TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-mr6r-82x4-f4jj
Summary: Timing attacks might allow practical recovery of the long-term private key
Aliases: CVE-2019-10764
Severity: HIGH
CVSS score: 7.4
CWE: CWE-203
Published: 2019-11-20T01:34:50Z

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.
Vulnerability: GHSA-438g-fx34-4h9m
Summary: Out of bounds read in simple-slab
Aliases: CVE-2020-35892
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-125
Published: 2021-08-25T20:48:38Z

An issue was discovered in the simple-slab crate before 0.3.3 for Rust. index() allows an out-of-bounds read.
Vulnerability: GHSA-4xc9-xhrj-v574
Summary: Prototype Pollution in lodash
Aliases: CVE-2018-16487
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2019-02-07T18:16:48Z

Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. 

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.11 or later.
Vulnerability: GHSA-vx9j-46rh-fqr8
Summary: Moderate severity vulnerability that affects actionview
Aliases: CVE-2016-2097
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
Vulnerability: GHSA-r53w-g4xm-3gc6
Summary: Cross-site scripting in Haml
Aliases: CVE-2017-1002201
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-10-21T21:59:13Z

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like < > " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
Vulnerability: GHSA-786j-5qwq-r36x
Summary: Segfault while copying constant resource tensor
Aliases: CVE-2021-41204
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-824
Published: 2021-11-10T19:12:14Z

### Impact
During TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change.

### Patches
We have patched the issue in GitHub commit [7731e8dfbe4a56773be5dc94d631611211156659](https://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions
Vulnerability: GHSA-fhj9-cjjh-27vm
Summary: Critical severity vulnerability that affects activerecord
Aliases: CVE-2013-0277
Severity: CRITICAL
CVSS score: 0
Published: 2017-10-24T18:33:37Z

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Vulnerability: GHSA-mxh3-2699-98g9
Summary: Cross-site Scripting pimcore
Aliases: CVE-2022-0510
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-02-09T00:00:28Z

pimcore version 10.3.0 and prior is vulnerable to cross-site scripting.
Vulnerability: GHSA-pjh3-jv7w-9jpr
Summary: Command Injection in gm
Aliases: CVE-2015-7982
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-01T15:18:55Z

Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary.


## Recommendation

Update to version 1.21.1 or later.
Vulnerability: GHSA-86gv-xpwv-jprc
Summary: Malicious Package in diamond-clien
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:36:00Z

All versions of `diamond-clien` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fp82-2h99-3fpp
Summary: Prototype Pollution in async merge-object
Aliases: CVE-2018-3753
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20, CWE-1321
Published: 2018-09-18T13:47:24Z

The utilities function in all versions of the merge-object node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Vulnerability: GHSA-xvch-r4wf-h8w9
Summary: Moderate severity vulnerability that affects org.apache.qpid:proton-j
Aliases: CVE-2018-17187
Severity: HIGH
CVSS score: 7.4
CWE: CWE-295
Published: 2018-11-21T22:22:21Z

The Apache Qpid Proton-J transport includes an optional wrapper layer to perform TLS, enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode was explicitly configured, client and server modes previously defaulted as documented to not verifying a peer certificate, with options to configure this explicitly or select a certificate verification mode with or without hostname verification being performed. The latter hostname verifying mode was not implemented in Apache Qpid Proton-J versions 0.3 to 0.29.0, with attempts to use it resulting in an exception. This left only the option to verify the certificate is trusted, leaving such a client vulnerable to Man In The Middle (MITM) attack. Uses of the Proton-J protocol engine which do not utilise the optional transport TLS wrapper are not impacted, e.g. usage within Qpid JMS. Uses of Proton-J utilising the optional transport TLS wrapper layer that wish to enable hostname verification must be upgraded to version 0.30.0 or later and utilise the VerifyMode#VERIFY_PEER_NAME configuration, which is now the default for client mode usage unless configured otherwise.
Vulnerability: GHSA-3p22-ghq8-v749
Summary: Renderers can obtain access to random bluetooth device without permission in Electron
Aliases: CVE-2022-21718
Severity: LOW
CVSS score: 3.4
CWE: CWE-668
Published: 2022-03-22T18:49:36Z

### Impact
This vulnerability allows renderers to obtain access to a random bluetooth device via the [web bluetooth API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetooth_API) if the app has not configured a custom `select-bluetooth-device` event handler.  The device that is accessed is random and the attacker would have no way of selecting a specific device.

