TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-cvgx-3v3q-m36c
Summary: Heap OOB in shape inference for `QuantizeV2`
Aliases: CVE-2021-41211
Severity: HIGH
CVSS score: 7.1
CWE: CWE-125
Published: 2021-11-10T19:01:03Z

### Impact
The [shape inference code for `QuantizeV2`](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/framework/common_shape_fns.cc#L2509-L2530) can trigger a read outside of bounds of heap allocated array:

```python
import tensorflow as tf

@tf.function
def test():
  data=tf.raw_ops.QuantizeV2(
    input=[1.0,1.0],
    min_range=[1.0,10.0],
    max_range=[1.0,10.0],
    T=tf.qint32,
    mode='MIN_COMBINED',
    round_mode='HALF_TO_EVEN',
    narrow_range=False,
    axis=-100,
    ensure_minimum_range=10)
  return data

test()
```

This occurs whenever `axis` is a negative value less than `-1`. In this case, we are accessing data before the start of a heap buffer:
    
```cc
int axis = -1;
Status s = c->GetAttr("axis", &axis);
if (!s.ok() && s.code() != error::NOT_FOUND) {
  return s;
}   
... 
if (axis != -1) {
  ...
  TF_RETURN_IF_ERROR(
      c->Merge(c->Dim(minmax, 0), c->Dim(input, axis), &depth));
}
```

The code allows `axis` to be an optional argument (`s` would contain an `error::NOT_FOUND` error code). Otherwise, it assumes that `axis` is a valid index into the dimensions of the `input` tensor. If `axis` is less than `-1` then this results in a heap OOB read.
    
### Patches
We have patched the issue in GitHub commit [a0d64445116c43cf46a5666bd4eee28e7a82f244](https://github.com/tensorflow/tensorflow/commit/a0d64445116c43cf46a5666bd4eee28e7a82f244).
    
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Vulnerability: GHSA-9689-rx4v-cqgc
Summary: Open Redirect
Aliases: CVE-2018-15798
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-601
Published: 2022-02-15T01:57:18Z

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse.
Vulnerability: GHSA-m852-866j-69j8
Summary: Malicious Package in eslint-config-airbnb-standard
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T20:47:01Z

Version 2.0.0 of `eslint-config-airbnb-standard` was published with a bundled version of `eslint-scope` that  was found to contain malicious code. This code would read the users `.npmrc` file and send it's contents to a remote server.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens and use a different version of the module. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Vulnerability: GHSA-wh87-3959-vfrq
Summary: Malicious Package in buffer-hor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T21:51:58Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-62g9-6hw5-rwfp
Summary: Path Traversal in resolve-path
Aliases: CVE-2018-3732
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-18T21:20:25Z

Versions of `resolve-path` before 1.4.0 are vulnerable to path traversal. `resolve-path` relative path resolving suffers from a lack of file path sanitization for windows based paths.


## Recommendation

Update to version 1.4.0 or later.
Vulnerability: GHSA-cq27-v7xp-c356
Summary: Moderate severity vulnerability that affects pycrypto
Aliases: CVE-2013-7459
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2018-12-14T18:51:38Z

Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
Vulnerability: GHSA-82mf-mmh7-hxp5
Summary: Directory traversal in development mode handler in Vaadin 14 and 15-17
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-20
Published: 2021-04-19T14:48:15Z

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

- https://vaadin.com/security/cve-2020-36321
Vulnerability: GHSA-wmjf-jpjj-9f3j
Summary: Low severity vulnerability that affects rubocop
Aliases: CVE-2017-8418
Severity: LOW
CVSS score: 3.3
CWE: CWE-668
Published: 2017-11-15T20:39:47Z

RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.
Vulnerability: GHSA-wvhm-4hhf-97x9
Summary: Cross-Site Scripting in Prism
Aliases: CVE-2020-15138
Severity: HIGH
CVSS score: 7.1
CWE: CWE-79
Published: 2020-08-07T22:28:30Z

### Impact
The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.

This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0).

