12-20T22:01:46Z

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.
Vulnerability: GHSA-jwhm-9cjm-4493
Summary: Cross-site Scripting in Jenkins Dashboard View Plugin
Aliases: CVE-2021-21649
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-06-16T17:24:41Z

Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
Vulnerability: GHSA-4cmx-hrq9-c23p
Summary: Improper Authorization in aedes
Aliases: CVE-2018-3778
Severity: MODERATE
CVSS score: 0
CWE: CWE-285
Published: 2018-08-15T20:03:22Z

Versions of `aedes` before 0.35.1 does not respect its own authorization rules when a client sets a `Last Will`.


## Recommendation

Update to version 0.35.1 or later.
Vulnerability: GHSA-77gc-v2xv-rvvh
Summary: Out-of-bounds Read in Pillow
Aliases: CVE-2021-25287
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-125
Published: 2021-06-08T18:49:02Z

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
Vulnerability: GHSA-43gc-mjxg-gvrq
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21350
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-434, CWE-502
Published: 2021-03-22T23:29:28Z

### Impact
The vulnerability may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21350](https://x-stream.github.io/CVE-2021-21350.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-wg96-3933-j2w5
Summary: Cross-Site Scripting in sanitize-html
Aliases: CVE-2017-16017
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2018-11-09T17:45:55Z

Affected versions of `sanitize-html` are vulnerable to cross-site scripting.

## Proof of Concept:

`<IMG SRC= onmouseover="alert('XSS');">`
produces the following:

`<img src="onmouseover="alert('XSS');"" />`
This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.


## Recommendation

Update to version 1.2.3 or later.
Vulnerability: GHSA-rp2c-jrgp-cvr8
Summary: Code injection in plupload
Aliases: CVE-2021-23562
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-434, CWE-75
Published: 2021-12-16T15:32:31Z

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
Vulnerability: GHSA-75p6-52g3-rqc8
Summary: Privilege escalation vulnerability on Token Exchange feature
Aliases: CVE-2022-1245
Severity: MODERATE
CVSS score: 0
CWE: CWE-284
Published: 2022-04-26T21:21:00Z

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Vulnerability: GHSA-j438-45hc-vjhm
Summary: CSRF and DNS Rebinding in Oasis
Aliases: CVE-2020-11003
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-352
Published: 2020-04-16T03:14:39Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) and [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery) attacks to read/write to vulnerable applications. 

**There is no evidence that suggests that this has been used in the wild.**

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, 2.15.0.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No.

### References
_Are there any links users can visit to find out more?_

No.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fraction/oasis](http://github.com/fraction/oasis)
* Email me at [christianbundy@fraction.io](mailto:christianbundy@fraction.io)
Vulnerability: GHSA-mg53-xr8m-86hw
Summary: Open Redirect in Liferay Portal
Aliases: CVE-2020-24554
Severity: HIGH
CVSS score: 7.5
CWE: CWE-601
Published: 2021-05-07T15:54:54Z

The redirect module in Liferay Portal before 7.3.3 does not limit the number of URLs resulting in a 404 error that is recorded, which allows remote attackers to perform a denial of service attack by making repeated requests for pages that do not exist.
Vulnerability: GHSA-7627-mp87-jf6q
Summary: Command injection in cocoapods-downloader
Aliases: CVE-2022-24440
Severity: HIGH
CVSS score: 8.1
CWE: CWE-88, CWE-74
Published: 2022-04-02T00:00:13Z

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-3vg7-jw9m-pc3f
Summary: Broken Access Control in Form Framework
Aliases: CVE-2021-21357
Severity: HIGH
CVSS score: 7.9
CWE: CWE-434, CWE-20, CWE-22
Published: 2021-03-23T01:53:57Z


### Problem
Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework.

In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation.

A valid backend user account with access to the form module is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 contributor Ralf Zimmermann who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-003](https://typo3.org/security/advisory/typo3-core-sa-2021-003)
Vulnerability: GHSA-hv87-47h9-jcvq
Summary: Uncontrolled recursion in rust-yaml
Aliases: CVE-2018-20993
Severity: HIGH
CVSS score: 7.5
CWE: CWE-674
Published: 2021-08-25T20:43:13Z

An issue was discovered in the yaml-rust crate before 0.4.1 for Rust. There is uncontrolled recursion during deserialization.
Vulnerability: GHSA-fjr6-hm39-4cf9
Summary: Double free in basic_dsp_matrix
Aliases: CVE-2021-25906
Severity: HIGH
CVSS score: 7.5
CWE: CWE-415
Published: 2021-08-25T20:52:50Z

