aswin1906/github-advisory-2022 huggingface dataset:
MessagePack for Golang subject to DoS via Unmarshal panic
Advisory: GHSA-jr77-8gx4-h5qh
Aliases: CVE-2022-41719
Published: 2022-11-11T12:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.
Apache Ivy does not verify target path when extracting the archive
Advisory: GHSA-94rr-4jr5-9h2p
Aliases: CVE-2022-37865
Published: 2022-11-07T12:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used
pack200 or zip packaging.

For artifacts using the "zip", "jar" or "war" packaging Ivy prior to version 2.5.1 doesn't verify the target path when extracting the archive. An archive containing absolute paths or paths that try to traverse "upwards" using ".." sequences can then write files to any location on
the local fie system that the user executing Ivy has write access to.

Ivy users of version 2.4.0 to 2.5.0 should upgrade to Ivy version 2.5.1.
Use of unclaimed s3 bucket in tests and examples
Advisory: GHSA-rc39-g977-687w
Aliases: CVE-2022-36022
Published: 2022-11-10T21:27:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact
People who use some older NLP examples that reference the old S3 bucket.

### Patches
The problem has been patched. Upgrade to snapshots for now. A release will be published later to address this due to the  vulnerability mostly being examples and 1 class in the actual code base.

### Workarounds
Download a word2vec google news vector from a new source using git lfs
Spring Security authorization rules can be bypassed via forward or include dispatcher types
Advisory: GHSA-mmmh-wcxm-2wr4
Aliases: CVE-2022-31692
Published: 2022-11-01T12:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
Concrete CMS vulnerable to Reflected Cross-Site Scripting via dashboard icons
Advisory: GHSA-8782-xgh5-r7mv
Aliases: CVE-2022-43968
Published: 2022-11-15T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
`tf.raw_ops.Mfcc` crashes
Advisory: GHSA-rmg2-f698-wq35
Aliases: CVE-2022-41896
Published: 2022-11-21T21:53:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If [`ThreadUnsafeUnigramCandidateSampler`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc) is given input `filterbank_channel_count` greater than the allowed max size, TensorFlow will crash.

```python
import tensorflow as tf
tf.raw_ops.Mfcc(
    spectrogram = [[[1.38, 6.32, 5.75, 9.51]]],
    sample_rate = 2,
    upper_frequency_limit = 5.0,
    lower_frequency_limit = 1.0,
    filterbank_channel_count = 2**31 - 1,
    dct_coefficient_count = 1
)
```

### Patches
We have patched the issue in GitHub commit [39ec7eaf1428e90c37787e5b3fbd68ebd3c48860](https://github.com/tensorflow/tensorflow/commit/39ec7eaf1428e90c37787e5b3fbd68ebd3c48860).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Vul AI.
Lack of authentication mechanism for webhook in CloudBees Docker Hub/Registry Notification Plugin
Advisory: GHSA-v535-pc6r-77qh
Aliases: CVE-2022-45385
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CloudBees Docker Hub/Registry Notification Plugin provides several webhook endpoints that can be used to trigger builds when Docker images used by a job have been rebuilt.

In CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier, these endpoints can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.

CloudBees Docker Hub/Registry Notification Plugin 2.6.2.1 requires a token as a part of webhook URLs, which will act as authentication for the webhook endpoint. As a result, all webhook URLs in the plugin will be different after updating the plugin.

Administrators can set the [Java system](https://www.jenkins.io/doc/book/managing/system-properties/) property `org.jenkinsci.plugins.registry.notification.webhook.JSONWebHook.DO_NOT_REQUIRE_API_TOKEN` to `true` to disable this fix.
rdiffweb vulnerable to Insufficient Session Expiration
Advisory: GHSA-94qm-99qc-qwqj
Aliases: CVE-2022-3362
Published: 2022-11-15T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Inefficient Regular Expression Complexity in Liferay Portal 
Advisory: GHSA-vjj4-qwcm-552h
Aliases: CVE-2022-42124
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.
Jenkins Associated Files Plugin vulnerable to cross-site scripting (XSS)
Advisory: GHSA-chcg-gh9p-96c5
Aliases: CVE-2022-45401
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Currently, there are no known workarounds or patches.
Concrete CMS vulnerable to Session Fixation
Advisory: GHSA-m53v-5x5x-5m2p
Aliases: CVE-2022-43687
Published: 2022-11-15T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Segfault in `tf.raw_ops.TensorListConcat`
Advisory: GHSA-66vq-54fq-6jvv
Aliases: CVE-2022-41891
Published: 2022-11-21T20:42:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If [`tf.raw_ops.TensorListConcat`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.h) is given `element_shape=[]`, it results segmentation fault which can be used to trigger a denial of service attack.
```python
import tensorflow as tf
tf.raw_ops.TensorListConcat(
    input_handle=tf.data.experimental.to_variant(tf.data.Dataset.from_tensor_slices([1, 2, 3])),
    element_dtype=tf.dtypes.float32,
    element_shape=[]
)
```

