aswin1906/github-advisory-2022 huggingface dataset:
NVFLARE unsafe deserialization due to Pickle
Advisory: GHSA-6qv6-q77g-7qm6
Aliases: CVE-2022-34668
Published: 2022-08-31T22:29:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
NVFLARE contains a vulnerability where deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity. 

All versions before 2.1.4 are affected. 

CVSS Score = 9.8 
 
[AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 


### Patches
 
The patch is included in nvflare==2.1.4 
This new version uses MessagePack instead of Pickle to do serialization and deserialization.  

Some object serializations supported by Pickle are not supported by MessagePack. We have provided out of box support for some built-in NVFLARE objects. For object serializations unsupported by MessagePack, the user will need to convert the objects to numpy or bytes before sending over to remote machines.  The list of supported object types are listed in https://github.com/NVIDIA/NVFlare/blob/2.1/nvflare/fuel/utils/fobs/README.rst 

 
### Workarounds

No workarounds available. 
 
### Additional information 
Issue Found by: Oliver Sellwood (Nintorac) and Elias Hohl
morgan-json vulnerable to Arbitrary Code Execution
Advisory: GHSA-fwv4-6mxc-x5h3
Aliases: CVE-2022-25921
Published: 2022-08-29T20:06:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the `Function` constructor.
JSPUI's "Internal System Error" page prints exceptions and stack traces without sanitization
Advisory: GHSA-c2j7-66m3-r4ff
Aliases: CVE-2022-31189
Published: 2022-08-06T05:39:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
When an "Internal System Error" occurs in the JSPUI, then entire exception (including stack trace) is available. Information in this stacktrace may be useful to an attacker in launching a more sophisticated attack.  This vulnerability only impacts the JSPUI.

_This vulnerability does NOT impact the XMLUI or 7.x._

### Patches

_DSpace 6.x:_
* Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/afcc6c3389729b85d5c7b0230cbf9aaf7452f31a
* 6.x patch file: https://github.com/DSpace/DSpace/commit/afcc6c3389729b85d5c7b0230cbf9aaf7452f31a.patch (may be applied manually if an immediate upgrade to 6.4 or above is not possible)

_DSpace 5.x:_
* The 6.x patch file can also be applied to an older 5.x installation.
* Alternatively, you can simply apply the workaround documented below.  The detailed error information embedded in `internal.jsp` is not necessary for the JSPUI to function.

#### Apply the patch to your DSpace
If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:
1. Download the appropriate patch file to the machine where DSpace is running
2. From the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`
3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
    1. Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)
    2. Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.
    3. Restart Tomcat

### Workarounds

The detailed error information embedded in `internal.jsp` is not necessary for the JSPUI to function.  Because this error information is also available in the `dspace.log` files, it does not need to be displayed in `internal.jsp`.

Modify your `internal.jsp`, and disable the display of the error message. This is most easily done by setting the returned exception to "null" at all times.  For example, add a new line between line number 43 and 44

```
// This line should exist around line number 43
Throwable ex = (Throwable) request.getAttribute("javax.servlet.error.exception");
// Add workaround for security issue. Ensure exception is always set to null.
ex = null;
// This line should exist around line number 44
if(ex == null) out.println("No stack trace available<br/>");
```

### References
Discovered & reported by Ozkan Erdogan (Brunel University London)

### For more information
If you have any questions or comments about this advisory:
* Email us at security@dspace.org
loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter
Advisory: GHSA-j259-6c58-9m58
Aliases: CVE-2022-35942
Published: 2022-08-11T21:13:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection.

### Impact

When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database.

This affects users who does any of the following:

- Connect to the database via the DataSource with `allowExtendedProperties: true` setting OR
- Uses the connector's CRUD methods directly OR
- Uses the connector's other methods to interpret the LoopBack filter.

### Patches

Patch release `loopback-connector-postgresql@5.5.1` has been published of which resolves this issue.

