TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-x5cp-9pcf-pp3h
Summary: Denial of Service in Tensorflow
Aliases: CVE-2020-15199
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-20
Published: 2020-09-25T18:28:24Z

### Impact
The `RaggedCountSparseOutput` does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the `splits` tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L241-L244

Since `BatchedMap` is equivalent to a vector, it needs to have at least one element to not be `nullptr`. If user passes a `splits` tensor that is empty or has exactly one element, we get a `SIGABRT` signal raised by the operating system.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)
Vulnerability: GHSA-7x9j-7223-rg5m
Summary: High severity vulnerability that affects commons-fileupload:commons-fileupload
Aliases: CVE-2016-1000031
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-284
Published: 2018-12-21T17:51:51Z

Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Vulnerability: GHSA-h98h-8mxr-m8gx
Summary: Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.
Aliases: CVE-2018-21233
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-125
Published: 2020-05-13T16:01:35Z

TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.
Vulnerability: GHSA-ppqp-78xx-3r38
Summary: Out of bounds write in calamine
Aliases: CVE-2021-26951
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-787
Published: 2021-08-25T20:53:25Z

An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.
Vulnerability: GHSA-grfp-q2mm-hfp6
Summary: Redirect URL matching ignores character casing
Aliases: CVE-2020-15234
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-20, CWE-178, CWE-601
Published: 2021-05-24T17:00:05Z

### Impact

Before version v0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using `strings.ToLower` while they should have been compared with a simple string match:

1. Registering a client with allowed redirect URL `https://example.com/callback`
2. Performing OAuth2 flow and requesting redirect URL `https://example.com/CALLBACK`
3. Instead of an error (invalid redirect URL), the browser is redirected to `https://example.com/CALLBACK` with a potentially successful OAuth2 response, depending on the state of the overall OAuth2 flow (the user might still deny the request for example).
Vulnerability: GHSA-545v-42p7-98fq
Summary: Heap out of bounds read in `MaxPoolGradWithArgmax`
Aliases: CVE-2021-29570
Severity: LOW
CVSS score: 2.5
CWE: CWE-125
Published: 2021-05-21T14:25:25Z