### Patches
This problem is patched in v1.21.0.

### Workarounds
To workaround the issue without upgrading, [disable the easing preview](https://prismjs.com/plugins/previewers/#disabling-a-previewer) on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

### References
The vulnerability was introduced by this [commit](https://github.com/PrismJS/prism/commit/4303c940d3d3a20e8ce7635bf23331c75060f5c5) on Sep 29, 2015 and fixed by [Masato Kinugawa](https://twitter.com/kinugawamasato) (#2506).

### For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/PrismJS/prism/issues).
Vulnerability: GHSA-pr34-8jfr-xhv8
Summary: Downloads Resources over HTTP in selenium-wrapper
Aliases: CVE-2016-10628
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:47:21Z

Affected versions of `selenium-wrapper` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-wrapper`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3cv4-xxv7-934q
Summary: Improper Verification of Cryptographic Signature in Apache Pulsar
Aliases: CVE-2021-22160
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-347
Published: 2021-06-01T21:53:49Z

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Vulnerability: GHSA-wp34-mqw5-jj85
Summary: Use after free in nano_arena
Aliases: CVE-2021-28032
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-416
Published: 2021-08-25T20:52:00Z

An issue was discovered in the nano_arena crate before 0.5.2 for Rust. There is an aliasing violation in split_at because two mutable references can exist for the same element, if Borrow<Idx> behaves in certain ways. This can have a resultant out-of-bounds write or use-after-free.
Vulnerability: GHSA-88cw-3m6x-49f7
Summary: Out-of-bounds Write in ChakraCore
Aliases: CVE-2020-17054
Severity: HIGH
CVSS score: 7.5
CWE: CWE-787
Published: 2021-08-02T17:25:58Z

Chakra Scripting Engine Memory Corruption Vulnerability This CVE ID is unique from CVE-2020-17048.
Vulnerability: GHSA-57f3-gghm-9mhc
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-23353
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-03-12T21:28:46Z

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.
Vulnerability: GHSA-hg78-c92r-hvwr
Summary: Denial of Service in mqtt
Aliases: CVE-2016-1000242
Severity: HIGH
CVSS score: 7.5
CWE: CWE-248
Published: 2020-09-01T16:01:24Z

Affected versions of `mqtt` will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition.



## Recommendation

Update to v1.0.0 or later
Vulnerability: GHSA-c78w-2gw7-gjv3
Summary: XSS in TinyMCE
Aliases: CVE-2019-1010091
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-05-11T20:00:15Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in: the core parser and `media` plugin. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.9 or lower and TinyMCE 5.2.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.10 and 5.2.2 by improved HTML parsing and sanitization logic.

### Workarounds
The workarounds available are:
- disable the media plugin and manually sanitize CDATA content (see below)
or
- upgrade to either TinyMCE 4.9.10 or TinyMCE 5.2.2

#### Example: Manually strip CDATA elements
```js
setup: function(editor) {
  editor.on('PreInit', function() {
    editor.parser.addNodeFilter('#cdata', function(nodes) {
      for (var i = 0; i < nodes.length; i++) {
        nodes[i].remove();
      }
    });
  });
}
```

### Acknowledgements
Tiny Technologies would like to thank Michał Bentkowski and [intivesec](https://github.com/intivesec) for discovering these vulnerabilities.

### References
https://www.tiny.cloud/docs/release-notes/release-notes522/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-5fxf-x22x-5q38
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0929
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-c6jq-h4jp-72pr
Summary: NULL Pointer Dereference in aubio
Aliases: CVE-2018-19802
Severity: HIGH
CVSS score: 7.5
CWE: CWE-476
Published: 2019-07-26T16:10:25Z

aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.
Vulnerability: GHSA-8wr4-2wm6-w3pr
Summary: B2 Command Line Tool TOCTOU application key disclosure 
Aliases: CVE-2022-23653
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-367
Published: 2022-02-24T13:11:51Z

### Impact

Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use (TOCTOU) race condition.