### Workarounds

Users who are unable to upgrade should do the following if applicable:

- Remove `allowExtendedProperties: true` DataSource setting
- Add `allowExtendedProperties: false` DataSource setting
- When passing directly to the connector functions, manually sanitize the user input for the `contains` LoopBack filter beforehand.
Subrion CMS 4.2.1 vulnerable to cross-site scripting in admin panel
Advisory: GHSA-rh4r-9689-6xw4
Aliases: CVE-2022-37059
Published: 2022-08-29T20:06:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) in the Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via the Login Field.
Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints
Advisory: GHSA-wcm8-86x6-8mv3
Aliases: CVE-2022-36124
Published: 2022-08-10T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
`rustdecimal` is a malicious crate
Advisory: GHSA-7pwq-f4pq-78gm
Published: 2022-08-11T15:43:35Z

The Rust Security Response WG and the crates.io team [were notified][1] on 2022-05-02 of the existence of the malicious crate `rustdecimal`, which contained malware. The crate name was intentionally similar to the name of the popular [`rust_decimal`][2] crate, hoping that potential victims would misspell its name (an attack called "typosquatting").

To protect the security of the ecosystem, the crates.io team permanently removed the crate from the registry as soon as it was made aware of the malware. An analysis of all the crates on crates.io was also performed, and no other crate with similar code patterns was found.

Keep in mind that the [`rust_decimal`][2] crate was **not** compromised, and it is still safe to use.

## Analysis of the crate

The crate had less than 500 downloads since its first release on 2022-03-25, and no crates on the crates.io registry depended on it.

The crate contained identical source code and functionality as the legit `rust_decimal` crate, except for the `Decimal::new` function.

If your project or organization is running GitLab CI, we strongly recommend checking whether your project or one of its dependencies depended on the `rustdecimal` crate, starting from 2022-03-25. If you notice a dependency on that crate, you should consider your CI environment to be compromised.
`libsqlite3-sys` via C SQLite improperly validates array index
Advisory: GHSA-jw36-hf63-69r9
Aliases: CVE-2022-35737
Published: 2022-08-04T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken
Advisory: GHSA-h864-m8vm-3xvj
Published: 2022-08-18T19:06:39Z

Ward Beullens found a practical key-recovery attack against Rainbow.
The level I parametersets are removed from liboqs starting from version `0.7.2`.
Find the scientific details in [Breaking Rainbow Takes a Weekend on a Laptop](https://eprint.iacr.org/2022/214).

This means all the `oqs::sig::Algorithm::RainbowI*` variants are insecure.
org.apache.activemq:artemis-core-client Vulnerable to Out-of-Bounds Write
Advisory: GHSA-gf8c-j759-86mg
Aliases: CVE-2021-4040
Published: 2022-08-25T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.
next-auth before v4.10.2 and v3.29.9 leaks excessive information into log
Advisory: GHSA-p6mm-27gq-9v3p
Aliases: CVE-2022-31186
Published: 2022-08-06T05:29:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

### Impact
An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log (which is thrown during OAuth error handling) and use it to leverage further attacks on the system, like impersonating the client to ask for extensive permissions.

### Patches
We patched this vulnerability in `v4.10.2` and `v3.29.9` by moving the log for `provider` information to the debug level. In addition, we added a warning for having the `debug: true` option turned on in production and documented it [here](https://next-auth.js.org/warnings#debug_enabled).
> You have enabled the debug option. It is meant for development only, to help you catch issues in your authentication flow and you should consider removing this option when deploying to production. One way of only allowing debugging while not in production is to set debug: process.env.NODE_ENV !== "production", so you can commit this without needing to change the value.
> 
> If you want to log debug messages during production anyway, we recommend setting the [logger option](https://next-auth.js.org/configuration/options#logger) with proper sanitization of potentially sensitive user information.

To upgrade:

```sh
npm i next-auth@latest
# or
yarn add next-auth@latest
# or
pnpm add next-auth@latest
```
(This will update to the latest v4 version, but you can change `latest` to 3 if you want to stay on v3. This is not recommended. v3 is unmaintained.)