### Impact
The implementation of `tf.raw_ops.MaxPoolGradWithArgmax` can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs:

```python
import tensorflow as tf

input = tf.constant([10.0, 10.0, 10.0], shape=[1, 1, 3, 1], dtype=tf.float32)
grad = tf.constant([10.0, 10.0, 10.0, 10.0], shape=[1, 1, 1, 4], dtype=tf.float32)
argmax = tf.constant([1], shape=[1], dtype=tf.int64)
ksize = [1, 1, 1, 1]
strides = [1, 1, 1, 1]
  
tf.raw_ops.MaxPoolGradWithArgmax(
  input=input, grad=grad, argmax=argmax, ksize=ksize, strides=strides,
  padding='SAME', include_batch_in_index=False)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/ef0c008ee84bad91ec6725ddc42091e19a30cf0e/tensorflow/core/kernels/maxpooling_op.cc#L1016-L1017) uses the same value to index in two different arrays but there is no guarantee that the sizes are identical. 

### Patches
We have patched the issue in GitHub commit [dcd7867de0fea4b72a2b34bd41eb74548dc23886](https://github.com/tensorflow/tensorflow/commit/dcd7867de0fea4b72a2b34bd41eb74548dc23886).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. 

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-23cm-x6j7-6hq3
Summary: matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
Aliases: CVE-2021-40823
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-200
Published: 2021-09-14T20:24:18Z

### Impact

A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.

† Or anyone with access to the account of the original recipient of an encrypted message.

Known clients affected (via their use of vulnerable versions of matrix-js-sdk):

- Element Web (1.8.2 and earlier)
- Element Desktop (1.8.2 and earlier)
- SchildiChat Web (1.7.32-sc1 and earlier)
- SchildiChat Desktop (1.7.32-sc1 and earlier)
- Cinny (1.2.0 and earlier)

### Patch

This was fixed in https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9.

### Workarounds
To prevent a homeserver from being able to steal the room keys, vulnerable clients can be taken offline or signed out. If signing out, care should be taken to either set up Secure Backup or export E2E room keys in order to preserve access to past messages.
Vulnerability: GHSA-mvjj-gqq2-p4hw
Summary: Cross-Site Scripting in react-dom
Aliases: CVE-2018-6341
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2019-01-04T19:05:35Z

Affected versions of `react-dom` are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
- be a server-side React app
- be rendered to HTML using `ReactDOMServer`
- include an attribute name from user input in an HTML tag


## Recommendation

If you are using `react-dom` 16.0.x, upgrade to 16.0.1 or later.  
If you are using `react-dom` 16.1.x, upgrade to 16.1.2 or later.  
If you are using `react-dom` 16.2.x, upgrade to 16.2.1 or later.  
If you are using `react-dom` 16.3.x, upgrade to 16.3.3 or later.  
If you are using `react-dom` 16.4.x, upgrade to 16.4.2 or later.
Vulnerability: GHSA-qpjr-ch72-2qq4
Summary: Use after free in portaudio-rs
Aliases: CVE-2019-16881
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:45:17Z

An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.
Vulnerability: GHSA-g5vf-v6wf-7w2r
Summary: Ciphertext Malleability Issue in Tink Java
Aliases: CVE-2020-8929
Severity: LOW
CVSS score: 5.3
CWE: CWE-327, CWE-176
Published: 2020-10-16T00:51:24Z

### Impact
Tink's Java version before 1.5 under some circumstances allowed attackers to change the key ID part of the ciphertext, resulting in the attacker creating a second ciphertext that will decrypt to the same plaintext. This can be a problem in particular in the case of encrypting with a deterministic AEAD with a single key, and relying on the fact that there is only a single valid ciphertext per plaintext.

No loss of confidentiality or loss of plaintext integrity occurs due to this problem, only ciphertext integrity is compromised.

### Patches
The issue was fixed in this [pull request](https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899).

### Workarounds
The only workaround is to backport the fixing [pull request](https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899).

### Details
Tink uses the first five bytes of a ciphertext for a version byte and a four byte key ID. Since each key has a well defined prefix, this extends non-malleability properties (but technically not indistinguishability). However, in the Java version this prefix lookup used a hash map indexed by unicode strings instead of the byte array, which means that invalid Unicode characters would be [replaced by U+FFFD](https://en.wikipedia.org/wiki/UTF-8#Invalid_sequences_and_error_handling) by the [Java API's default behavior](https://docs.oracle.com/javase/7/docs/api/java/lang/String.html#String(byte[],%20java.nio.charset.Charset)). This means several different values for the five bytes would result in the same hash table key, which allows an attacker to exchange one invalid byte sequence for another, creating a mutated ciphertext that still decrypts (to the same plaintext).

### Acknowledgements
We'd like to thank Peter Esbensen for finding this issue and raising it internally.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Tink](https://github.com/google/tink/issues)
Vulnerability: GHSA-jqqr-c2r2-9cvr
Summary: Improper Certificate Validation in security-framework
Aliases: CVE-2017-18588
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-295
Published: 2021-08-25T20:42:59Z

An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
Vulnerability: GHSA-h86j-6h6m-qjqw
Summary: Cross-Site Request Forgery in remdex/livehelperchat
Aliases: CVE-2021-4049
Severity: LOW
CVSS score: 0
CWE: CWE-352
Published: 2021-12-10T20:26:34Z

An attacker is able to log out a user if a logged-in user visits the attacker's website. While this cannot harm a user's account, it can be a great annoyance and is a valid CSRF.
Vulnerability: GHSA-432j-4fw9-2g6f
Summary: Downloads Resources over HTTP in libsbml
Aliases: CVE-2016-10668
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:44:33Z

Affected versions of `libsbml` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libsbml`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5mv2-rx3q-4w2v
Summary: Code injection in Twig
Aliases: CVE-2022-23614
Severity: HIGH
CVSS score: 8.8
CWE: CWE-74
Published: 2022-02-10T22:21:48Z

# Description

When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.

# Resolution

We now disallow calling non Closure in the `sort` filter like we already did for some other filters.

# Credits

We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.
Vulnerability: GHSA-943p-xc6m-c6gr
Summary: Rejected CVE ID
Aliases: CVE-2018-7574
Severity: HIGH
CVSS score: 0
Published: 2019-04-30T15:37:27Z

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-7576,
CVE-2018-21233. Reason: this candidate was intended for one issue, but the
description and references inadvertently combined multiple issues. Notes:
All CVE users should consult CVE-2018-7576 and CVE-2018-21233 to determine
which ID is appropriate. All references and descriptions in this candidate
have been removed to prevent accidental usage.
Vulnerability: GHSA-p639-xxv5-j383
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2018-1315
Severity: LOW
CVSS score: 3.7
CWE: CWE-732
Published: 2018-11-21T22:24:08Z

In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not verify the destination location of the downloaded file. This does not affect hive cli user and hiveserver2 user as hplsql is a separate command line script and needs to be invoked differently.
Vulnerability: GHSA-m6xf-fq7q-8743
Summary: mutation XSS via whitelisted math or svg and raw tag in Bleach
Aliases: CVE-2020-6816
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-03-24T15:06:32Z

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* the `svg` or `math` in the allowed/whitelisted tags
* an RCDATA tag (see below) in the allowed/whitelisted tags
* the keyword argument `strip=False`

### Patches

Users are encouraged to upgrade to bleach v3.1.2 or greater.

### Workarounds

* modify `bleach.clean` calls to use `strip=True`, or not whitelist `math` or `svg` tags and one or more of the following tags:

```
script
noscript
style
noframes
xmp
noembed
iframe
```

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1621692
* https://cure53.de/fp170.pdf
* https://nvd.nist.gov/vuln/detail/CVE-2020-6816
* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)
Vulnerability: GHSA-p55x-7x9v-q8m4
Summary: Denial of Service in miekg-dns
Aliases: CVE-2017-15133
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-29T21:45:07Z

A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.
Vulnerability: GHSA-g7mq-rfj2-25wq
Summary: Code Injection in total4
Aliases: CVE-2021-23390
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-12-10T17:26:33Z

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Vulnerability: GHSA-h9x2-5rm7-x4gm
Summary: Insecure Comparison in secure-compare
Aliases: CVE-2015-9238
Severity: HIGH
CVSS score: 0
CWE: CWE-697
Published: 2019-06-03T17:28:23Z

Versions of `secure-compare` prior to 3.0.1 are affected by a vulnerability that results in the package always returning true when comparing two strings of the same length, despite differences in the contents of those strings.


## Recommendation

Upgrade to version 3.0.1 or later.
Vulnerability: GHSA-5h9j-q6j2-253f
Summary: Unescaped exception messages in error responses in Jetty
Aliases: CVE-2019-17632
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-12-02T18:13:28Z

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.
Vulnerability: GHSA-rc3x-jf5g-xvc5
Summary: Open redirect in karma
Aliases: CVE-2021-23495
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-601
Published: 2022-02-26T00:00:38Z

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.
Vulnerability: GHSA-32v7-ghpr-c8hg
Summary: Mishandling of format strings in ncurses
Aliases: CVE-2019-15547
Severity: HIGH
CVSS score: 7.5
CWE: CWE-134
Published: 2021-08-25T20:58:47Z

An issue was discovered in the ncurses crate for Rust. There are format string issues in printw functions because C format arguments are mishandled.
Vulnerability: GHSA-h9px-9vqg-222h
Summary: Heap OOB in `QuantizeAndDequantizeV3`
Aliases: CVE-2021-29553
Severity: LOW
CVSS score: 2.5
CWE: CWE-125
Published: 2021-05-21T14:23:51Z

### Impact
An attacker can read data outside of bounds of heap allocated buffer in `tf.raw_ops.QuantizeAndDequantizeV3`:

```python
import tensorflow as tf

tf.raw_ops.QuantizeAndDequantizeV3(
  input=[2.5,2.5], input_min=[0,0], input_max=[1,1], num_bits=[30],
  signed_input=False, range_given=False, narrow_range=False, axis=3)
```   

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/11ff7f80667e6490d7b5174aa6bf5e01886e770f/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L237) does not validate the value of user supplied `axis` attribute before using it to index in the array backing the `input` argument:

```cc
const int depth = (axis_ == -1) ? 1 : input.dim_size(axis_);
```

### Patches
We have patched the issue in GitHub commit [99085e8ff02c3763a0ec2263e44daec416f6a387](https://github.com/tensorflow/tensorflow/commit/99085e8ff02c3763a0ec2263e44daec416f6a387).
  
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Aivul Team from Qihoo 360.
Vulnerability: GHSA-cpxc-67rc-c775
Summary: Cross Site Scripting in baserCMS
Aliases: CVE-2020-15154
Severity: LOW
CVSS score: 7.3
CWE: CWE-79
Published: 2020-08-28T20:48:12Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS).

* Impact: XSS via Arbitrary script execution.
* Attack vector is: Administrator must be logged in.
* Components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js
* Tested baserCMS Version : 4.3.6 (Latest)
* Affected baserCMS Version : 4.0.0 ~ 4.3.6
* Patches : https://basercms.net/security/20200827

Found by Aquilao Null
Vulnerability: GHSA-h7qh-3h6f-w79p
Summary: Unexpected panic in multihash
Aliases: CVE-2020-35909
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-08-25T20:49:41Z

An issue was discovered in the multihash crate before 0.11.3 for Rust. The from_slice parsing code can panic via unsanitized data from a network server.
Vulnerability: GHSA-2w67-526p-gm73
Summary: redis-store deserializes untrusted data the affected version range and description should be adjust to match as well
Aliases: CVE-2017-1000248
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-502
Published: 2017-12-06T16:41:25Z

Redis-store <=v1.3.0 allows unsafe objects to be loaded from redis
Vulnerability: GHSA-pgf9-h69p-pcgf
Summary: High severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2015-5211
Severity: HIGH
CVSS score: 8.6
CWE: CWE-20
Published: 2018-10-17T20:29:33Z

Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Vulnerability: GHSA-769f-539v-f5jg
Summary: PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
Severity: HIGH
CVSS score: 0
Published: 2020-01-08T03:10:44Z

### Impact

We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).

### Patches

In the [security patch](https://github.com/PrestaShop/gamification/releases/tag/v2.3.2), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com
Vulnerability: GHSA-qq89-hq3f-393p
Summary: Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Aliases: CVE-2021-37712
Severity: HIGH
CVSS score: 8.2
CWE: CWE-59, CWE-22
Published: 2021-08-31T16:05:17Z

### Impact
Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained two directories and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include directories with two forms of the path that resolve to the same file system entity, followed by a symbolic link with a name in the first form, lastly followed by a file using the second form. It led to bypassing node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

The v3 branch of `node-tar` has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of `node-tar`. If this is not possible, a workaround is available below.

### Patches

6.1.9 || 5.0.10 || 4.4.18

### Workarounds

Users may work around this vulnerability without upgrading by creating a custom filter method which prevents the extraction of symbolic links.