An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
Vulnerability: GHSA-f8rj-4v7g-p5rj
Summary: Directory Traversal in jansenstuffpleasework
Aliases: CVE-2017-16176
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:53:29Z

Affected versions of `jansenstuffpleasework` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-378p-hrq3-x4p3
Summary: Cross-site scripting in Shopizer
Aliases: CVE-2021-33562
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2021-06-08T23:08:20Z

A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.
Vulnerability: GHSA-hfj4-96f7-6r5g
Summary: Cross-Site Scripting in html-janitor
Aliases: CVE-2017-0931
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2018-11-09T17:49:11Z

Versions of `html-janitor` prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).

This is exploitable if user-controlled data is passed into the modules `clean()` function.


## Recommendation

No fix is currently available for this vulnerability. It is recommended to use an alternative module for HTML sanitization.
Vulnerability: GHSA-g78p-g85h-q6ww
Summary: Data races in cache
Aliases: CVE-2020-36448
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:57:12Z

An issue was discovered in the cache crate through 2020-11-24 for Rust. 
Affected versions of this crate unconditionally implement Send/Sync for `Cache<K>`.
This allows users to insert `K` that is not Send or not Sync.

This allows users to create data races by using non-Send types like `Arc<Cell<T>>` or `Rc<T>` as `K` in `Cache<K>`. It is also possible to create data races by using types like `Cell<T>` or `RefCell<T>` (types that are `Send` but not `Sync`).
Such data races can lead to memory corruption.
Vulnerability: GHSA-9vp3-7qwq-83r9
Summary: Server-Side Request Forgery in FUXA
Aliases: CVE-2021-45851
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2022-03-17T00:00:48Z

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
Vulnerability: GHSA-333g-rpr4-7hxq
Summary: Backdoor / Malicious code
Aliases: CVE-2019-15224
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2019-08-20T14:29:03Z

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
Vulnerability: GHSA-r9cj-xj33-4q42
Summary: Malicious Package in buffgr-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:21:54Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-f248-v4qh-x2r6
Summary: Improper Certificate Validation in blackduck
Aliases: CVE-2020-27589
Severity: HIGH
CVSS score: 7.5
CWE: CWE-295
Published: 2021-04-20T16:29:41Z

Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
Vulnerability: GHSA-qwvx-c8j7-5g75
Summary: Use of Uninitialized Resource in tectonic_xdv
Aliases: CVE-2021-45703
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:09:19Z

An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
Vulnerability: GHSA-2xvj-j3qh-x8c3
Summary: High severity vulnerability that affects private_address_check
Aliases: CVE-2018-3759
Severity: HIGH
CVSS score: 0
CWE: CWE-362
Published: 2018-07-31T18:13:05Z

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.
Vulnerability: GHSA-gwpx-q2h9-wxgx
Summary: elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Aliases: CVE-2021-3964
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-639
Published: 2021-12-03T20:43:25Z

elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Vulnerability: GHSA-4xrw-wvmq-8jmh
Summary: OS Command Injection in node-key-sender
Aliases: CVE-2020-7627
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2022-02-10T23:46:11Z

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.
Vulnerability: GHSA-g37q-26qx-8v2m
Summary: Denial of service in Apache OpenMeetings
Aliases: CVE-2020-13951
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2022-02-10T20:36:45Z

Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
Vulnerability: GHSA-35fg-hjcr-j65f
Summary: Information exposure in xwiki-platform
Aliases: CVE-2022-23619
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-200, CWE-640
Published: 2022-02-09T21:51:19Z

### Impact
It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users.

### Patches
The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.

### Workarounds
There's no easy workaround other than applying the upgrade.

### References

https://jira.xwiki.org/browse/XWIKI-18787

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security Mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-x2w5-725j-gf2g
Summary: Prototype Pollution in convict
Aliases: CVE-2022-22143
Severity: HIGH
CVSS score: 8.4
CWE: CWE-1321
Published: 2022-04-20T16:21:03Z

An attacker can inject attributes that are used in other components and override existing attributes with ones that have incompatible type, which may lead to a crash.

The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.