### Workarounds

If for some reason you cannot upgrade, you can user the `logger` configuration option by sanitizing the logs:
```ts
// Example
import log from "your-logging-service"
export const authOptions: NextAuthOptions = {
  debug: process.env.NODE_ENV !== "production",
  logger: {
    error: (code, metadata) => {
      if (!(metadata instanceof Error) &&  metadata.provider) {
        // redact the provider secret here
        delete metadata.provider
        log.error(code, metadata)
      } else {
        log.error(code, metadata)
      }
    }
  },
}
```

### References
Related documentation:
- https://next-auth.js.org/warnings#debug_enabled
- https://next-auth.js.org/configuration/options#logger 
- https://next-auth.js.org/getting-started/upgrade-v4

### For more information
If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability

### Timeline
The issue was reported 18th of July, a response was sent out in less than 20 minutes and after identifying the issue a patch was published within a week.
OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals
Advisory: GHSA-xrc4-737v-9q75
Aliases: CVE-2022-31198
Published: 2022-08-18T18:48:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

This issue concerns instances of Governor that use the module `GovernorVotesQuorumFraction`, a mechanism that determines quorum requirements as a percentage of the voting token's total supply. In affected instances, when a proposal is passed to lower the quorum requirement, past proposals may become executable if they had been defeated only due to lack of quorum, and the number of votes it received meets the new quorum requirement.

Analysis of instances on chain found only one proposal that met this condition, and we are actively monitoring for new occurrences of this particular issue.

### Patches

This issue has been patched in v4.7.2.

### Workarounds

Avoid lowering quorum requirements if a past proposal was defeated for lack of quorum.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3561

### For more information

If you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
PrestaShop Product Comments Cross-site Scripting vulnerability
Advisory: GHSA-prrh-qvhf-x788
Aliases: CVE-2022-35933
Published: 2022-08-31T21:27:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

### Impact
An attacker could steal an admin's cookie

### Patches
The issue is fixed in 5.0.2

### References
[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)
ansible-runner 2.0.0 default temporary files written to world R/W locations
Advisory: GHSA-wwch-cmqr-hhrm
Aliases: CVE-2021-3701
Published: 2022-08-24T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
Cronos vulnerable to DoS through unintended Contract Selfdestruct
Advisory: GHSA-gwj5-wp6r-5q9f
Published: 2022-08-11T18:08:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

In Cronos nodes running versions before v0.7.0, the contract selfdestruct invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in Ethermint, all contracts that used the identical bytecode (i.e shared the same CodeHash) will also stop working once one contract invokes selfdestruct, even though the other contracts did not invoke the selfdestruct OPCODE. Thanks to the successfully coordinated security vulnerability disclosure, no smart contracts were impacted through the use of this vulnerability. Smart contract states and storage values are not affected by this vulnerability. This problem has been patched in Cronos v0.8.0. The patch has state machine-breaking changes and the required coordinated network upgrade was done on the block height 3982500 on the Cronos mainnet beta network. If a contract is subject to DoS due to this issue, the user can redeploy the same contract, i.e with identical bytecode, so that the original contract's code is recovered.
Raneto Denial of Service via crafted payload injected into `Search` parameter
Advisory: GHSA-xxc2-j7jj-6g5m
Aliases: CVE-2022-35142
Published: 2022-08-05T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the `Search` parameter.
`undici.request` vulnerable to SSRF using absolute URL on `pathname`
Advisory: GHSA-8qr4-xgw6-wmr3
Aliases: CVE-2022-35949
Published: 2022-08-18T18:59:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact

`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`.

If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1`

```js
const undici = require("undici")
undici.request({origin: "http://example.com", pathname: "//127.0.0.1"})
```

Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`.

If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL.

### Patches

This issue was fixed in `undici@5.8.1`.

### Workarounds

The best workaround is to validate user input before passing it to the `undici.request` call.