### Patches
We have patched the issue in GitHub commit [fc33f3dc4c14051a83eec6535b608abe1d355fde](https://github.com/tensorflow/tensorflow/commit/fc33f3dc4c14051a83eec6535b608abe1d355fde).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Tong Liu, ShanghaiTech University
Silverstripe XSS in shortcodes
Advisory: GHSA-9cx2-hj6m-fv58
Aliases: CVE-2022-38724
Published: 2022-11-21T23:58:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used to inject a JavaScript payload on the front end of the site. The shortcode providers that ship with Silverstripe CMS have been reviewed and attribute whitelists have been implemented where appropriate to negate this risk.
URL XSS vulnerability due to outdated jquery in CMS
Advisory: GHSA-44xv-v98g-v79f
Aliases: CVE-2022-38146
Published: 2022-11-21T23:57:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).
Cross-Site Request Forgery in Jenkins Delete log Plugin
Advisory: GHSA-hw4f-g7wh-xp52
Aliases: CVE-2022-45393
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.
KubeView vulnerable to full cluster takeover due to improper authentication
Advisory: GHSA-22vc-5pgw-644q
Aliases: CVE-2022-45933
Published: 2022-11-27T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side project and a learning exercise," and not "very secure."
crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication
Advisory: GHSA-j2jp-wvqg-wc2g
Aliases: CVE-2022-41912
Published: 2022-11-29T23:55:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

### Impact

The crewjam/saml go library is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements.

### Patches

This issue has been corrected in version 0.4.9.

### Credit

This issue was reported by Felix Wilhelm from Google Project Zero.
Cross-site Scripting in Jenkins Naginator Plugin
Advisory: GHSA-h8hf-hxx6-5g6v
Aliases: CVE-2022-45382
Published: 2022-11-16T12:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to edit build display names.

Naginator Plugin 1.18.2 escapes display names of source builds.
Overflow in `ResizeNearestNeighborGrad`
Advisory: GHSA-368v-7v32-52fx
Aliases: CVE-2022-41907
Published: 2022-11-21T22:04:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
When [`tf.raw_ops.ResizeNearestNeighborGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/resize_nearest_neighbor_op.cc) is given a large `size` input, it overflows.
```
import tensorflow as tf

align_corners = True
half_pixel_centers = False
grads = tf.constant(1, shape=[1,8,16,3], dtype=tf.float16)
size = tf.constant([1879048192,1879048192], shape=[2], dtype=tf.int32)
tf.raw_ops.ResizeNearestNeighborGrad(grads=grads, size=size, align_corners=align_corners, half_pixel_centers=half_pixel_centers)
```

### Patches
We have patched the issue in GitHub commit [00c821af032ba9e5f5fa3fe14690c8d28a657624](https://github.com/tensorflow/tensorflow/commit/00c821af032ba9e5f5fa3fe14690c8d28a657624).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou from the Secure Systems Lab (SSL) at Brown University.
Missing Authorization in HashiCorp Consul
Advisory: GHSA-gw2g-hhc9-wgjh
Aliases: CVE-2022-3920
Published: 2022-11-16T12:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
pymatgen is vulnerable to Regular Expression Denial of Service (ReDoS)
Advisory: GHSA-5jqp-885w-xj32
Aliases: CVE-2022-42964
Published: 2022-11-10T12:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the `GaussianInput.from_string` method.
Prevent RCE when deserializing untrusted user input
Advisory: GHSA-442f-wcwq-fpcf
Aliases: CVE-2022-41922
Published: 2022-11-21T22:32:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
Affected versions of `yiisoft/yii` are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input.