All current stable versions of Electron are affected.

### Patches
This has been patched and the following Electron versions contain the fix:
* `17.0.0-alpha.6`
* `16.0.6`
* `15.3.5`
* `14.2.4`
* `13.6.6`

### Workarounds
Adding this code to your app can workaround the issue.

```js
app.on('web-contents-created', (event, webContents) => {
  webContents.on('select-bluetooth-device', (event, devices, callback) => {
    // Prevent default behavior
    event.preventDefault();
    // Cancel the request
    callback('');
  });
});
```

For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org.
Vulnerability: GHSA-rpxm-vmr7-5f5f
Summary: Data races in convec
Aliases: CVE-2020-36445
Severity: HIGH
CVSS score: 8.1
CWE: CWE-119, CWE-362
Published: 2021-08-25T20:59:15Z

Affected versions of this crate unconditionally implement Send/Sync for `ConVec<T>`.
This allows users to insert `T` that is not Send or not Sync.

This allows users to create data races by using non-Send types like `Arc<Cell<_>>` or `Rc<_>` as `T` in `ConVec<T>`. It is also possible to create data races by using types like `Cell<_>` or `RefCell<_>` as `T` (types that are `Send` but not `Sync`).
Such data races can lead to memory corruption.
Vulnerability: GHSA-gj85-pvp5-mvf9
Summary: Cross-site Scripting in Beanstalk console
Aliases: CVE-2022-0501
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-06T00:00:54Z

Beanstalk console prior to version 1.7.12 is vulnerable to cross-site scripting.
Vulnerability: GHSA-wpq7-q8j4-72jg
Summary: Moderate severity vulnerability that affects auth0-js
Aliases: CVE-2018-7307
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2018-03-07T22:22:24Z

The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks.
Vulnerability: GHSA-4x49-w62v-76q7
Summary: Path Traversal in Spring Cloud Config
Aliases: CVE-2019-3799
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2019-05-23T08:39:23Z

Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Vulnerability: GHSA-pr3h-jjhj-573x
Summary: High severity vulnerability that affects sprockets
Aliases: CVE-2018-3760
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200, CWE-22
Published: 2018-06-20T22:18:58Z

Specially crafted requests can be used to access files that exist on the filesystem that is outside an application's root directory, when the Sprockets server is used in production.
  
All users running an affected release should either upgrade or use one of the work arounds immediately.
  
Workaround:
  
In Rails applications, work around this issue, set `config.assets.compile = false` and `config.public_file_server.enabled = true` in an initializer and precompile the assets.

This work around will not be possible in all hosting environments and upgrading is advised.
Vulnerability: GHSA-4fc4-4p5g-6w89
Summary: Cross-site Scripting in CKEditor4
Aliases: CVE-2022-24728
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-16T22:47:55Z

### Affected packages
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.18.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.18.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank GHSL team member Kevin Backhouse ([@kevinbackhouse](https://github.com/kevinbackhouse)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-74vq-h4q8-x6jv
Summary: Critical severity vulnerability that affects ansible
Aliases: CVE-2019-3828
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-22
Published: 2019-04-15T16:19:19Z

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
Vulnerability: GHSA-5q2r-92f9-4m49
Summary: Improper verification of signature threshold in tough
Aliases: CVE-2020-15093
Severity: HIGH
CVSS score: 8.6
CWE: CWE-347
Published: 2021-08-25T20:56:55Z

## Impact

The tough library, prior to 0.7.1, does not properly verify the uniqueness of keys in the signatures provided to meet the threshold of cryptographic signatures. It allows someone with access to a valid signing key to create multiple valid signatures in order to circumvent TUF requiring a minimum threshold of unique keys before the metadata is considered valid.