## For more information
If you have any questions or comments about this advisory:

- Open an issue in [undici repository](https://github.com/nodejs/undici/issues)
- To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document
Django vulnerable to Reflected File Download attack 
Advisory: GHSA-8x94-hmjh-97hq
Aliases: CVE-2022-36359
Published: 2022-08-11T14:49:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a FileResponse when the filename is derived from user-supplied input.
Moodle XSS Vulnerability
Advisory: GHSA-cwhp-rqfr-8462
Aliases: CVE-2020-1691
Published: 2022-08-06T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting.
ZK Framework vulnerable to malicious POST
Advisory: GHSA-6278-2q4m-cmf3
Aliases: CVE-2022-36537
Published: 2022-08-27T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

ZK Framework version 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
OpenZeppelin Contracts ERC165Checker unbounded gas consumption
Advisory: GHSA-7grf-83vw-6f5x
Aliases: CVE-2022-35915
Published: 2022-08-14T00:23:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact

The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a bounded cost.

### Patches

The issue has been fixed in v4.7.2.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3587

### For more information

If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
JSPUI vulnerable to path traversal in submission (resumable) upload
Advisory: GHSA-qp5m-c3m9-8q2p
Aliases: CVE-2022-31194
Published: 2022-08-06T05:47:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

### Impact
The JSPUI resumable upload implementations in SubmissionController and FileUploadRequest are vulnerable to multiple path traversal attacks, allowing an attacker to create files/directories anywhere on the server writable by the Tomcat/DSpace user, by modifying some request parameters during submission. This path traversal can only be executed by a user with special privileges (submitter rights). This vulnerability only impacts the JSPUI.

_This vulnerability does NOT impact the XMLUI or 7.x._

### Patches

_DSpace 6.x:_
* Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/7569c6374aefeafb996e202cf8d631020eda5f24
* 6.x patch file: https://github.com/DSpace/DSpace/commit/7569c6374aefeafb996e202cf8d631020eda5f24.patch (may be applied manually if an immediate upgrade to 6.4 or above is not possible)

_DSpace 5.x:_
* Fixed in 5.11 via commit: https://github.com/DSpace/DSpace/commit/d1dd7d23329ef055069759df15cfa200c8e3
* 5.x patch file: https://github.com/DSpace/DSpace/commit/d1dd7d23329ef055069759df15cfa200c8e3.patch (may be applied manually if an immediate upgrade to 5.11 or 6.4 is not possible)

#### Apply the patch to your DSpace
If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:
1. Download the appropriate patch file to the machine where DSpace is running
2. From the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`
3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
    1. Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)
    2. Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.
    3. Restart Tomcat

### Workarounds

There are no known workarounds. However, this vulnerability cannot be exploited by an anonymous user or a basic user. The user must first have submitter privileges to at least one Collection and be able to determine how to modify the request parameters to exploit the vulnerability.

### References
Discovered & reported by Johannes Moritz of Ripstech

### For more information
If you have any questions or comments about this advisory:
* Email us at security@dspace.org
oqs's Post-Quantum Key Encapsulation Mechanism SIKE broken
Advisory: GHSA-hrjv-pf36-jpmr
Published: 2022-08-18T19:01:15Z

Wouter Castryck and Thomas Decru presented an efficient key recovery attack on the SIDH protocol.
As a result, the secret key of SIKEp751 can be recovered in a matter of hours.
The SIKE and SIDH schemes will be removed from oqs 0.7.2.

[An efficient key recovery attack on SIDH (preliminary version)](https://eprint.iacr.org/2022/975)
Keycloak allows arbitrary Javascript to be uploaded for SAML protocol mapper even if UPLOAD_SCRIPTS feature disabled
Advisory: GHSA-q2gp-gph3-88x9
Published: 2022-08-06T00:00:42Z
Withdrawn: 2022-09-23T16:30:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-wf7g-7h6h-678v]https://github.com/advisories/GHSA-wf7g-7h6h-678v). This link is maintained to preserve external references.