```js
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})
```

Users are encouraged to upgrade to the latest patched versions, rather than attempt to sanitize tar input themselves.

#### Fix

The problem is addressed in the following ways, when comparing paths in the directory cache and path reservation systems:

1. The `String.normalize('NFKD')` method is used to first normalize all unicode to its maximally compatible and multi-code-point form.
2. All slashes are normalized to `/` on Windows systems (on posix systems, `\` is a valid filename character, and thus left intact).
3. When a symbolic link is encountered on Windows systems, the entire directory cache is cleared.  Collisions related to use of 8.3 short names to replace directories with other (non-symlink) types of entries may make archives fail to extract properly, but will not result in arbitrary file writes.
Vulnerability: GHSA-8336-mxp6-v5h9
Summary: Moderate severity vulnerability that affects OPCFoundation.NetStandard.Opc.Ua
Aliases: CVE-2018-12087
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-295
Published: 2018-10-16T19:51:18Z

Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network infrastructure to decrypt passwords.
Vulnerability: GHSA-xg59-m7wx-853q
Summary: Cross-site Scripting in node-red-dashboard
Aliases: CVE-2019-10756
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2019-10-25T19:41:24Z

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
Vulnerability: GHSA-hgjh-723h-mx2j
Summary: Authorization Bypass Through User-Controlled Key in url-parse
Aliases: CVE-2022-0686
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-639
Published: 2022-02-21T00:00:21Z

url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.
Vulnerability: GHSA-frcq-4ffq-v4mw
Summary: Directory Traversal in lessindex
Aliases: CVE-2017-16211
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:12:07Z

Affected versions of `lessindex` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4vvp-x9h2-x2vf
Summary: Path Traversal in public
Severity: MODERATE
CVSS score: 0
CWE: CWE-22
Published: 2020-09-03T20:26:39Z

All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.


## Recommendation

No fix is currently available. Do not use `public` in production or consider using an alternative module until a fix is made available.
Vulnerability: GHSA-3q5q-f79q-7hr2
Summary: High severity vulnerability that affects rubyzip
Severity: HIGH
CVSS score: 0
Published: 2018-07-31T18:21:46Z

Withdrawn, accidental duplicate publish.

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
Vulnerability: GHSA-vxf6-w9mp-95hm
Summary: Low severity vulnerability that affects puppet
Aliases: CVE-2012-3408
Severity: LOW
CVSS score: 0
CWE: CWE-287
Published: 2017-10-24T18:33:38Z

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Vulnerability: GHSA-vmqm-g3vh-847m
Summary: Denial of service in Apache Xerces2
Aliases: CVE-2012-0881
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-06-15T18:51:38Z

Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Vulnerability: GHSA-9m4x-8w29-r78g
Summary: Server-Side Request Forgery in @uppy/companion
Aliases: CVE-2020-8205
Severity: MODERATE
CVSS score: 0
CWE: CWE-918
Published: 2020-08-13T18:54:19Z

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
Vulnerability: GHSA-vw27-fwjf-5qxm
Summary: Arbitrary command execution on Windows via qutebrowserurl: URL handler
Aliases: CVE-2021-41146
Severity: HIGH
CVSS score: 8.8
CWE: CWE-88, CWE-77, CWE-641
Published: 2021-10-22T16:20:10Z

### Impact
Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers it as a handler for certain URL schemes. With some applications such as Outlook Desktop, opening a specially crafted URL can lead to argument injection, allowing execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`.

Only Windows installs where qutebrowser is registered as URL handler are affected. It does *not* have to be set as default browser for the exploit to work.

### Patches
The issue has been fixed in [qutebrowser v2.4.0](https://github.com/qutebrowser/qutebrowser/releases/tag/v2.4.0) in commit 8f46ba3f6dc7b18375f7aa63c48a1fe461190430.

The fix also adds additional hardening for potential similar issues on Linux (by adding the new `--untrusted-args` flag to the `.desktop` file), though no such vulnerabilities are known.

Backported patches for older versions are available, but no further releases are planned:

- v1.7.x: d1ceaab
- v1.8.x: ca7155d
- v1.9.x: 157d871
- v1.10.x: 94a6125
- v1.11.x: 10acfbb
- v1.12.x: 363a18f
- v1.13.x: 410f262
- v1.14.x: e4f4d93
- v2.0.x: 15a1654
- v2.1.x: 509ddf2
- v2.2.x: 03dcba5
- v2.3.x: 00a694c

(commits are referring to qutebrowser/qutebrowser on GitHub)

### Workarounds
Remove qutebrowser from the default browser settings entirely, so that it does not handle any kind of URLs. Make sure to remove *all* handlers, including an (accidental) `qutebrowserURL` handler, e.g. using [NirSoft URLProtocolView](https://www.nirsoft.net/utils/url_protocol_view.html).

### Timeline
2021-10-15: Issue reported via security@qutebrowser.org by Ping Fan (Zetta) Ke of [Valkyrie-X Security Research Group (VXRL)](https://www.vxrl.hk/)
2021-10-15: Issue confirmed by @The-Compiler (lead developer), author of installer (@bitraid) contacted for help/review
2021-10-15: CVE assigned by GitHub
2021-10-15 to 2021-10-17: Fix developed
2021-10-17: Additional core developer (@toofar) contacted for help/review
2021-10-21: v2.4.0 released containing the fix
2021-10-21: Advisory and fix published

### References
See the [commit message](https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430) for additional information and references to various similar issues in other projects.

### Acknowledgements
Thanks to Ping Fan (Zetta) Ke of [Valkyrie-X Security Research Group](https://www.vxrl.hk/) (VXRL/@vxresearch) for finding and responsibly disclosing this issue.

### Contact
If you have any questions or comments about this advisory, please email [security@qutebrowser.org](mailto:security@qutebrowser.org).
Vulnerability: GHSA-c968-pq7h-7fxv
Summary: Division by 0 in `Conv3DBackprop*`
Aliases: CVE-2021-29522
Severity: LOW
CVSS score: 2.5
CWE: CWE-369
Published: 2021-05-21T14:21:39Z

### Impact
The `tf.raw_ops.Conv3DBackprop*` operations fail to validate that the input tensors are not empty. In turn, this would result in a division by 0:

```python
import tensorflow as tf

input_sizes = tf.constant([0, 0, 0, 0, 0], shape=[5], dtype=tf.int32)
filter_tensor = tf.constant([], shape=[0, 0, 0, 1, 0], dtype=tf.float32)
out_backprop = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32)
                            
tf.raw_ops.Conv3DBackpropInputV2(input_sizes=input_sizes, filter=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```
```python
import tensorflow as tf

input_sizes = tf.constant([1], shape=[1, 1, 1, 1, 1], dtype=tf.float32)
filter_tensor = tf.constant([0, 0, 0, 1, 0], shape=[5], dtype=tf.int32)
out_backprop = tf.constant([], shape=[1, 1, 1, 1, 0], dtype=tf.float32)

tf.raw_ops.Conv3DBackpropFilterV2(input=input_sizes, filter_sizes=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1])
```

This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/a91bb59769f19146d5a0c20060244378e878f140/tensorflow/core/kernels/conv_grad_ops_3d.cc#L430-L450) does not check that the divisor used in computing the shard size is not zero:

```cc
  const int64 size_A = output_image_size * dims.out_depth;
  const int64 size_B = filter_total_size * dims.out_depth;
  const int64 size_C = output_image_size * filter_total_size;
  const int64 work_unit_size = size_A + size_B + size_C;
  ...
  const size_t shard_size =
      use_parallel_contraction
        ? 1
        : (target_working_set_size + work_unit_size - 1) / work_unit_size;
```

Thus, if attacker controls the input sizes, they can trigger a denial of service via a division by zero error.

### Patches
We have patched the issue in GitHub commit [311403edbc9816df80274bd1ea8b3c0c0f22c3fa](https://github.com/tensorflow/tensorflow/commit/311403edbc9816df80274bd1ea8b3c0c0f22c3fa).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Vulnerability: GHSA-2f5j-3mhq-xv58
Summary: Double free in sys-info 
Aliases: CVE-2020-36434
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:58:15Z

An issue was discovered in the sys-info crate before 0.8.0 for Rust. sys_info::disk_info calls can trigger a double free.
Vulnerability: GHSA-jxgm-9f58-w4xp
Summary: Improper Input Validation in Apache Archiva
Aliases: CVE-2019-0214
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2019-05-14T04:00:21Z