AWS would like to thank Erick Tryzelaar of the Google Fuchsia Team for reporting this issue. 

## Patches

A fix is available in version 0.7.1.

## Workarounds

No workarounds to this issue are known.

## References

CVE-2020-6174 is assigned to the same issue in the TUF reference implementation.

https://github.com/theupdateframework/tuf/pull/974
https://nvd.nist.gov/vuln/detail/CVE-2020-6174

## For more information

If you have any questions or comments about this advisory, [contact AWS Security](https://aws.amazon.com/security/vulnerability-reporting/) at [aws-security@amazon.com](mailto:aws-security@amazon.com).
Vulnerability: GHSA-428x-9xc2-m8mj
Summary: Division by zero in TFLite
Aliases: CVE-2022-21741
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-369
Published: 2022-02-09T23:47:30Z

### Impact 
An attacker can craft a TFLite model that would trigger a division by zero in [the implementation of depthwise convolutions](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/lite/kernels/depthwise_conv.cc#L96).

The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is stricly positive.

### Patches              
We have patched the issue in GitHub commit [e5b0eec199c2d03de54fd6a7fd9275692218e2bc](https://github.com/tensorflow/tensorflow/commit/e5b0eec199c2d03de54fd6a7fd9275692218e2bc).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Vulnerability: GHSA-3x9f-74h4-2fqr
Summary: Denial of Service in SheetJS Pro
Aliases: CVE-2021-32012
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-400
Published: 2021-07-22T19:48:17Z

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 1 of 2).
Vulnerability: GHSA-h2j3-gg8w-4858
Summary: Malicious Package in buffer-xos
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:12:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-82mm-ffjr-h86c
Summary: Authorization bypass in Istio
Aliases: CVE-2020-16844
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-284
Published: 2022-02-15T01:57:18Z

"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy."
Vulnerability: GHSA-49rv-g7w5-m8xx
Summary: Cross-Site Scripting in @novnc/novnc
Aliases: CVE-2017-18635
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-08-28T21:24:59Z

Versions of `@novnc/novnc` prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of `include/ui.js` and users of `vnc_auto.html` and `vnc.html`.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability: GHSA-2jm5-2cqf-6vw9
Summary: Malicious Package in baes-x
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T15:30:32Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rv39-3qh7-9v7w
Summary: Improper Input Validation in Spring Framework
Aliases: CVE-2020-5421
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-35
Published: 2021-04-30T17:29:51Z

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
Vulnerability: GHSA-5q99-f34m-67gc
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2018-11784
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-601
Published: 2018-10-17T16:31:02Z

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
Vulnerability: GHSA-fcjw-8rhj-gwwc
Summary: Authentication Bypass in Devise
Aliases: CVE-2019-16109
Severity: HIGH
CVSS score: 5.3
CWE: CWE-284
Published: 2019-09-11T23:06:57Z

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
Vulnerability: GHSA-qhx9-7hx7-cp4r
Summary: HTTP Request smuggling in bottle
Aliases: CVE-2020-28473
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-444
Published: 2021-04-07T21:05:21Z

The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Vulnerability: GHSA-xmq3-hgjx-6997
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0705
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-03-17T00:00:47Z

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Vulnerability: GHSA-7qqv-r2q4-jxhm
Summary: High severity vulnerability that affects privacyIDEA
Aliases: CVE-2018-1000809
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2019-01-14T16:19:31Z

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
Vulnerability: GHSA-2rmm-87v7-34rj
Summary: Improper Restriction of XML External Entity Reference in Any23
Aliases: CVE-2022-25312
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-611
Published: 2022-03-06T00:00:17Z

An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
Vulnerability: GHSA-m5ch-gx8g-rg73
Summary: Remote Code Execution in pomelo-monitor
Severity: HIGH
CVSS score: 0
CWE: CWE-20
Published: 2020-09-02T15:43:53Z

All versions of `pomelo-monitor` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-2m53-83f3-562j
Summary: Prototype pollution in min-dash < 3.8.1
Severity: HIGH
CVSS score: 0
CWE: CWE-1321
Published: 2022-02-01T00:44:35Z

### Impact

The `set` method is vulnerable to prototype pollution with specially crafted inputs.

```javascript
// insert the following into poc.js and run node poc,js (after installing the package)
 
let parser = require("min-dash");
parser.set({}, [["__proto__"], "polluted"], "success");
console.log(polluted);
```

### Patches

`min-dash>=3.8.1` fix the issue.