## Original Description
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled.
JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack
Advisory: GHSA-v866-gwf5-w92f
Aliases: CVE-2022-38179
Published: 2022-08-13T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack.
Froxlor vulnerable to Cross-Site Request Forgery (CSRF)
Advisory: GHSA-9xgp-3mxp-rv7x
Aliases: CVE-2022-3017
Published: 2022-08-29T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 0.10.38.
uri-template-lite Regular Expression Denial of Service
Advisory: GHSA-chw2-6c7r-37p7
Aliases: CVE-2021-43309
Published: 2022-08-25T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method.
@acrontum/filesystem-template vulnerable to Command Injection due to fetchRepo API missing sanitization
Advisory: GHSA-m2fc-9h5m-29cm
Aliases: CVE-2022-21186
Published: 2022-08-06T00:00:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package @acrontum/filesystem-template before 0.0.2 is vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input.
Network Policies & (Clusterwide) Cilium Network Policies with namespace label selectors may unexpectedly select pods with maliciously crafted labels
Advisory: GHSA-pfhr-pccp-hwmh
Published: 2022-08-30T20:06:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

### Impact

If a user has Network Policies with namespace selectors selecting labels of namespaces, or (clusterwide) Cilium Network Policies matching on namespace labels, then it is possible for an attacker with Kubernetes pod deploy rights (either directly or indirectly via higher-level APIs such as Deployment, Daemonset etc) to craft additional pod labels such that the pod is selected by another policy that exists rather than the expected policy. 

### Patches

The problem has been fixed and is available on versions >=1.10.14, >=1.11.8, >=1.12.1

### Workarounds

There are no workarounds available.

### Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to Sander Mathijssen for not only highlighting the issue but also proposing a resolution. 

### For more information

If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
untangle vulnerable to Improper Restriction of XML External Entity Reference
Advisory: GHSA-f83q-2cp7-qrjg
Aliases: CVE-2022-31471
Published: 2022-08-06T05:30:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Description
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external entity references. By exploiting this vulnerability, a remote unauthenticated attacker may read the contents of local files.

### Impact
An attacker may be able to read the contents of local files. This affects untangle versions up to and including 1.2.0

### Patches
The problem has been fixed with version 1.2.1

### Workarounds
None

### References
https://jvn.jp/en/jp/JVN30454777/

### For more information
If you have any questions or comments about this advisory:
* Open an [issue](https://github.com/stchris/untangle/issues)
CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process
Advisory: GHSA-42wq-rch8-6f6j
Aliases: CVE-2022-31175
Published: 2022-08-06T09:40:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

### Affected packages
@ckeditor/ckeditor5-markdown-gfm
@ckeditor/ckeditor5-html-support
@ckeditor/ckeditor5-html-embed

### Impact
A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions:

a) Using one of the affected packages. In case of `ckeditor5-html-support` and `ckeditor5-html-embed`, additionally, it was required to use a configuration that allows unsafe markup inside the editor,
b) Initializing the editor on an element and using an element other than `<textarea>` as a base,
c) Destroying the editor instance.

The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. 

This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use [Markdown](https://ckeditor.com/docs/ckeditor5/latest/features/markdown.html), [General HTML Support](https://ckeditor.com/docs/ckeditor5/latest/features/general-html-support.html) or [HTML embed](https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html) features.

### Patches
The problem has been recognized and patched. The fix will be available in version 35.0.1.

### For more information
Email us at [security@cksource.com](mailto:security@cksource.com) if you have any questions or comments about this advisory.
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
Advisory: GHSA-4h98-2769-gh6h
Aliases: CVE-2022-35961
Published: 2022-08-18T19:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

### Impact

The functions `ECDSA.recover` and `ECDSA.tryRecover` are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single `bytes` argument, and not the functions that take `r, v, s` or `r, vs` as separate arguments.

The potentially affected contracts are those that implement signature reuse or replay protection by marking the signature itself as used rather than the signed message or a nonce included in it. A user may take a signature that has already been submitted, submit it again in a different form, and bypass this protection.

### Patches

The issue has been patched in 4.7.3.