The problem is patched in `convict@6.2.2`. Users should upgrade to `convict@6.2.2`. There is no way for users to fix or remediate the vulnerability without upgrading.
Vulnerability: GHSA-hcq6-h8v2-r5wm
Summary: Server-Side Request Forgery in node-pdf-generator
Aliases: CVE-2020-7740
Severity: HIGH
CVSS score: 8.2
CWE: CWE-20, CWE-918
Published: 2021-05-10T18:38:34Z

This affects all versions of package node-pdf-generator up to and including 0.0.6. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
Vulnerability: GHSA-fwvp-x5gj-773j
Summary: Malicious Package in react-server-native
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-01T20:33:10Z

Version 0.0.7 of `react-server-native` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.7 of this module is found installed you will want to replace it with a version before or after 0.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-wjxj-f8rg-99wx
Summary: Moderate severity vulnerability that affects org.apache.thrift:libthrift
Aliases: CVE-2018-1320
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-295
Published: 2019-01-17T13:56:40Z

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Vulnerability: GHSA-xj6q-9hx8-mm7f
Summary: Directory Traversal in liuyaserver
Aliases: CVE-2017-16170
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T17:34:34Z

Affected versions of `liuyaserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-673x-f5wx-fxpw
Summary: Cross Site Scripting and RCE in baserCMS
Aliases: CVE-2020-15159
Severity: LOW
CVSS score: 7.6
CWE: CWE-79
Published: 2020-08-28T21:45:15Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).

* Impact: XSS to RCE via Arbitrary file upload.
* Attack vector is: Administrator must be logged in.
* Components are: ThemeFilesController.php, UploaderFilesController.php.
* Tested baserCMS Version : 4.3.6 (Latest)
* Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
* Patches : https://basercms.net/security/20200827

Found by Vulnerability Research team in [Flatt Security Inc.](https://flatt.tech/)
Vulnerability: GHSA-hf2m-j98r-4fqw
Summary: API token verification can be bypassed in NodeBB 
Aliases: CVE-2021-43786
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-11-30T22:21:05Z

### Impact
Incorrect logic present in the token verification step unintentionally allowed master token access to the API.

### Patches
The vulnerability has been patch as of v1.18.5.

### Workarounds
Cherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability: GHSA-cqqj-4p63-rrmm
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2019-20444
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-444
Published: 2020-02-21T18:55:24Z

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."
Vulnerability: GHSA-v88g-cgmw-v5xw
Summary: Prototype Pollution in Ajv
Aliases: CVE-2020-15366
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-915
Published: 2022-02-10T23:30:59Z

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Vulnerability: GHSA-xf27-jqwv-gf3r
Summary: Unintended Require in larvitbase-api
Aliases: CVE-2019-5479
Severity: MODERATE
CVSS score: 0
CWE: CWE-98
Published: 2019-09-11T23:03:57Z

Versions of `larvitbase-api` prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running.


## Recommendation

Upgrade to version 0.5.4 or later.
Vulnerability: GHSA-5629-8855-gf4g
Summary: Authentication Bypass by CSRF Weakness 
Severity: CRITICAL
CVSS score: 9.3
CWE: CWE-352, CWE-305
Published: 2021-11-18T20:12:40Z

### Impact
The actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end.

### Patches
For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`.

### Workarounds
Look at the workarounds described at [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### References
- [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
Vulnerability: GHSA-xr9h-9m79-x29g
Summary: SSRF in Rendertron
Aliases: CVE-2020-8902
Severity: MODERATE
CVSS score: 0
CWE: CWE-918
Published: 2021-03-01T19:38:23Z

Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are to upgrade your rendertron to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your internal domain.
Vulnerability: GHSA-579h-mv94-g4gp
Summary: Privilege Escalation in Kubernetes
Aliases: CVE-2018-1002105
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-269
Published: 2022-02-15T01:57:18Z

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
Vulnerability: GHSA-g7w8-pp9w-7p32
Summary: Creation of order credits was not validated by acl in admin orders
Severity: LOW
CVSS score: 0
CWE: CWE-306
Published: 2021-06-28T16:57:32Z

### Impact
Creation of order credits was not validated by ACL in admin orders

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-xpfv-89vg-r562
Summary: Cross Site Request Forgery in Moodle
Aliases: CVE-2022-0335
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2022-01-28T22:07:23Z

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Vulnerability: GHSA-p9g3-vpvp-hcj5
Summary: Malicious Package in bufber-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:41:55Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-mcfm-h73v-635m
Summary: High severity vulnerability that affects io.undertow:undertow-core
Aliases: CVE-2017-2666
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-444
Published: 2018-10-19T16:55:14Z

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
Vulnerability: GHSA-322m-p39j-r5m2
Summary: Malicious Package in npm-script-demo
Aliases: CVE-2017-16128
Severity: MODERATE
CVSS score: 0
CWE: CWE-506
Published: 2020-09-01T18:55:37Z

The `npm-script-demo` package is a piece of malware that opens a connection to a command and control server and executed the instructions it is given.

