aswin1906/github-advisory-2018.csv huggingface dataset:
pysaml2 Improper Authentication vulnerability (CVE-2017-1000433)
Published: 2018-07-13T16:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

pysaml2 version 4.4.0 and older accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password.
Regular Expression Denial of Service in forwarded (CVE-2017-16118)
Published: 2018-07-24T20:16:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions of `forwarded` are vulnerable to regular expression denial of service when parsing specially crafted user input.


## Recommendation

Update to version 0.1.2 or later
Remote Code Execution in pg (CVE-2017-16082)
Published: 2018-07-24T19:44:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. 

There are two specific scenarios in which it is likely for an application to be vulnerable:
1. The application executes unsafe, user-supplied sql which contains malicious column names.
2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.

## Proof of Concept
```
const { Client } = require('pg')
const client = new Client()
client.connect()

const sql = `SELECT 1 AS "\\'/*", 2 AS "\\'*/\n + console.log(process.env)] = null;\n//"`

client.query(sql, (err, res) => {
  client.end()
})
```


## Recommendation

* Version 2.x.x: Update to version 2.11.2 or later.
* Version 3.x.x: Update to version 3.6.4 or later.
* Version 4.x.x: Update to version 4.5.7 or later.
* Version 5.x.x: Update to version 5.2.1 or later.
* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )
* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )
Jupyter Notebook file bypasses sanitization, executes JavaScript (CVE-2018-8768)
Published: 2018-07-12T12:00:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In Jupyter Notebook before 5.4.1, a maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.
Remote Code Execution in markdown-pdf (CVE-2018-3770)
Published: 2018-07-27T17:03:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Versions of `markdown-pdf` prior to 9.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize HTML code in markdown files. If markdown files with malicious HTML are converted to PDF, the resulting PDF file will execute any JavaScript code in the original markdown file. This may allow attackers to execute Remote Code.


## Recommendation

Upgrade to version 9.0.0 or later.
Moderate severity vulnerability that affects django (CVE-2010-3082)
Published: 2018-07-23T19:52:42Z

Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.
Directory Traversal in commentapp.stetsonwood (CVE-2017-16143)
Published: 2018-07-23T20:48:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `commentapp.stetsonwood` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Moderate severity vulnerability that affects Plone and Zope2 (CVE-2012-6661)
Published: 2018-07-23T19:51:14Z

Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors.  NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).
Directory Traversal in 22lixian (CVE-2017-16162)
Published: 2018-07-23T20:46:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `22lixian` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Directory Traversal in intsol-package (CVE-2017-16178)
Published: 2018-07-23T20:44:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

`intsol-package` is a file server.

`intsol-package` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

**Example Request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost
```
and the server's Response

```http
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Directory Traversal in fbr-client (CVE-2017-16217)
Published: 2018-07-23T20:39:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `fbr-client` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Moderate severity vulnerability that affects Plone (CVE-2012-5503)
Published: 2018-07-23T19:52:35Z

ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.
Pillow Buffer overflow in ImagingFliDecode (CVE-2016-0775)
Published: 2018-07-24T20:15:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Buffer overflow in the `ImagingFliDecode` function in `libImaging/FliDecode.c` in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.
Regular Expression Denial of Service in marked (CVE-2017-16114)
Published: 2018-07-24T20:10:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions of `marked` are vulnerable to a regular expression denial of service. 

The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.


## Recommendation

Update to version 0.3.9 or later.
Directory Traversal in open-device (CVE-2017-16187)
Published: 2018-07-23T20:41:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `open-device` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers (CVE-2018-1000164)
Published: 2018-07-12T20:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

gunicorn version 19.4.5 contains a CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers vulnerability in "process_headers" function in "gunicorn/http/wsgi.py" that can result in an attacker causing the server to return arbitrary HTTP headers. This vulnerability appears to have been fixed in 19.5.0.
Arbitrary File Write via Archive Extraction in unzipper (CVE-2018-1002203)
Published: 2018-07-27T17:06:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Versions of `unzipper` before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example).


## Recommendation

Update to version 0.3.18 or later.
Paramiko not properly checking authentication before processing other requests (CVE-2018-7750)
Published: 2018-07-12T20:29:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Arbitrary code using "crafted image file" approach affecting Pillow (CVE-2016-9190)
Published: 2018-07-12T14:45:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.
ReDoS via long UserAgent header in ua-parser (CVE-2017-16086)
Published: 2018-07-24T19:46:37Z

Affected versions of `ua-parser` are vulnerable to regular expression denial of service when given a specially crafted `User-Agent` header.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different, functionally equivalent package such as [useragent](https://www.npmjs.com/package/useragent).
Directory Traversal in ltt (CVE-2017-16212)
Published: 2018-07-23T20:39:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `ltt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Directory Traversal in serverabc (CVE-2017-16180)
Published: 2018-07-23T20:44:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `serverabc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
hubl-server downloads resources over HTTP (CVE-2017-16035)
Published: 2018-07-24T15:40:47Z

Affected versions of `hubl-server` insecurely download dependencies over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the responses and replace the dependencies with malicious ones, resulting in code execution on the system running `hubl-server`.