### Patches
Upgrade `yiisoft/yii` to version 1.1.27 or higher.

### For more information
See the following links for more details:
- [Git commit](https://github.com/yiisoft/yii/commit/ed67b7cc57216557c5c595c6650cdd2d3aa41c52)
- https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection

If you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).
Matrix-appservice-irc vulnerable to sql injection via roomIds argument
Advisory: GHSA-ffwf-47x2-jpr8
Aliases: CVE-2022-3971
Published: 2022-11-13T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability was found in matrix-appservice-irc up to 0.35.1. This vulnerability affects the file src/datastore/postgres/PgDataStore.ts. The manipulation of the argument roomIds leads to sql injection. Upgrading to version 0.36.0 is able to address this issue. The name of the patch is 179313a37f06b298150edba3e2b0e5a73c1415e7. It is recommended to upgrade the affected component.
Segfault in `CompositeTensorVariantToComponents`
Advisory: GHSA-rjx6-v474-2ch9
Aliases: CVE-2022-41909
Published: 2022-11-21T22:17:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in [`tf.raw_ops.CompositeTensorVariantToComponents`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc).

```python
import tensorflow as tf

encode = tf.raw_ops.EmptyTensorList(element_dtype=tf.int32, element_shape=[10, 15], max_num_elements=2)
meta= ""
component=[tf.int32]

print(tf.raw_ops.CompositeTensorVariantToComponents(encoded=encode,metadata=meta,Tcomponents=component))
```

### Patches
We have patched the issue in GitHub commits [bf594d08d377dc6a3354d9fdb494b32d45f91971](https://github.com/tensorflow/tensorflow/commit/bf594d08d377dc6a3354d9fdb494b32d45f91971) and [660ce5a89eb6766834bdc303d2ab3902aef99d3d](https://github.com/tensorflow/tensorflow/commit/660ce5a89eb6766834bdc303d2ab3902aef99d3d).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by pattarakritr@smu.edu.sg
Reflected Cross site scripting (XSS) in kairosdb
Advisory: GHSA-fjhh-67wv-7gr4
Aliases: CVE-2019-19040
Published: 2022-11-03T18:42:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
PHPServerMon PRNG has Insufficient Entropy
Advisory: GHSA-hc4j-7mqg-cxjj
Aliases: CVE-2021-4241
Published: 2022-11-16T12:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function `setUserLoggedIn` of the file `src/psm/Service/User.php`. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is bb10a5f3c68527c58073258cb12446782d223bc3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213744.
ibexa/admin-ui vulnerable to Cross-site Scripting in content type name/shortname
Advisory: GHSA-7644-cxp8-h23r
Published: 2022-11-10T23:52:31Z

Critical severity. It is possible to inject JavaScript XSS in the content type entries "name" and "short name". To exploit this, one must already have permission to edit content types, which limits it in many cases to people who are already administrators. However, please verify which users have this permission. The fix ensures any injections are escaped.
XXE vulnerability in Jenkins JAPEX Plugin
Advisory: GHSA-8538-25v4-25pg
Aliases: CVE-2022-45400
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control XML input files for the 'Record Japex test report' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Apache SOAP contains unauthenticated RPCRouterServlet
Advisory: GHSA-789v-h9hw-38pg
Aliases: CVE-2022-45378
Published: 2022-11-14T19:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

** UNSUPPORTED WHEN ASSIGNED ** In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Incorrect permission checks in Jenkins Support Core Plugin
Advisory: GHSA-w2j3-pq63-339w
Aliases: CVE-2022-45383
Published: 2022-11-16T12:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Support Core Plugin defines the permission Support/DownloadBundle that allows users without Overall/Administer permission to create and download support bundles containing a limited set of diagnostic information.

Support Core Plugin 1206.v14049fa_b_d860 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission.

Support Core Plugin 1206.1208.v9b_7a_1d48db_0f deprecates the Support/DownloadBundle permission. The Overall/Administer permission is now required to download support bundles.
Cross-site Scripting in librenms/librenms
Advisory: GHSA-qch4-jmf8-xvp7
Aliases: CVE-2022-4067
Published: 2022-11-20T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
Invalid char to bool conversion when printing a tensor
Advisory: GHSA-pf36-r9c6-h97j
Aliases: CVE-2022-41911
Published: 2022-11-21T22:18:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
When [printing a tensor](https://github.com/tensorflow/tensorflow/blob/807cae8a807960fd7ac2313cde73a11fc15e7942/tensorflow/core/framework/tensor.cc#L1200-L1227), we get it's data as a `const char*` array (since that's the underlying storage) and then we typecast it to the element type. However, conversions from `char` to `bool` are undefined if the `char` is not `0` or `1`, so sanitizers/fuzzers will crash.

### Patches
We have patched the issue in GitHub commit [1be743703279782a357adbf9b77dcb994fe8b508](https://github.com/tensorflow/tensorflow/commit/1be743703279782a357adbf9b77dcb994fe8b508).