### For more information

If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
Denial of service due to incorrect application of event authorization rules
Advisory: GHSA-jhjh-776m-4765
Aliases: CVE-2022-31152
Published: 2022-08-31T21:25:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.3/rooms/v10/#authorization-rules) which must be checked when determining if an event should be accepted into a room.

In versions of Synapse up to and including v1.61, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers.

### Patches

Administrators of homeservers with federation enabled are advised to upgrade to v1.62.0 or higher.

### Workarounds

 * Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`).

### References

 * https://github.com/matrix-org/synapse/pull/13087
 * https://github.com/matrix-org/synapse/pull/13088

### For more information

If you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
Streamlit directory traversal vulnerability
Advisory: GHSA-v4hr-4jpx-56gc
Aliases: CVE-2022-35918
Published: 2022-08-06T05:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

### Impact
Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data from their web server file-system such as: server logs, world readable files, and potentially other sensitive information.

An attacker can craft a malicious URL with file paths and the streamlit server would process that URL and return the contents of that file.

### Patches
On July 27th at 2:20PM PST we rolled out a patch in release 1.11.1. This patch ensures that any file operations are restricted only to the custom component directory and cannot traverse outside of that. We strongly recommend users upgrade to v1.11.1 as soon as possible. We have notified the Streamlit community and popular hosting providers about this issue so they can patch quickly. As a precautionary measure, we are also upgrading all users on Streamlit Cloud wherever possible. We continue to check other occurrences of this vulnerability and monitor potential exploits wherever we can.

Finally, as a general security practice, we recommend users review custom components for any malicious code before using them in their apps. Following security best practices such as running web servers with low privileges, firewalls, etc. for hosting your apps, helps in mitigating the severity of such exploits.

### Workarounds
None.

### References
* https://docs.google.com/document/d/e/2PACX-1vRzF9K6gwv9KnQz---1pt0SdHMVt-CHuKMmdTH1uct7xPcK7vToP4FvYdI84aO6rGfCmrBSaViri0Nd/pub

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@streamlit.io](mailto:security@streamlit.io)
Google Play Services SDK leads to apps having incorrectly set mutability flag
Advisory: GHSA-cm6r-892j-jv2g
Aliases: CVE-2022-2390
Published: 2022-08-13T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
JSPUI spellcheck and autocomplete tools vulnerable to Cross Site Scripting
Advisory: GHSA-c558-5gfm-p2r8
Aliases: CVE-2022-31191
Published: 2022-08-06T05:46:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

### Impact
The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text.  Similarly, the JSPUI autocomplete HTML does not properly escape text passed to it. Both are vulnerable to XSS.  This vulnerability only impacts the JSPUI.

_This vulnerability does NOT impact the XMLUI or 7.x._

### Patches
_DSpace 6.x:_
* Fixed in 6.4 via two commits: 
    * Fix for spellcheck: https://github.com/DSpace/DSpace/commit/ebb83a75234d3de9be129464013e998dc929b68d
    * Fix for autocomplete: https://github.com/DSpace/DSpace/commit/35030a23e48b5946f5853332c797e1c4adea7bb7
* 6.x patch files available (may be applied manually if an immediate upgrade to 6.4 or above is not possible)
    * Fix for spellcheck: https://github.com/DSpace/DSpace/commit/ebb83a75234d3de9be129464013e998dc929b68d.patch
    * Fix for autocomplete: https://github.com/DSpace/DSpace/commit/35030a23e48b5946f5853332c797e1c4adea7bb7.patch

_DSpace 5.x:_
* Fixed in 5.11 via two commits: 
    * Fix for spellcheck: https://github.com/DSpace/DSpace/commit/c89e493e517b424dea6175caba54e91d3847fc3a
    * Fix for autocomplete: https://github.com/DSpace/DSpace/commit/6f75bb084ab1937d094208c55cd84340040bcbb5
* 5.x patch files available (may be applied manually if an immediate upgrade to 5.11 or 6.4 is not possible)
    * Fix for spellcheck: https://github.com/DSpace/DSpace/commit/c89e493e517b424dea6175caba54e91d3847fc3a.patch
    * Fix for autocomplete: https://github.com/DSpace/DSpace/commit/6f75bb084ab1937d094208c55cd84340040bcbb5.patch