It has been removed from the npm registry.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer has been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-68wg-qv6r-j4vp
Summary: SQL Injection in usmanhalalit/pixie
Aliases: CVE-2019-10766
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-89
Published: 2019-11-20T17:44:54Z

Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
Vulnerability: GHSA-3fxp-vwxm-2r5p
Summary: Command injection in gitlogplus
Aliases: CVE-2021-23412
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-77
Published: 2021-07-26T21:23:35Z

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
Vulnerability: GHSA-7fjp-g4m7-fx23
Summary: User (Encrypted) Password Field Being Serialised
Severity: LOW
CVSS score: 0
CWE: CWE-200
Published: 2021-04-13T15:12:26Z

### Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.

### Patches
Issue has been patched in version 0.3.7-beta and onwards.

### Workarounds
Add the 'password' field to the Users model file in the hidden array:

```php

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'remember_token',
        'password',
    ];
```


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)
* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)
Vulnerability: GHSA-p86x-652p-6385
Summary: Incorrect Default Permissions in keyring
Aliases: CVE-2012-5577
Severity: HIGH
CVSS score: 7.5
CWE: CWE-276
Published: 2020-03-11T21:36:38Z

Python keyring lib before 0.10 created keyring files with world-readable permissions.
Vulnerability: GHSA-g54x-29xv-58h5
Summary: Remote code execution in Subrion
Aliases: CVE-2021-43464
Severity: HIGH
CVSS score: 8.8
Published: 2022-04-05T00:00:23Z

Subrion is an open source php content management system. A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().
Vulnerability: GHSA-8hmr-w35f-3qgj
Summary: Malicious Package in harmlesspackage
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:07:37Z

Version 0.0.1 of `harmlesspackage` contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server.


## Recommendation

Remove the package from your environment. There is no evidence of further compromise.
Vulnerability: GHSA-23f7-99jx-m54r
Summary: Remote code execution in dependabot-core branch names when cloning
Aliases: CVE-2020-26222
Severity: LOW
CVSS score: 8.7
CWE: CWE-74
Published: 2020-11-13T15:47:50Z

### Impact
Remote code execution vulnerability in `dependabot-common` and  `dependabot-go_modules` when a source branch name contains malicious injectable bash code.

For example, if Dependabot is configured to use the following source branch name: `"/$({curl,127.0.0.1})"`, Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository.

When Dependabot is configured to clone the source repository during an update, Dependabot runs a shell command to git clone the repository:

```bash
git clone --no-tags --no-recurse-submodules --depth=1 --branch=<BRANCH> --single-branch <GITHUB_REPO_URL> repo/contents/path
```

Dependabot will always clone the source repository for `go_modules` during the file fetching step and can be configured to clone the repository for other package managers using the `FileFetcher` class from `dependabot-common`.

```ruby
source = Dependabot::Source.new(
  provider: "github",
  repo: "repo/name",
  directory: "/",
  branch: "/$({curl,127.0.0.1})",
)

repo_contents_path = "./file/path"
fetcher = Dependabot::FileFetchers.for_package_manager("bundler").
                  new(source: source, credentials: [],
                  repo_contents_path: repo_contents_path)
fetcher.clone_repo_contents
```

### Patches

The fix was applied to version `0.125.1`: https://github.com/dependabot/dependabot-core/pull/2727

### Workarounds
Escape the branch name prior to passing it to the `Dependabot::Source` class.

For example using `shellwords`:

```ruby
require "shellwords"
branch = Shellwords.escape("/$({curl,127.0.0.1})")
source = Dependabot::Source.new(
  provider: "github",
  repo: "repo/name",
  directory: "/",
  branch: branch,
)
```
Vulnerability: GHSA-m6cx-g6qm-p2cx
Summary: Arbitrary File Write in npm
Aliases: CVE-2019-16775
Severity: HIGH
CVSS score: 7.7
CWE: CWE-61, CWE-59
Published: 2019-12-13T15:39:19Z

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to create files on a user's system when the package is installed. It is only possible to affect files that the user running `npm install` has access to and it is not possible to over write files that already exist on disk.