### Workarounds

No workarounds exist for the issue.

### References

Closed via https://github.com/bpmn-io/min-dash/pull/21.

### Credits

Credits to Cristian-Alexandru STAICU who found the vulnerability and to Idan Digmi from the Snyk Security Team who reported the vulnerability to us, responsibly.
Vulnerability: GHSA-xmgj-5fh3-xjmm
Summary: Path traversal when MessageBus::Diagnostics is enabled
Aliases: CVE-2021-43840
Severity: MODERATE
CVSS score: 4.2
CWE: CWE-22
Published: 2021-12-17T19:59:13Z

### Impact

Users who deployed message bus with diagnostics features enabled (default off) were vulnerable to a path traversal bug, which could lead to disclosure of secret information on a machine if an unintended user were to gain access to the diagnostic route. The impact is also greater if there is no proxy for your web application as the number of steps up the directories is not bounded. For deployments which uses a proxy, the impact varies. For example, If a request goes through a proxy like Nginx with `merge_slashes` enabled, the number of steps up the directories that can be read is limited to 3 levels. 

### Patches

Patched in 3.3.7.

### Workarounds

Disable MessageBus::Diagnostics in production like environments.
Vulnerability: GHSA-q89x-f52w-6hj2
Summary: Headers containing newline characters can split messages in hyper
Aliases: CVE-2017-18587
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-93
Published: 2021-08-25T20:43:04Z

An issue was discovered in the hyper crate before 0.9.18 for Rust. It mishandles newlines in headers.
Vulnerability: GHSA-xg68-chx2-253g
Summary: Prototype Pollution in jquery-deparam
Aliases: CVE-2021-20087
Severity: HIGH
CVSS score: 8.8
CWE: CWE-1321
Published: 2021-05-24T19:53:01Z

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam allows a malicious user to inject properties into Object.prototype.
Vulnerability: GHSA-hfm8-2q22-h7hv
Summary: Cross-site Scripting in pegasus/google-for-jobs
Aliases: CVE-2021-43561
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2021-11-15T17:39:18Z

An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
Vulnerability: GHSA-jj4f-p7vv-j4v9
Summary: Arbitrary code execution in Apache Druid
Aliases: CVE-2021-26919
Severity: HIGH
CVSS score: 0
CWE: CWE-668
Published: 2021-06-16T17:51:58Z

Apache Druid allows users to read data from other database systems using JDBC. This functionality is to allow trusted users with the proper permissions to set up lookups or submit ingestion tasks. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Druid server processes. This issue was addressed in Apache Druid 0.20.2
Vulnerability: GHSA-q4hm-fwc9-hmv6
Summary: Insecure temporary file used in com.squareup:connect
Aliases: CVE-2021-23331
Severity: LOW
CVSS score: 3.3
CWE: CWE-377
Published: 2021-06-16T17:53:20Z

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.
Vulnerability: GHSA-pm44-7gw9-6g8p
Summary: Directory Traversal in uekw1511server
Aliases: CVE-2017-16185
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:28:08Z

Affected versions of `uekw1511server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-g7r5-x7cr-vm3v
Summary: Buffer overflow and format vulnerabilities in ncurses
Aliases: CVE-2019-15548
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2021-08-25T20:58:29Z

An issue was discovered in the ncurses crate for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.
Vulnerability: GHSA-w6xj-45gv-fw35
Summary: Malicious Package in stream-combine
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-02T15:57:06Z

Version 2.0.2 of `stream-combine` has malicious code design to steal credentials and credit card information. The code searches all form elements for passwords, credit card numbers and CVC codes. It then uploads the information to a remote server using HTML links embedded in the page or form actions. If your application has Content Security Policy set you are not affected by this issue.