#### Apply the patch to your DSpace
If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:
1. Download the appropriate patch file to the machine where DSpace is running
2. From the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`
3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
    1. Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)
    2. Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.
    3. Restart Tomcat

### References
Discovered & reported by Hassan Bhuiyan (Brunel University London)

### For more information
If you have any questions or comments about this advisory:
* Email us at security@dspace.org
4thline cling uPnP protocol issue can lead to denial of service
Advisory: GHSA-c438-6f6r-pg8w
Aliases: CVE-2020-23622
Published: 2022-08-16T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked `CALLBACK` parameter in the request header. As of 2022, 4thline cling is no longer supported by the maintainers.
Captcha Bypass in strapi-plugin-ezforms
Advisory: GHSA-8mgq-6r2q-82w9
Published: 2022-08-30T20:54:12Z

### Impact
Users using any captcha providers

### Patches
>0.1.0

### References
[Issue](https://github.com/excl-networks/strapi-plugin-ezforms/issues/15)
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
Advisory: GHSA-r38f-c4h4-hqq2
Aliases: CVE-2022-31197
Published: 2022-08-06T05:51:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

### Impact
_What kind of vulnerability is it? Who is impacted?_

The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. This could lead to executing additional SQL commands as the application's JDBC user.

User applications that do not invoke the `ResultSet.refreshRow()` method are not impacted.

User application that do invoke that method are impacted if the underlying database that they are querying via their JDBC application may be under the control of an attacker. The attack requires the attacker to trick the user into executing SQL against a table name who's column names would contain the malicious SQL and subsequently invoke the `refreshRow()` method on the ResultSet.

For example:

```sql
CREATE TABLE refresh_row_example (
  id     int PRIMARY KEY,
  "1 FROM refresh_row_example; SELECT pg_sleep(10); SELECT * " int
);
```

This example has a table with two columns. The name of the second column is crafted to contain a statement terminator followed by additional SQL. Invoking the `ResultSet.refreshRow()` on a ResultSet that queried this table, e.g. `SELECT * FROM refresh_row`, would cause the additional SQL commands such as the `SELECT pg_sleep(10)` invocation to be executed.

As the multi statement command would contain multiple results, it would not be possible for the attacker to get data directly out of this approach as the `ResultSet.refreshRow()` method would throw an exception. However, the attacker could execute any arbitrary SQL including inserting the data into another table that could then be read or any other DML / DDL statement.

Note that the application's JDBC user and the schema owner need not be the same. A JDBC application that executes as a privileged user querying database schemas owned by potentially malicious less-privileged users would be vulnerable. In that situation it may be possible for the malicious user to craft a schema that causes the application to execute commands as the privileged user.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, versions 42.2.26, 42.3.7, and 42.4.1 have been released with a fix.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Check that you are not using the `ResultSet.refreshRow()` method.

If you are, ensure that the code that executes that method does not connect to a database that is controlled by an unauthenticated or malicious user. If your application only connects to its own database with a fixed schema with no DDL permissions, then you will not be affected by this vulnerability as it requires a maliciously crafted schema.
OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information
Advisory: GHSA-f4qr-f4xx-hjxw
Aliases: CVE-2022-35980
Published: 2022-08-12T17:31:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
Requests to an OpenSearch cluster configured with advanced access control features ([document level security (DLS)](https://opensearch.org/docs/latest/security-plugin/access-control/document-level-security/), [field level security (FLS)](https://opensearch.org/docs/latest/security-plugin/access-control/field-level-security/), and/or [field masking](https://opensearch.org/docs/latest/security-plugin/access-control/field-masking/)) will not be filtered when the query's search pattern matches an aliased index.

OpenSearch Dashboards creates an alias to `.kibana` by default, so filters with the index pattern of `*` to restrict access to documents or fields will not be applied.

This issue allows requests to access sensitive information when customer have acted to restrict access that specific information. 