The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1, TensorFlow 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability was discovered via internal fuzzing.
muhammara and hummus vulnerable to denial of service by NULL pointer dereference
Advisory: GHSA-9cv5-4wqv-9w94
Aliases: CVE-2022-25892
Published: 2022-11-01T12:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

### Patches
It has been patched in 3.1.1 and has been backported to 2.6.1
Hummus has a patch in 1.0.111.

### Workarounds
Do not process files from untrusted sources or update.

### References
https://nvd.nist.gov/vuln/detail/CVE-2022-25892
https://github.com/galkahana/HummusJS/issues/463
https://github.com/julianhille/MuhammaraJS/issues/214
https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002
https://github.com/julianhille/MuhammaraJS/commit/90b278d09f16062d93a4160ef0a54d449d739c51
https://security.snyk.io/vuln/SNYK-JS-HUMMUS-3091138
https://security.snyk.io/vuln/SNYK-JS-MUHAMMARA-3060320
Cross-site Scripting in pimcore
Advisory: GHSA-cg3h-rc9q-g8v9
Aliases: CVE-2022-0509
Published: 2022-02-09T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

pimcore version 10.3.0 and prior is vulnerable to cross-site scripting.
Arbitrary Code Execution
Advisory: GHSA-997c-fj8j-rq5h
Aliases: CVE-2014-9357
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
Limited ability to spoof SAML authentication with missing audience verification in Fleet
Advisory: GHSA-ch68-7cf4-35vr
Aliases: CVE-2022-23600
Published: 2022-02-07T21:57:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact

This impacts deployments using SAML SSO in two specific cases:

1. A malicious or compromised Service Provider (SP) could reuse the SAML response to log into Fleet as a user -- only if the user has an account with the same email in Fleet, _and_ the user signs into the malicious SP via SAML SSO from the same Identity Provider (IdP) configured with Fleet.
2. A user with an account in Fleet could reuse a SAML response intended for another SP to log into Fleet. This is only a concern if the user is blocked from Fleet in the IdP, but continues to have an account in Fleet. If the user is blocked from the IdP entirely, this cannot be exploited.

### Patches
Fleet 4.9.1 resolves this issue.

### Workarounds and good practices
* Reduce the length of sessions on your IdP to reduce the window for malicious re-use.
* Limit the amount of SAML Service Providers/Applications used by user accounts with access to Fleet.
* When removing access to Fleet in the IdP, delete the Fleet user from Fleet as well.

### For more information
If you have any questions or comments about this advisory:
* Join us in the #fleet channel of [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw).
* Email us at [security@fleetdm.com](mailto:security@fleetdm.com).
gobase subject to Incorrect routing of some HTTP requests when using httpauth due to a race condition
Advisory: GHSA-h2x7-2ff6-v32p
Published: 2022-02-11T23:39:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact
Incorrect routing of some HTTP requests when using httpauth due to a race condition

### Patches
Upgrade to version 0.7.2 for fix

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [nbosscher@blue-giraffe.ca](mailto:nbosscher@blue-giraffe.ca)
Studio 42 elFinder allows stored XSS
Advisory: GHSA-c3j8-q5x6-2855
Aliases: CVE-2021-45919
Published: 2022-02-10T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.
Uninitialized variable access in Tensorflow
Advisory: GHSA-q85f-69q7-55h2
Aliases: CVE-2022-23573
Published: 2022-02-09T23:26:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

### Impact
The [implementation of `AssignOp`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/assign_op.h#L30-L143) can result in copying unitialized data to a new tensor. This later results in undefined behavior.

The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized.
  
### Patches
We have patched the issue in GitHub commit [ef1d027be116f25e25bb94a60da491c2cf55bd0b](https://github.com/tensorflow/tensorflow/commit/ef1d027be116f25e25bb94a60da491c2cf55bd0b).
    
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Path Traversal in SharpZipLib
Advisory: GHSA-2x7h-96h5-rq84
Aliases: CVE-2021-32841
Published: 2022-02-01T16:22:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.
Uncaught Exception in fastify-multipart
Advisory: GHSA-qh73-qc3p-rjv2
Aliases: CVE-2021-23597
Published: 2022-02-11T18:57:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

This is a bypass of CVE-2020-8136 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8136).
By providing a `name=constructor` property it is still possible to crash the application.
The original fix only checks for the key `__proto__` (https://github.com/fastify/fastify-multipart/pull/116).