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.3 or later.
Vulnerability: GHSA-mwgj-7x7j-6966
Summary: Deserialization of Untrusted Data in ParlAI
Aliases: CVE-2021-24040
Severity: MODERATE
CVSS score: 0
CWE: CWE-502
Published: 2021-09-13T20:06:14Z

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
Vulnerability: GHSA-85rr-4rh9-hhwh
Summary: Memory leak in Nanopb
Aliases: CVE-2020-26243
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-119, CWE-20
Published: 2020-11-25T16:53:27Z

### Impact
Decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.

### Patches
Preliminary patch is [available on git](https://github.com/nanopb/nanopb/commit/edf6dcbffee4d614ac0c2c1b258ab95185bdb6e9) and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.

### Workarounds
Following workarounds are available:
* Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code.
* Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed.
* Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

### References
Bug report: https://github.com/nanopb/nanopb/issues/615

### For more information
If you have any questions or comments about this advisory, comment on the bug report linked above.
Vulnerability: GHSA-384w-5v3f-q499
Summary: Base class whitelist configuration ignored in OAuthenticator
Aliases: CVE-2020-26250
Severity: HIGH
CVSS score: 6.3
CWE: CWE-863
Published: 2020-12-01T20:25:00Z

### Impact

__What goes wrong?__

The deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been set. If this is the only mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all authenticated users will be allowed. Provider-based restrictions, including deprecated values such as `GitHubOAuthenticator.org_whitelist` are **not** affected.

__Who is impacted?__

All users of OAuthenticator 0.12.0 and 0.12.1 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users` configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly. Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not** affected.

If you see a log line like this and expect a specific list of allowed usernames:

```
[I 2020-11-27 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed.
```

you are likely affected.

### Patches

- Replacing deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...` avoids the issue.
- Update oauthenticator to 0.12.2
- Update jupyterhub helm chart to 0.10.6

If any users have been authorized during this time who should not have been, they must be deleted via the API or admin interface, [per the documentation](https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub).

### Workarounds

Replacing `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...` avoids the issue.

In the jupyterhub helm chart prior to 0.10.6, this can be done via `hub.extraConfig`:

```yaml
auth:
  allowedUsers:
  - user1
  - user2

hub:
  extraConfig:
    allowedUsers: |
        # set new field not exposed in helm chart < 0.10.6
        set_config_if_not_none(c.Authenticator, "allowed_users", "auth.allowedUsers")
```


### For more information

If you have any questions or comments about this advisory:

* Open a thread [on the Jupyter forum](http://discourse.jupyter.org)
* Email us at [security@ipython.org](mailto:security@ipython.org)
Vulnerability: GHSA-79hv-pfx6-hhpj
Summary: Cross-site scripting (XSS)
Aliases: CVE-2021-28088
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2021-03-12T21:34:02Z

Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field.
Vulnerability: GHSA-rxq3-gm4p-5fj4
Summary: High severity vulnerability that affects rails
Aliases: CVE-2009-2422
Severity: HIGH
CVSS score: 0
CWE: CWE-287
Published: 2017-10-24T18:33:38Z

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
Vulnerability: GHSA-gcvh-66ff-4mwm
Summary: `CHECK`-failures in Tensorflow
Aliases: CVE-2022-21734
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617, CWE-843
Published: 2022-02-10T00:21:12Z