## Recommendation

This package is not available on the npm Registry anymore. If you used this module and your application processed credentials or credit card information, it is possible that information was stolen.
Vulnerability: GHSA-427g-2r83-3ccm
Summary: Information disclosure through processing of external XML entities
Aliases: CVE-2019-8126
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-776, CWE-611
Published: 2019-11-12T22:59:24Z

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.
Vulnerability: GHSA-f6jp-j6w3-w9hm
Summary: Improper Authentication in Apache Shiro
Aliases: CVE-2021-41303
Severity: MODERATE
CVSS score: 0
CWE: CWE-287
Published: 2021-09-20T20:18:11Z

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
Vulnerability: GHSA-xwg4-93c6-3h42
Summary: Directory Traversal in send
Aliases: CVE-2014-6394
Severity: LOW
CVSS score: 0
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Versions 0.8.3 and earlier of `send` are affected by a directory traversal vulnerability. When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory. 

For example, `static(_dirname + '/public')` would allow access to `_dirname + '/public-restricted'`.


## Recommendation

Update to version 0.8.4 or later.
Vulnerability: GHSA-vfqx-33qm-g869
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36189
Severity: HIGH
CVSS score: 8.1
CWE: CWE-502
Published: 2021-12-09T19:16:59Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
Vulnerability: GHSA-v5vg-g7rq-363w
Summary: Prototype Pollution in json-pointer
Aliases: CVE-2021-23820
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:40:49Z

This affects all versions of package `json-pointer`, up to and including `0.6.1`. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.
Vulnerability: GHSA-r5cq-9537-9rpf
Summary: Prototype Pollution in mixme
Aliases: CVE-2021-28860
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-1321
Published: 2022-02-10T23:52:01Z

Node.js mixme 0.5.0, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
Vulnerability: GHSA-64gv-3pqv-299h
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
Aliases: CVE-2020-11976
Severity: HIGH
CVSS score: 7.5
CWE: CWE-200
Published: 2021-05-07T15:54:15Z

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Vulnerability: GHSA-cpv8-6xgr-rmf6
Summary: Cross-site Scripting in Dolibarr
Aliases: CVE-2021-25955
Severity: CRITICAL
CVSS score: 9
CWE: CWE-79
Published: 2021-08-30T16:22:46Z

In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account takeover of the admin and due to other vulnerability (Improper Access Control on Private notes) a low privileged user can update the private notes which could lead to privilege escalation.
Vulnerability: GHSA-7r9x-hr76-jr96
Summary: Command Injection in giting
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2020-09-04T17:26:18Z

All versions of `gitting` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `pull` function is vulnerable through the `branch` variable.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-x8xx-x82q-42q3
Summary: Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel
Aliases: CVE-2022-25336
Severity: MODERATE
CVSS score: 0
CWE: CWE-668
Published: 2022-02-19T00:01:25Z

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, since not all possible attack vectors are removed from the original file name.

The second issue is that direct access to the images is not access controlled. This is by design, for performance reasons, and documented as such. But it does mean that images not meant to be publicly accessible can be accessed, provided that the image path and filename is correctly deduced and/or guessed, through dictionary attacks and similar.
Vulnerability: GHSA-gm29-35c7-8cfw
Summary: Cross-Site Scripting in buttle
Aliases: CVE-2019-5422
Severity: HIGH
CVSS score: 0
CWE: CWE-79
Published: 2019-04-08T15:18:38Z

All versions of `buttle` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-qc4m-gc8r-mg8m
Summary: Double free in alpm-rs
Aliases: CVE-2020-35885
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-415
Published: 2021-08-25T20:48:59Z