All users are recommended to upgrade

### Patches

v5.3.1 includes a patch
 
### Workarounds

No workarounds are possible.

### References

Read up https://www.fastify.io/docs/latest/Guides/Prototype-Poisoning/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/fastify/fastify-multipart](https://github.com/fastify/fastify-multipart)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Use after free in `DecodePng` kernel
Advisory: GHSA-24x4-6qmh-88qg
Aliases: CVE-2022-23584
Published: 2022-02-09T23:57:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

### Impact
A malicious user can cause a use after free behavior when [decoding PNG images](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/image/decode_image_op.cc#L339-L346):
```cc
if (/* ... error conditions ... */) {
  png::CommonFreeDecode(&decode);
  OP_REQUIRES(context, false,
              errors::InvalidArgument("PNG size too large for int: ",
                                      decode.width, " by ", decode.height));
}   
```
After `png::CommonFreeDecode(&decode)` gets called, the values of `decode.width` and `decode.height` are in an unspecified state.

### Patches
We have patched the issue in GitHub commit [e746adbfcfee15e9cfdb391ff746c765b99bdf9b](https://github.com/tensorflow/tensorflow/commit/e746adbfcfee15e9cfdb391ff746c765b99bdf9b).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Cross-site Scripting in Django
Advisory: GHSA-95rw-fx8r-36v6
Aliases: CVE-2022-22818
Published: 2022-02-04T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The `{% debug %}` template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
Cross site scripting in apache airflow
Advisory: GHSA-65xw-pcqw-hjrh
Aliases: CVE-2021-45229
Published: 2022-02-26T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.
Exposure of server configuration in github.com/go-vela/server
Advisory: GHSA-gv2h-gf8m-r68j
Aliases: CVE-2020-26294
Published: 2022-02-15T00:19:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

### Impact
_What kind of vulnerability is it? Who is impacted?_

* The ability to expose configuration set in the [Vela server](https://github.com/go-vela/server) via [pipeline template functionality](https://go-vela.github.io/docs/templates/overview/).
* It impacts all users of Vela.


Sample of template exposing server configuration [using Sprig's `env` function](http://masterminds.github.io/sprig/os.html):

```yaml
metadata:
  template: true

steps:
  - name: sample
    image: alpine:latest
    commands:
      # OAuth client ID for Vela <-> GitHub communication
      - echo {{ env "VELA_SOURCE_CLIENT" }}
      # secret used for server <-> worker communication
      - echo {{ env "VELA_SECRET" }}
```

### Patches
_Has the problem been patched? What versions should users upgrade to?_

* Upgrade to `0.6.1`

#### Additional Recommended Action(s)

* Rotate all secrets

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

* No

### For more information

If you have any questions or comments about this advisory:

* Email us at [vela@target.com](mailto:vela@target.com)
Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel
Advisory: GHSA-x8xx-x82q-42q3
Aliases: CVE-2022-25336
Published: 2022-02-19T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, since not all possible attack vectors are removed from the original file name.

The second issue is that direct access to the images is not access controlled. This is by design, for performance reasons, and documented as such. But it does mean that images not meant to be publicly accessible can be accessed, provided that the image path and filename is correctly deduced and/or guessed, through dictionary attacks and similar.
Hadoop token in temp file visible to all users in Apache Gobblin
Advisory: GHSA-p435-w4xm-jj8x
Aliases: CVE-2021-36151
Published: 2022-02-06T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Cross Site Request Forgery in concrete5/concrete5 
Advisory: GHSA-gr23-g276-xc73
Aliases: CVE-2021-22954
Published: 2022-02-11T00:00:58Z

A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
OS Command Injection in Microweber
Advisory: GHSA-vm37-j55j-8655
Aliases: CVE-2022-0557
Published: 2022-02-12T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Microweber is a content management system with drag and drop. Prior to version 1.2.11, Microweber is vulnerable to OS Command Injection.
Prototype Pollution in keyget
Advisory: GHSA-9fp7-4fjm-q3mf
Aliases: CVE-2021-23760
Published: 2022-02-01T00:51:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)
SQL Injection in Jeecg-boot
Advisory: GHSA-f9pg-g9xw-r5g2
Aliases: CVE-2022-22881
Published: 2022-02-17T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.
Cross-site Scripting in Beanstalk console
Advisory: GHSA-gj85-pvp5-mvf9
Aliases: CVE-2022-0501
Published: 2022-02-06T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Beanstalk console prior to version 1.7.12 is vulnerable to cross-site scripting.
Authentication bypass in Apache Hadoop
Advisory: GHSA-4fh8-pm7g-pmxq
Aliases: CVE-2018-11764
Published: 2022-02-10T20:28:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
Authentication bypass by capture-replay in github.com/cosmos/ethermint
Advisory: GHSA-93p5-8fqw-wjx3
Aliases: CVE-2021-25834
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. If the victim sends a very large nonce transaction, the attacker can replay the transaction through the application.
Path Traversal in Yarn
Advisory: GHSA-8mfc-v7wv-p62g
Aliases: CVE-2020-8131
Published: 2022-02-09T22:43:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Improper Authentication for Keycloak
Advisory: GHSA-j229-2h63-rvh9
Aliases: CVE-2020-1718
Published: 2022-02-09T00:59:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive
Advisory: GHSA-m6cj-93v6-cvr5
Aliases: CVE-2022-23596
Published: 2022-02-01T00:47:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. 