The command line tool saves API keys (and bucket name-to-id mapping) in a local database file (`$XDG_CONFIG_HOME/b2/account_info`, `~/.b2_account_info` or a user-defined path) when `b2 authorize-account` is first run. This happens regardless of whether a valid key is provided or not. When first created, the file is world readable and is (typically a few milliseconds) later altered to be private to the user. If the directory is readable by a local attacker and the user did not yet run `b2 authorize-account` then during the brief period between file creation and permission modification, a local attacker can race to open the file and maintain a handle to it. This allows the local attacker to read the contents after the file after the sensitive information has been saved to it.

### Remediation

Users that have not yet run `b2 authorize-account` should upgrade to B2 Command-Line Tool v3.2.1 before running it.

Users that have run `b2 authorize-account` are safe if at the time of the file creation no other local users had read access to the local configuration file.

Users that have run `b2 authorize-account` where the designated path could be opened by another local user should upgrade to B2 Command-Line Tool v3.2.1 and remove the database and regenerate all application keys. Note that `b2 clear-account` does not remove the database file and it should not be used to ensure that all open handles to the file are invalidated.

### Workarounds
If B2 Command-Line Tool cannot be upgraded to v3.2.1 due to a dependency conflict, a binary release can be used instead. Alternatively a new version could be installed within a virtualenv, or the permissions can be changed to prevent local users from opening the database file.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [B2 Command-Line Tool](https://github.com/Backblaze/B2_Command_Line_Tool) mentioning the CVE id in the issue title
* Email us at [security@backblaze.com](mailto:security@backblaze.com)
Vulnerability: GHSA-m3rf-7m4w-r66q
Summary: Improper Authentication in Flask-AppBuilder
Aliases: CVE-2021-41265
Severity: HIGH
CVSS score: 8.1
CWE: CWE-287
Published: 2021-12-09T19:09:07Z

### Impact
Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints.

### Patches
Upgrade to Flask-AppBuilder 3.3.4

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/dpgaspar/Flask-AppBuilder
Vulnerability: GHSA-5946-mpw5-pqxx
Summary: Incorrect Default Permissions in Cobbler
Aliases: CVE-2021-45083
Severity: HIGH
CVSS score: 7.1
CWE: CWE-276
Published: 2022-02-21T00:00:20Z

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.
Vulnerability: GHSA-mj6m-246h-9w56
Summary: Improper regex in htaccess file
Aliases: CVE-2022-25769
Severity: MODERATE
CVSS score: 0
Published: 2022-03-01T22:05:34Z

### Impact
the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

### Patches
Please upgrade to 3.3.5 or 4.2.0 

### Workarounds
No

### References

- Release post: https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic
- Internally tracked under MST-32

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-jqpv-jm4m-86j9
Summary: Use After Free in libpulse-binding
Aliases: CVE-2018-25028
Severity: HIGH
CVSS score: 7.5
CWE: CWE-416
Published: 2022-01-06T22:17:50Z

An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free.
Vulnerability: GHSA-m8pw-hgvj-cwcm
Summary: Directory Traversal in sgqserve
Aliases: CVE-2017-16215
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:08:55Z

Affected versions of `sgqserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-69p6-wvmq-27gg
Summary: Command injection in ruby-git
Aliases: CVE-2022-25648
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-88
Published: 2022-04-20T00:00:33Z

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-2c25-xfpq-8w9r
Summary: Cross-site scripting in jfinal
Aliases: CVE-2021-33348
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-08-13T15:22:14Z

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.
Vulnerability: GHSA-8fx9-5hx8-crhm
Summary: Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
Aliases: CVE-2017-12611
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-20
Published: 2018-10-16T19:35:40Z

In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Vulnerability: GHSA-c738-77x8-wmq5
Summary: Uncontrolled Resource Consumption in XNIO
Aliases: CVE-2020-14340
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-400
Published: 2021-06-08T22:29:29Z