## Recommendation

No patch is currently available for this vulnerability, and it has not seen any updates since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo
Macro in MathJax running untrusted Javascript within a web browser (CVE-2018-1999024)
Published: 2018-07-27T17:05:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the `\unicode{}` macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.
Path Traversal in stattic (CVE-2018-3734)
Published: 2018-07-18T21:20:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Versions of `stattic` before 0.3.0 are vulnerable to path traversal allowing a remote attacker to read arbitrary files with any extension from the server that users `stattic`.


## Recommendation

Update to version 0.3.0 or later.
Path Traversal in localhost-now (CVE-2018-3729)
Published: 2018-07-25T22:44:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Versions of `localhost-now` before 1.0.2 are vulnerable to path traversal. This allows a remote attacker to read the content of an arbitrary file.


## Recommendation

Update to version 1.0.2 or later.
High severity vulnerability that affects django (CVE-2011-0698)
Published: 2018-07-23T19:52:31Z

Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
Directory Traversal in gomeplus-h5-proxy (CVE-2017-16037)
Published: 2018-07-24T15:48:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions of `gomeplus-h5-proxy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Moderate severity vulnerability that affects django (CVE-2010-4534)
Published: 2018-07-23T19:51:40Z

The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.
Pycrypto generates weak key parameters (CVE-2018-6594)
Published: 2018-07-12T20:29:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation.
Chromium Remote Code Execution in electron (CVE-2017-16151)
Published: 2018-07-24T20:04:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of `ElectronJS` are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.



## Recommendation

Update to electron version 1.7.8 or later.
Github Token Leak in aegir (CVE-2017-16225)
Published: 2018-07-24T20:04:11Z

Affected versions of `aegir` bundle and publish the current users github token to npm when `aegir-release` is executed.


## Recommendation

Update to version 12.0.8 or later.

If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.
Django-piston and Django-tastypie do not properly deserialize YAML data (CVE-2011-4103)
Published: 2018-07-23T19:50:48Z

emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.

Django Tastypie has a very similar vulnerability.
Unsafe deserialization in MLAlchemy (CVE-2017-16615)
Published: 2018-07-13T16:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Regular Expression Denial of Service in tough-cookie (CVE-2017-15010)
Published: 2018-07-24T20:14:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions of `tough-cookie` are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

If node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.


## Recommendation

Update to version 2.3.3 or later.
Open Redirect in hekto (CVE-2018-3743)
Published: 2018-07-18T21:20:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Versions of `hekto` before 0.2.4 are vulnerable to open redirect when a domain name is used as part of the `.html` filename.


## Recommendation

Update to version 0.2.4 or later.
Diffoscope may write to arbitrary locations due to an untrusted archive (CVE-2017-0359)
Published: 2018-07-13T16:01:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

diffoscope before 76 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Moderate severity vulnerability that affects feedparser (CVE-2011-1157)
Published: 2018-07-23T19:52:21Z

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.
Pillow buffer overflow in ImagingPcdDecode (CVE-2016-2533)
Published: 2018-07-24T20:15:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Buffer overflow in the `ImagingPcdDecode` function in `PcdDecode.c` in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.
Directory Traversal in tmock (CVE-2017-16106)
Published: 2018-07-23T23:51:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

`tmock` is a static file server.

`tmock` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```http
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Path Traversal in crud-file-server (CVE-2018-3733)
Published: 2018-07-18T21:20:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Versions of `crud-file-server` prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 0.9.0 or later.
Authentication Bypass in passport-azure-ad (CVE-2016-7191)
Published: 2018-07-26T15:53:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of `passport-azure-ad` do not recognize the `validateIssuer` setting, which allows remote attackers to bypass authentication via a crafted token.


## Recommendation

Version 1.x: Update to version 1.4.6 or later.
Version 2.x: Update to version 2.0.1 or later.
Command Injection in whereis (CVE-2018-3772)
Published: 2018-07-31T18:28:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Versions of `whereis` before 0.4.1 are vulnerable to command injection if untrusted user input is passed into `whereis`.


## Recommendation

Update to version 0.4.1 or later.
Moderate severity vulnerability that affects Plone and plone.app.users (CVE-2011-1950)
Published: 2018-07-23T20:26:45Z

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.
Moderate severity vulnerability that affects django (CVE-2011-0697)
Published: 2018-07-23T21:01:00Z

Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.
Kotti CSRF in the local roles implementation (CVE-2018-9856)
Published: 2018-07-12T20:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a `/admin-document/@@share` request.
Low severity vulnerability that affects Plone (CVE-2011-1949)
Published: 2018-07-23T21:01:10Z

Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.