In Apache Archiva 2.0.0 - 2.2.3, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Vulnerability: GHSA-6h2c-g688-q9qr
Summary: Path traversal in Jenkins Phoenix AutoTest Plugin
Aliases: CVE-2022-28156
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2022-03-30T00:00:24Z

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.
Vulnerability: GHSA-hm82-qr45-h7mw
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in field
Aliases: CVE-2020-28269
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-915
Published: 2021-12-10T17:22:58Z

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-hxx6-p24v-wg8c
Summary: High severity vulnerability that affects curl
Aliases: CVE-2013-2617
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2017-10-24T18:33:37Z

lib/curl.rb in the Curl Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
Vulnerability: GHSA-4g46-5grc-wq49
Summary: Cross-Site Scripting in seeftl
Aliases: CVE-2019-15603
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2020-04-01T16:36:31Z

All versions of `seeftl` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-f78f-353m-cf4j
Summary: Code Injection in node-rules
Aliases: CVE-2020-7609
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2021-12-10T20:05:37Z

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
Vulnerability: GHSA-c7pr-343r-5c46
Summary: missing clamps for decimal args in external functions
Aliases: CVE-2021-41122
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-682
Published: 2021-10-06T17:48:46Z

### Impact

The following code does not properly validate that its input is in bounds.

```python
@external
def foo(x: decimal) -> decimal:
    return x
```

### Patches
0.3.0 / #2447

### Workarounds
Don't use decimal args
Vulnerability: GHSA-w942-gw6m-p62c
Summary: Denial of service in GJSON
Aliases: CVE-2020-35380
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-06-23T17:53:05Z

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Vulnerability: GHSA-qwfw-gxx2-mmv2
Summary: Command Injection in Kylin
Aliases: CVE-2020-13925
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-78
Published: 2020-07-27T22:51:37Z

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.
Vulnerability: GHSA-cj43-9h3w-v976
Summary: Moderate severity vulnerability that affects puppet
Aliases: CVE-2013-4761
Severity: MODERATE
CVSS score: 0
Published: 2017-10-24T18:33:37Z

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
Vulnerability: GHSA-5379-r78w-42h2
Summary: Unlimited transforms allowed for signed nodes
Aliases: CVE-2021-39171
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-400
Published: 2021-08-30T16:11:57Z

### Impact
A malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack.

### Patches
This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

### References
https://github.com/node-saml/passport-saml/pull/595
Vulnerability: GHSA-84wg-rgp8-2hg4
Summary: Command Injection in Apache James
Aliases: CVE-2021-38542
Severity: MODERATE
CVSS score: 0
CWE: CWE-77
Published: 2022-01-08T00:40:33Z

Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Vulnerability: GHSA-6m26-25q2-cq46
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0763
Severity: MODERATE
CVSS score: 4.8
CWE: CWE-79
Published: 2022-02-27T00:00:15Z

Microweber Cross-site Scripting (XSS) - Stored XSS vulnerability on admin page up to version 1.3.
Vulnerability: GHSA-267x-w5hx-8hjr
Summary: Integer Overflow or Wraparound in OpenCV
Aliases: CVE-2017-12864
Severity: HIGH
CVSS score: 8.8
CWE: CWE-190
Published: 2021-10-12T22:02:45Z

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier.
Vulnerability: GHSA-qh4w-7pw3-p4rp
Summary: Potential denial of service in bson rubygem
Aliases: CVE-2015-4411
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2020-04-29T15:34:50Z

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
Vulnerability: GHSA-w3f4-3q6j-rh82
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2018-5968
Severity: HIGH
CVSS score: 8.1
CWE: CWE-184, CWE-502
Published: 2020-06-30T20:40:50Z

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
Vulnerability: GHSA-xqfj-cr6q-pc8w
Summary: Crash in `tf.transpose` with complex inputs
Aliases: CVE-2021-29618
Severity: LOW
CVSS score: 2.5
CWE: CWE-755
Published: 2021-05-21T14:28:58Z