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
Vulnerability: GHSA-gjph-xf5q-6mfq
Summary: Denial of Service in @hapi/ammo
Severity: HIGH
CVSS score: 0
Published: 2020-09-03T15:46:02Z

Versions of `@hapi/ammo` prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 3.1.2 or 5.0.1.
Vulnerability: GHSA-v7m9-9497-p9gr
Summary: Possible pod name collisions in jupyterhub-kubespawner
Aliases: CVE-2020-15110
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-863
Published: 2020-07-22T23:07:16Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

JupyterHub deployments using:

- KubeSpawner <= 0.11.1 (e.g. zero-to-jupyterhub 0.9.0) and
- enabled named_servers (not default), and
- an Authenticator that allows:
  - usernames with hyphens or other characters that require escape (e.g. `user-hyphen` or `user@email`), and
  - usernames which may match other usernames up to but not including the escaped character (e.g. `user` in the above cases)

In this circumstance, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Patch will be released in kubespawner 0.12 and zero-to-jupyterhub 0.9.1

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

#### KubeSpawner

Specify configuration:

for KubeSpawner
```python
from traitlets import default
from kubespawner import KubeSpawner

class PatchedKubeSpawner(KubeSpawner):
    @default("pod_name_template")
    def _default_pod_name_template(self):
        if self.name:
            return "jupyter-{username}-{servername}"
        else:
            return "jupyter-{username}"

    @default("pvc_name_template")
    def _default_pvc_name_template(self):
        if self.name:
            return "claim-{username}-{servername}"
        else:
            return "claim-{username}"

c.JupyterHub.spawner_class = PatchedKubeSpawner
```

**Note for KubeSpawner:** this configuration will behave differently before and after the upgrade, so will need to be removed when upgrading. Only apply this configuration while still using KubeSpawner ≤ 0.11.1 and remove it after upgrade to ensure consistent pod and pvc naming.

Changing the name template means pvcs for named servers will have different names. This will result in orphaned PVCs for named servers across Hub upgrade! This may appear as data loss for users, depending on configuration, but the orphaned PVCs will still be around and data can be migrated manually (or new PVCs created manually to reference existing PVs) before deleting the old PVCs and/or PVs.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [kubespawner](https://github.com/jupyterhub/kubespawner)
* Email us at [security@ipython.org](mailto:security@ipython.org)

Credit: Jining Huang
Vulnerability: GHSA-vxrc-68xx-x48g
Summary: Sandbox Information Disclosure
Aliases: CVE-2019-9942
Severity: LOW
CVSS score: 3.7
Published: 2022-03-26T00:25:25Z

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
Vulnerability: GHSA-v73w-r9xg-7cr9
Summary: Use of insecure jQuery version in OctoberCMS
Severity: MODERATE
CVSS score: 0
Published: 2020-06-05T19:37:49Z

### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

### Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

### Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.

### References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory:
* Email us at [octobercms@luketowers.ca](mailto:octobercms@luketowers.ca) & [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Moderate by the @jquery team.

### Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.
Vulnerability: GHSA-vjqw-r3ww-wj2w
Summary: Expression Language Injection in Apache Syncope
Aliases: CVE-2020-1959
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-917
Published: 2021-06-16T17:18:58Z

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.
Vulnerability: GHSA-8843-m7mw-mxqm
Summary: Buffer overflow in Pillow
Aliases: CVE-2020-10379
Severity: HIGH
CVSS score: 7.8
CWE: CWE-120
Published: 2020-07-27T21:52:41Z

In Pillow before 6.2.3 and 7.x before 7.0.1, there are two Buffer Overflows in libImaging/TiffDecode.c.
Vulnerability: GHSA-m2wv-m5pf-284r
Summary: Cross-site Scripting in teampass
Aliases: CVE-2022-26980
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-03-29T00:01:09Z

Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. Someone must open a link for the Teampass Password Manager index page containing malicious payload.
Vulnerability: GHSA-694m-jhr9-pf77
Summary: High severity vulnerability that affects doorkeeper
Aliases: CVE-2018-1000211
Severity: HIGH
CVSS score: 7.5
CWE: CWE-732
Published: 2018-08-13T20:46:41Z

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
Vulnerability: GHSA-5mxh-2qfv-4g7j
Summary: NUL character in ROA causes OctoRPKI to crash
Aliases: CVE-2021-3910
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20
Published: 2021-11-10T20:15:06Z

OctoRPKI crashes when encountering a repository that returns an invalid ROA (just an encoded `NUL` (`\0`) character).