### Patches
OpenSearch 2.2.0+ contains the fix for this issue. OpenSearch Security Plugin 2.2.0.0 is compatible with OpenSearch 2.2.0.

### Workarounds
There is no recommended work around.

### References
See pull request #1999 for additional details.

### For more information
If you have any questions or comments about this advisory we ask that contact AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do **not** create a public GitHub issue.
Broken Authorization in ZITADEL Actions
Advisory: GHSA-c8fj-4pm8-mp2c
Aliases: CVE-2022-36051
Published: 2022-08-30T20:54:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

### Impact

**Actions**, introduced in ZITADEL **1.42.0** on the API and **1.56.0** for Console, is a feature, where users with role `ORG_OWNER` are able to create Javascript Code, which is invoked by the system at certain points during the login.
**Actions**, for example, allow creating authorizations (user grants) on newly created users programmatically.
Due to a missing authorization check, **Actions** were able to grant authorizations for projects that belong to other organisations inside the same Instance. Granting authorizations via API and Console is not affected by this vulnerability.

### Patches

2.x versions are fixed on >= [2.2.0](https://github.com/zitadel/zitadel/releases/tag/v2.2.0)
1.x versions are fixed on >= [1.87.1](https://github.com/zitadel/zitadel/releases/tag/v1.87.1)

ZITADEL recommends upgrading to the latest versions available in due course.

### Workarounds

There is no workaround since a patch is already available.

### Who did disclose this

During our recurring white box penetration test our external security consultant found this issue.
The full report will be made public after the complete review.

### References

https://docs.zitadel.com/docs/guides/manage/customize/behavior
https://docs.zitadel.com/docs/apis/actions
https://zitadel.com/blog/pentest-results-h1-2021

### Questions

If you have any questions or comments about this advisory:
* Email us at [security@zitadel.com](mailto:security@zitadel.com)
python-oslo-utils has improper password parsing
Advisory: GHSA-wmqq-r32m-87c5
Aliases: CVE-2022-0718
Published: 2022-08-29T20:06:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext
Go Ethereum allows attackers to use manipulation of time-difference values to achieve replacement of main-chain blocks
Advisory: GHSA-rqmg-hrg4-fm69
Aliases: CVE-2022-37450
Published: 2022-08-06T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation of time-difference values to achieve replacement of main-chain blocks, aka Riskless Uncle Making (RUM), as exploited in the wild in 2020 through 2022.
Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp
Advisory: GHSA-9x9j-vrhj-v364
Aliases: CVE-2022-28731
Published: 2022-08-05T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
Remote code execution in Apache Airflow Docker's Provider
Advisory: GHSA-746v-hfh2-xphm
Aliases: CVE-2022-38362
Published: 2022-08-17T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above.
gitblame susceptible to command injection
Advisory: GHSA-3486-rvxc-hrrj
Aliases: CVE-2020-28434
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.
Missing password strength check in notrinos/notrinos-erp
Advisory: GHSA-qhm8-69qh-g76j
Aliases: CVE-2022-2927
Published: 2022-08-23T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

In versions of notrinos/notrinoserp prior to 0.7 new account passwords were missing a password strength check.
Socket.IO-client Java before 2.0.1 vulnerable to NULL Pointer Dereference
Advisory: GHSA-85xx-xhjm-rhrw
Aliases: CVE-2022-25867
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package io.socket:socket.io-client before 2.0.1 is vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format.
node-opcua DoS when bypassing limitations for excessive memory consumption
Advisory: GHSA-vh4f-fgpp-x8x2
Aliases: CVE-2022-24375
Published: 2022-08-25T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple `CloseSession` requests with the `deleteSubscription` parameter equal to `False`.
Exposure of Sensitive Information in OPCFoundation.NetStandard.Opc.Ua.Server
Advisory: GHSA-mw9h-hcp7-fgc6
Aliases: CVE-2022-33916
Published: 2022-08-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OPC UA .NET Standard Reference Server 1.04.368 allows a remote attacker to cause the application to access sensitive information.