An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. StrcCtx performs improper memory deallocation.
Vulnerability: GHSA-2vgm-wxr3-6w2j
Summary: Authentication bypass in Apache Shiro
Aliases: CVE-2020-13933
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287
Published: 2021-05-07T15:54:23Z

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
Vulnerability: GHSA-7c7g-72q7-4xhm
Summary: Prototype pollution vulnerability in 'deepref'
Aliases: CVE-2020-28274
Severity: CRITICAL
CVSS score: 9.8
Published: 2021-10-12T16:27:35Z

Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-w73w-5m7g-f7qc
Summary: Authorization bypass in github.com/dgrijalva/jwt-go
Aliases: CVE-2020-26160
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-755
Published: 2021-05-18T21:08:21Z

jwt-go allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check. There is no patch available and users of jwt-go are advised to migrate to [golang-jwt](https://github.com/golang-jwt/jwt) at version 3.2.1
Vulnerability: GHSA-xh9g-cp3v-p8q4
Summary: Missing Authorization in Crater Invoice
Aliases: CVE-2022-0203
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-862, CWE-284
Published: 2022-01-27T00:01:17Z

Crater Invoice prior to version 6.0.2 has a missing authorization vulnerability..
Vulnerability: GHSA-xrx6-fmxq-rjj2
Summary: Timing attacks in python-rsa
Aliases: CVE-2020-25658
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-327, CWE-385
Published: 2021-04-30T17:35:15Z

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA.
Vulnerability: GHSA-9534-h433-2rjf
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify
Aliases: CVE-2019-10808
Severity: HIGH
CVSS score: 8.8
CWE: CWE-915
Published: 2021-05-07T16:28:47Z

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
Vulnerability: GHSA-85j6-f8j6-q26x
Summary: Unaligned references in Obstack
Aliases: CVE-2020-35894
Severity: HIGH
CVSS score: 7.5
CWE: CWE-706
Published: 2021-08-25T20:48:12Z

An issue was discovered in the obstack crate before 0.1.4 for Rust. Unaligned references can occur.
Vulnerability: GHSA-w8fh-pvq2-x8c4
Summary: Malicious npm package: sonatype
Severity: CRITICAL
CVSS score: 0
CWE: CWE-506
Published: 2021-01-29T18:11:20Z

The npm `sonatype` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3329-pjwv-fjpg
Summary: Hostname spoofing via backslashes in URL
Aliases: CVE-2020-26291
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-20
Published: 2020-12-30T23:40:48Z

### Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https://expected-example.com\@observed-example.com`
Escaped string: `https://expected-example.com\\@observed-example.com` (JavaScript strings must escape backslash)

Affected versions incorrectly return `observed-example.com`. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches
Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.

### References
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (complete fix for this bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (partial fix for this bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

### Reporter credit
[Alesandro Ortiz](https://AlesandroOrtiz.com)
Vulnerability: GHSA-x4cm-m36h-c6qj
Summary: Moderate severity vulnerability that affects ansible
Aliases: CVE-2016-8647
Severity: MODERATE
CVSS score: 4.9
CWE: CWE-20
Published: 2018-10-10T17:23:33Z

An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.
Vulnerability: GHSA-6p56-wp2h-9hxr
Summary: Buffer Overflow in NumPy
Aliases: CVE-2021-33430
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-120
Published: 2022-01-07T00:09:39Z

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.
Vulnerability: GHSA-vgrx-w6rg-8fqf
Summary: Forgeable Public/Private Tokens in jwt-simple
Aliases: CVE-2016-10555
Severity: CRITICAL
CVSS score: 0
CWE: CWE-20
Published: 2018-11-06T23:12:07Z

Affected versions of the `jwt-simple` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result is a complete authentication bypass with minimal effort.



## Recommendation

Update to version 0.3.1 or later.