## Patches

## For more information
If you have any questions or comments about this advisory email us at security@cloudflare.com
Vulnerability: GHSA-wp7m-mrvf-599c
Summary: Command Injection in node-df
Aliases: CVE-2019-15597
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2020-02-14T23:09:10Z

All versions of `node-df` are vulnerable to Command Injection. The package fails to sanitize filenames passed to the  `file` option. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gx7g-wjxg-jwwj
Summary: Cross-Site Request Forgery in YOURLS
Aliases: CVE-2022-0088
Severity: LOW
CVSS score: 3.5
CWE: CWE-352
Published: 2022-04-04T00:00:55Z

YOURLS versions 1.8.2 and prior are vulnerable to Cross-Site Request Forgery.
Vulnerability: GHSA-9hgc-wpc5-v8p9
Summary: An attacker can execute malicious javascript in Live Helper Chat
Aliases: CVE-2022-1530
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2022-04-30T00:00:37Z

Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious javascript on application.
Vulnerability: GHSA-rpvr-mw7r-25xx
Summary: Path traversal in MCMS
Aliases: CVE-2021-46062
Severity: HIGH
CVSS score: 7.1
CWE: CWE-22
Published: 2022-02-19T00:01:24Z

MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
Vulnerability: GHSA-h5g2-38x9-4gv3
Summary: High severity vulnerability that affects archive-tar-minitar and minitar
Aliases: CVE-2016-10173
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
Vulnerability: GHSA-x7m2-6g99-84w5
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7652
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2020-06-03T22:02:24Z

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Vulnerability: GHSA-m98g-63qj-fp8j
Summary: Reflected XSS on clients-registrations endpoint
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2022-04-28T21:01:28Z

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.

### Acknowledgement

Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.
Vulnerability: GHSA-v222-6mr4-qj29
Summary: Command Injection vulnerability in asciidoctor-include-ext
Aliases: CVE-2022-24803
Severity: CRITICAL
CVSS score: 10
CWE: CWE-78
Published: 2022-03-31T23:27:15Z

### Impact

Applications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor) with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext) (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. ~~This attack is possible even when `allow-uri-read` is disabled!~~ (EDIT: it’s not)


### Patches

The vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).

### Workarounds

```rb
require 'asciidoctor/include_ext'

class Asciidoctor::IncludeExt::IncludeProcessor
  # Overrides superclass private method to mitigate Command Injection
  # vulnerability in asciidoctor-include-ext <0.4.0.
  def target_uri?(target)
    target.downcase.start_with?('http://', 'https://') \
      && URI.parse(target).is_a?(URI::HTTP)
  rescue URI::InvalidURIError
    false
  end
end
```

### References

* https://sakurity.com/blog/2015/02/28/openuri.html

### Credits

This vulnerability was discovered by Joern Schneeweisz from the GitLab Security Research Team.


### For more information

See commit message c7ea001.

If you have any questions or comments about this advisory open an issue in [jirutka/asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext/issues/).
Vulnerability: GHSA-w8hg-mxvh-9h57
Summary: Malicious Package in angular-bmap
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-01T19:42:49Z

Version 0.0.9 of `angular-bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.9 of this module is found installed you will want to replace it with a version before or after 0.0.9. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-5gjh-5j4f-cpwv
Summary: Unrestricted Upload of File with Dangerous Type in Gogs
Aliases: CVE-2022-0415
Severity: HIGH
CVSS score: 8.8
CWE: CWE-434, CWE-20
Published: 2022-03-28T16:46:41Z

### Impact

The malicious user is able to upload a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

Repository file uploads are prohibited to its `.git` directory. Users should upgrade to 0.12.6 or the latest 0.13.0+dev.