### Impact
Passing a complex argument to `tf.transpose` at the same time as passing `conjugate=True` argument results in a crash:

```python 
import tensorflow as tf
tf.transpose(conjugate=True, a=complex(1))
```

### Patches
We have received a patch for the issue in GitHub commit [1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88](https://github.com/tensorflow/tensorflow/commit/1dc6a7ce6e0b3e27a7ae650bfc05b195ca793f88).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported in [#42105](https://github.com/tensorflow/issues/42105) and fixed in [#46973](https://github.com/tensorflow/issues/46973).
Vulnerability: GHSA-wppj-3pjr-9w79
Summary: crater is vulnerable to Unrestricted Upload of File with Dangerous Type
Aliases: CVE-2021-4080
Severity: HIGH
CVSS score: 8.8
CWE: CWE-434
Published: 2022-01-21T23:55:11Z

crater is vulnerable to Unrestricted Upload of File with Dangerous Type
Vulnerability: GHSA-q7wx-62r7-j2x7
Summary: Moderate severity vulnerability that affects nokogiri
Aliases: CVE-2015-1819
Severity: MODERATE
CVSS score: 0
Published: 2018-08-08T22:31:12Z

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Vulnerability: GHSA-hpcf-8vf9-q4gj
Summary: XSS in dialog closeText in jquery-ui
Aliases: CVE-2016-7103
Severity: HIGH
CVSS score: 6.1
CWE: CWE-79
Published: 2017-10-24T18:33:35Z

Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. 

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog`  function.  If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.


## Recommendation

Upgrade to jQuery-UI 1.12.0 or later.
Vulnerability: GHSA-c3h9-896r-86jm
Summary: Improper Input Validation in GoGo Protobuf
Aliases: CVE-2021-3121
Severity: HIGH
CVSS score: 8.6
CWE: CWE-20, CWE-129
Published: 2022-03-28T20:28:00Z

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
Vulnerability: GHSA-q24h-5rq3-63j9
Summary: Incorrect Authorization in @uppy/companion
Aliases: CVE-2022-0528
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-863
Published: 2022-03-04T00:00:19Z

@uppy/companion prior to version 3.3.1 is vulnerable to incorrect authorization. A user with URL upload access could enumerate internal companion server networks, send local webservers files to the destination server, and finally download them If each of these files had a guessable and regular name.
Vulnerability: GHSA-p46c-w9m3-7qr2
Summary: Use of Uninitialized Resource in flumedb.
Aliases: CVE-2021-45684
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-908
Published: 2022-01-06T22:18:35Z

An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.
Vulnerability: GHSA-ggjr-2f7v-vhq4
Summary: Authentication Bypass in Kiali
Aliases: CVE-2021-20278
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-290
Published: 2021-06-01T21:57:08Z

An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
Vulnerability: GHSA-hxm2-r34f-qmc5
Summary: Regular Expression Denial of Service in minimatch
Aliases: CVE-2016-10540
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-10-09T00:40:41Z

Affected versions of `minimatch` are vulnerable to regular expression denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`.


## Proof of Concept
```
var minimatch = require(“minimatch”);

// utility function for generating long strings
var genstr = function (len, chr) {
  var result = “”;
  for (i=0; i<=len; i++) {
    result = result + chr;
  }
  return result;
}

var exploit = “[!” + genstr(1000000, “\\”) + “A”;

// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
```


## Recommendation

Update to version 3.0.2 or later.
Vulnerability: GHSA-m93v-9qjc-3g79
Summary: Context isolation bypass via leaked cross-context objects in Electron
Aliases: CVE-2020-4076
Severity: HIGH
CVSS score: 7.8
CWE: CWE-501
Published: 2020-07-07T00:01:07Z

### Impact
Apps using `contextIsolation` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### Non-Impacted Versions
* `9.0.0-beta.*`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)