### Impact 
The [implementation of `MapStage`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/map_stage_op.cc#L519-L550) is vulnerable a `CHECK`-fail if the key tensor is not a scalar:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.MapStage(
    key = tf.constant(value=[4], shape= (1,2), dtype=tf.int64),
    indices = np.array([[6]]),
    values = np.array([-60]),
    dtypes = [tf.int64], capacity=0, memory_limit=0,
    container='', shared_name='', name=None
)   
``` 

### Patches
We have patched the issue in GitHub commit [f57315566d7094f322b784947093406c2aea0d7d](https://github.com/tensorflow/tensorflow/commit/f57315566d7094f322b784947093406c2aea0d7d).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
~
Vulnerability: GHSA-jxg6-fhwc-9v9c
Summary: Regular Expression Denial of Service (ReDoS) in es6-crawler-detect
Aliases: CVE-2020-28501
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-04-13T15:19:39Z

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.
Vulnerability: GHSA-r695-7vr9-jgc2
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36187
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:51Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource.
Vulnerability: GHSA-7mg4-w3w5-x5pc
Summary: Prototype pollution in json-pointer
Aliases: CVE-2020-7709
Severity: MODERATE
CVSS score: 6
CWE: CWE-1321
Published: 2021-05-10T18:37:47Z

This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
Vulnerability: GHSA-crf2-xm6x-46p6
Summary: Observable Timing Discrepancy in OpenMage LTS
Aliases: CVE-2020-15151
Severity: HIGH
CVSS score: 8
CWE: CWE-352, CWE-203
Published: 2020-08-19T18:02:36Z

### Impact
This vulnerability allows to circumvent the **formkey protection** in the Admin Interface and increases the attack surface for  **Cross Site Request Forgery** attacks 

### Patches
The latest OpenMage Versions up from 19.4.6 and 20.0.2 have this Issue solved


### References
Related to Adobes CVE-2020-9690 ( https://helpx.adobe.com/security/products/magento/apsb20-47.html )
fixed in Magento2 https://github.com/magento/magento2/commit/52d72b8010c9cecb5b8e3d98ec5edc1ddcc65fb4
as part of 2.4.0/2.3.5-p2
Vulnerability: GHSA-cghx-9gcr-r42x
Summary: Path Traversal in the Java Kubernetes Client
Aliases: CVE-2020-8570
Severity: MODERATE
CVSS score: 7.5
CWE: CWE-22
Published: 2021-01-29T18:12:54Z

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
Vulnerability: GHSA-jxfh-8wgv-vfr2
Summary: Prototype pollution in dojo
Aliases: CVE-2020-5258
Severity: HIGH
CVSS score: 7.7
CWE: CWE-94, CWE-74, CWE-1321
Published: 2020-03-10T18:03:14Z

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.

Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.
An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. 

This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Vulnerability: GHSA-c289-47qf-rvrr
Summary: Low severity vulnerability that affects easymon
Aliases: CVE-2018-1000855
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-12-21T17:46:03Z

easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies, depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.
Vulnerability: GHSA-832h-xg76-4gv6
Summary: ReDoS in brace-expansion
Aliases: CVE-2017-18077
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2018-01-29T15:50:46Z

Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.

## Proof of Concept

```
var expand = require('brace-expansion');
expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}');
```


## Recommendation

Update to version 1.1.7 or later.
Vulnerability: GHSA-3vv5-42wr-m32g
Summary: Downloads Resources over HTTP in scala-bin
Aliases: CVE-2016-10627
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:57:00Z

Affected versions of `scala-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `scala-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-w655-w578-99pq
Summary: High severity vulnerability that affects espeak-ruby
Severity: HIGH
CVSS score: 0
Published: 2018-08-21T17:09:08Z

Withdrawn, accidental duplicate publish.

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.
Vulnerability: GHSA-8h2j-cgx8-6xv7
Summary: Cross-Site Request Forgery (CSRF) in FastAPI
Aliases: CVE-2021-32677
Severity: HIGH
CVSS score: 8.2
CWE: CWE-352
Published: 2021-06-10T15:43:54Z

### Impact

FastAPI versions lower than `0.65.2` that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack.

In versions lower than `0.65.2`, FastAPI would try to read the request payload as JSON even if the `content-type` header sent was not set to `application/json` or a compatible JSON media type (e.g. `application/geo+json`).

So, a request with a content type of `text/plain` containing JSON data would be accepted and the JSON data would be extracted.

But requests with content type `text/plain` are exempt from [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) preflights, for being considered [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests). So, the browser would execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application.

### Patches

This is fixed in FastAPI `0.65.2`.

The request data is now parsed as JSON only if the `content-type` header is `application/json` or another JSON compatible media type like `application/geo+json`.

### Workarounds

It's best to upgrade to the latest FastAPI.

But still, it would be possible to add a middleware or a dependency that checks the `content-type` header and aborts the request if it is not `application/json` or another JSON compatible content type.

### References

* [CORS on Mozilla web docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
* [This answer on StackExchange](https://security.stackexchange.com/questions/157528/ways-to-bypass-browsers-cors-policy/157531#157531)
* [OWASP CSRF](https://owasp.org/www-community/attacks/csrf)
* Fixed in PR [#2118](https://github.com/tiangolo/fastapi/pull/2118)

### For more information

If you have any questions or comments, write to [security@tiangolo.com](mailto:security@tiangolo.com)
Vulnerability: GHSA-g68x-vvqq-pvw3
Summary: Moderate severity vulnerability that affects ckeditor
Aliases: CVE-2018-17960
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2018-11-21T22:19:50Z

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.