### Workarounds

[Disable repository files upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L128-L129).

### References

https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902/

### For more information

If you have any questions or comments about this advisory, please post on #6833.
Vulnerability: GHSA-6898-wx94-8jq8
Summary: Potential Command Injection in libnotify
Aliases: CVE-2013-7381
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-74
Published: 2020-08-31T22:50:48Z

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.

Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.

### Example
```
var libnotify = require('libnotify')
libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () {
    console.log(arguments);
})
```

Special thanks to Neal Poole for submitting the pull request to fix this issue.


## Recommendation

Update to version 1.0.4 or greater
Vulnerability: GHSA-qpgv-g792-wh6x
Summary: Uncontrolled Resource Consumption in parse_duration
Aliases: CVE-2021-29932
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2021-08-25T20:54:04Z

An issue was discovered in the parse_duration crate through 2021-03-18 for Rust. It allows attackers to cause a denial of service (CPU and memory consumption) via a duration string with a large exponent.
Vulnerability: GHSA-fjqm-246c-mwqg
Summary: In Bouncy Castle JCE Provider the other party DH public key is not fully validated
Aliases: CVE-2016-1000346
Severity: LOW
CVSS score: 3.7
Published: 2018-10-17T16:27:28Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
Vulnerability: GHSA-62mh-w5cv-p88c
Summary: Import token permissions checking not enforced
Severity: CRITICAL
CVSS score: 0
CWE: CWE-863
Published: 2022-02-15T00:42:28Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2021-3127.txt>)

## Problem Description

The NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects.  Some Exports are public, such that anyone can import the
relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.

The JWT library's validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.

As a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the
importing account is not rejected, and use it to import *any* Subject from the Exporting account, not just the Subject referenced in the Import Token.

The NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.

The CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.


## Affected versions

#### JWT library

 * all versions prior to 2.0.1
 * fixed after nats-io/jwt#149 landed (2021-03-14)

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable
 * fixed with nats-io/nats-server@423b79440c (2021-03-14)


## Impact

In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.

Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.


## Workaround

Deny access to clients to update their account JWT in the account server.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).

Audit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at <https://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a>.
Vulnerability: GHSA-h6xq-3h62-99qx
Summary: Cross-site scripting in Apache Atlas
Aliases: CVE-2020-13928
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2022-02-10T20:51:46Z

Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability.
Vulnerability: GHSA-66p5-j55p-32r9
Summary: smallvec creates uninitialized value of any type
Severity: MODERATE
CVSS score: 0
CWE: CWE-457
Published: 2021-08-25T21:00:25Z

Affected versions of this crate called `mem::uninitialized()` to create values of a user-supplied type `T`.
This is unsound e.g. if `T` is a reference type (which must be non-null and thus may not remain uninitialized).
 
The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.
Vulnerability: GHSA-2p89-5f22-8qvf
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32711
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-200
Published: 2021-09-08T18:00:32Z

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information. https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351 ### Workarounds For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659 ### For more information https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
Vulnerability: GHSA-ph98-v78f-jqrm
Summary: SQL injection in jackalope/jackalope-doctrine-dbal
Aliases: CVE-2021-43822
Severity: HIGH
CVSS score: 8.5
CWE: CWE-89
Published: 2021-12-14T21:08:13Z

### Impact

Users can provoke SQL injections if they can specify a node name or query.

### Patches

Upgrade to version 1.7.4

If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`.

### Workarounds

Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.

If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected. 

### References

No further references.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [jackalope/jackalope-doctrine-dbal repo](https://github.com/jackalope/jackalope-doctrine-dbal/issues)
Vulnerability: GHSA-qvc5-cfrr-384v
Summary: RCE in Third Party Library in Shopware
Severity: LOW
CVSS score: 0
Published: 2020-09-23T17:20:28Z

### Impact
RCE in Third Party Library

### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. 