Additionally, be sure to always specify an algorithm in calls to `.decode()`.
Vulnerability: GHSA-v6vv-hhqc-6hh2
Summary: Malicious Package in pyramid-proportion
Severity: CRITICAL
CVSS score: 0
Published: 2020-09-03T19:15:37Z

Version 1.0.5 of `pyramid-proportion` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qjvf-rmwg-64fr
Summary: Downloads Resources over HTTP in install-g-test
Aliases: CVE-2016-10630
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:20Z

Affected versions of `install-g-test` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-fx5c-h9f6-rv7c
Summary: `CHECK`-fails due to attempting to build a reference tensor
Aliases: CVE-2022-23588
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-617
Published: 2022-02-09T23:28:07Z

### Impact
A malicious user can cause a denial of service by altering a `SavedModel` such that [Grappler optimizer would attempt to build a tensor using a reference `dtype`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/constant_folding.cc#L1328-L1402). This would result in a crash due to a `CHECK`-fail [in the `Tensor` constructor](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/tensor.cc#L733-L781) as reference types are not allowed.
### Patches
We have patched the issue in GitHub commit [6b5adc0877de832b2a7c189532dbbbc64622eeb6](https://github.com/tensorflow/tensorflow/commit/6b5adc0877de832b2a7c189532dbbbc64622eeb6).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Vulnerability: GHSA-76xq-58hj-vwm2
Summary: Malicious Package in test-module-a
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-11T21:16:59Z

All versions of `test-module-a` contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking,


## Recommendation

Remove the package from your system. If you own any packages that were compromised please contact npm security immediately at security@npmjs.com. Also enable 2FA for publishing to further secure packages you maintain.
Vulnerability: GHSA-f997-8gxg-r354
Summary: Data races in lexer
Aliases: CVE-2020-36458
Severity: HIGH
CVSS score: 8.1
CWE: CWE-362, CWE-77
Published: 2021-08-25T20:58:09Z

lexer is a plugin based lexical reader.Affected versions of this crate implements Sync for ReaderResult<T, E> with the trait bound T: Send, E: Send. Since matching on the public enum ReaderResult<T, E> provides access to &T & &E, allowing data race to a non-Sync type T or E. This can result in a memory corruption when multiple threads concurrently access &T or &E. Suggested fix for the bug is change the trait bounds imposed on T & E to be T: Sync, E: Sync.
Vulnerability: GHSA-7x7c-qm48-pq9c
Summary: Cross-site Scripting in karma
Aliases: CVE-2022-0437
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-06T00:00:54Z

karma prior to version 6.3.14 contains a cross-site scripting vulnerability.
Vulnerability: GHSA-gf88-j2mg-cc82
Summary: Crash caused by integer conversion to unsigned
Aliases: CVE-2021-37661
Severity: MODERATE
CVSS score: 5.5
CWE: CWE-681
Published: 2021-08-25T14:42:28Z

### Impact
An attacker can cause a denial of service in `boosted_trees_create_quantile_stream_resource` by using negative arguments:

```python
import tensorflow as tf
from tensorflow.python.ops import gen_boosted_trees_ops
import numpy as np

v= tf.Variable([0.0, 0.0, 0.0, 0.0, 0.0])
gen_boosted_trees_ops.boosted_trees_create_quantile_stream_resource(
  quantile_stream_resource_handle = v.handle,
  epsilon = [74.82224],
  num_streams = [-49], 
  max_elements = np.int32(586))
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantile_ops.cc#L96) does not validate that `num_streams` only contains non-negative numbers. In turn, [this results in using this value to allocate memory](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantiles/quantile_stream_resource.h#L31-L40):

```cc
class BoostedTreesQuantileStreamResource : public ResourceBase {
 public:
  BoostedTreesQuantileStreamResource(const float epsilon,
                                     const int64 max_elements,
                                     const int64 num_streams)
      : are_buckets_ready_(false),
        epsilon_(epsilon),
        num_streams_(num_streams),
        max_elements_(max_elements) {
    streams_.reserve(num_streams_);
    ...
  }
}
```

However, `reserve` receives an unsigned integer so there is an implicit conversion from a negative value to a large positive unsigned. This results in a crash from the standard library.

### Patches
We have patched the issue in GitHub commit [8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992](https://github.com/tensorflow/tensorflow/commit/8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992).

The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.