For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
Vulnerability: GHSA-fgv8-vj5c-2ppq
Summary: Incorrect Authorization in runc
Aliases: CVE-2019-16884
Severity: HIGH
CVSS score: 5.4
CWE: CWE-863
Published: 2022-02-22T15:38:08Z

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Vulnerability: GHSA-5w8q-x7hc-jhp6
Summary: Directory Traversal in node-simple-router
Aliases: CVE-2017-16083
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-24T19:42:39Z

Affected versions of `node-simple-router` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to v0.10.1 or later.
Vulnerability: GHSA-f93p-f762-vr53
Summary: Reflected Cross-Site Scripting in Apache CXF
Aliases: CVE-2019-17573
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2020-06-10T20:02:33Z

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Vulnerability: GHSA-2382-qx5h-rvqh
Summary: SQL Injection in odata4j
Aliases: CVE-2016-11023
Severity: HIGH
CVSS score: 9.8
CWE: CWE-89
Published: 2021-05-07T15:52:56Z

odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE, this product is apparently discontinued.
Vulnerability: GHSA-9qgc-p27w-3hjg
Summary: High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
Aliases: CVE-2018-16131
Severity: HIGH
CVSS score: 7.5
CWE: CWE-400
Published: 2018-10-22T20:37:07Z

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
Vulnerability: GHSA-xgrx-xpv2-6vp4
Summary: Improper Authentication in Apache ActiveMQ
Aliases: CVE-2020-13920
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-306
Published: 2022-02-09T22:15:00Z

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
Vulnerability: GHSA-wpgh-hmv4-r3v5
Summary: Prototype pollution in safe-obj
Aliases: CVE-2021-25928
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-06-21T17:18:20Z

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-6p52-jr3q-c94g
Summary: Arbitrary code execution due to YAML deserialization
Aliases: CVE-2021-41078
Severity: HIGH
CVSS score: 8.6
CWE: CWE-502
Published: 2021-10-19T15:28:57Z

### Impact

Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:

``` yaml
# malicious.yaml
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
```

``` shell
$ nameko run --config malicious.yaml test
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
... 
```

### Patches

The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.

Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.

### Workarounds

The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.
Vulnerability: GHSA-w725-67p7-xv22
Summary: Command Injection in local-devices
Severity: HIGH
CVSS score: 0
CWE: CWE-77
Published: 2020-09-03T17:05:04Z

Versions of `local-devices` prior to 3.0.0 are vulnerable to Command Injection. The package does not validate input on ip addresses and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 3.0.0 or later.
Vulnerability: GHSA-qvf8-p83w-v58j
Summary: Podman's default inheritable capabilities for linux container not empty
Aliases: CVE-2022-27649
Severity: HIGH
CVSS score: 7.5
CWE: CWE-276
Published: 2022-04-01T20:52:29Z

A bug was found in Podman where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Vulnerability: GHSA-fjh3-g8gq-9q92
Summary: Cross-Site Scripting in Content Preview
Aliases: CVE-2021-21340
Severity: LOW
CVSS score: 0
CWE: CWE-79
Published: 2021-03-23T01:53:47Z

> ### Meta
> * CVSS: `AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0)
> * CWE-79
> * Status: **DRAFT**

### Problem
It has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-007](https://typo3.org/security/advisory/typo3-core-sa-2021-007)
Vulnerability: GHSA-89mq-4x47-5v83
Summary: Prototype Pollution in angular
Aliases: CVE-2019-10768
Severity: HIGH
CVSS score: 7.5
CWE: CWE-20, CWE-915
Published: 2019-11-20T15:29:43Z

Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function `merge()` does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

Upgrade to version 1.7.9 or later. The function was already deprecated and upgrades are not expected to break functionality.
Vulnerability: GHSA-2f9x-5v75-3qv4
Summary: Moderate severity vulnerability that affects django
Aliases: CVE-2018-7537
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-185
Published: 2019-01-04T17:50:00Z

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.