### Patches
The problem is partially patched in 7.4.1

### Workarounds
None

### References

https://github.com/junrar/junrar/issues/73

https://github.com/junrar/junrar/issues/81
Authentication Bypass in Apache Cassandra
Advisory: GHSA-2vxm-vp4c-fjfw
Aliases: CVE-2020-17516
Published: 2022-02-09T01:01:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
Prototype Pollution in dot-object
Advisory: GHSA-j9cf-pr2x-5273
Aliases: CVE-2019-10793
Published: 2022-02-09T22:33:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Uncontrolled Resource Consumption in github.com/google/fscrypt
Advisory: GHSA-mpq4-rjj8-fjph
Aliases: CVE-2022-25326
Published: 2022-02-26T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to fscrypt 0.3.3 or above and adjusting the permissions on existing fscrypt metadata directories where applicable.
Incorrect Default Permissions in Apache Tomcat
Advisory: GHSA-gc58-v8h3-x2gr
Aliases: CVE-2020-8022
Published: 2022-02-09T23:01:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
Path Traversal in SharpZipLib
Advisory: GHSA-m22m-h4rf-pwq3
Aliases: CVE-2021-32840
Published: 2022-02-01T16:22:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
SQL injection without credentials in ming-soft MCMS
Advisory: GHSA-h3hw-g4hm-7gr4
Aliases: CVE-2020-23262
Published: 2022-02-09T22:18:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.
Cross-site Scripting in microweber
Advisory: GHSA-38m9-3vg4-rwvp
Aliases: CVE-2022-0678
Published: 2022-02-20T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Missing permission check in Jenkins SCP publisher Plugin
Advisory: GHSA-vj3j-8m6x-mjq6
Aliases: CVE-2022-25199
Published: 2022-02-16T00:01:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SCP publisher Plugin 1.8 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Information exposure in xwiki-platform
Advisory: GHSA-35fg-hjcr-j65f
Aliases: CVE-2022-23619
Published: 2022-02-09T21:51:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
It's possible to guess if a user has an account on the wiki by using the "Forgot your password" form, even if the wiki is closed to guest users.

### Patches
The problem has been patched on XWiki 12.10.9, 13.4.1 and 13.6RC1.

### Workarounds
There's no easy workaround other than applying the upgrade.

### References

https://jira.xwiki.org/browse/XWIKI-18787

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security Mailing list](mailto:security@xwiki.org)
Infinite Loop in Django
Advisory: GHSA-6cw3-g6wv-c2xv
Aliases: CVE-2022-23833
Published: 2022-02-04T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Incorrect Authorization in WildFly Elytron
Advisory: GHSA-qgrq-cx4c-2rmm
Aliases: CVE-2020-1748
Published: 2022-02-15T01:39:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.
Buffer Overflow in galois_2p8
Advisory: GHSA-9p8q-j6q5-mjw8
Aliases: CVE-2022-24988
Published: 2022-02-15T00:02:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.
Integer overflow in TFLite
Advisory: GHSA-98p5-x8x4-c9m5
Aliases: CVE-2022-23559
Published: 2022-02-09T23:52:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact 
An attacker can craft a TFLite model that would cause an integer overflow [in embedding lookup operations](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/embedding_lookup_sparse.cc#L179-L189):

```cc
  int embedding_size = 1;
  int lookup_size = 1;
  for (int i = 0; i < lookup_rank - 1; i++, k++) {
    const int dim = dense_shape->data.i32[i];
    lookup_size *= dim;
    output_shape->data[k] = dim;
  }
  for (int i = 1; i < embedding_rank; i++, k++) {
    const int dim = SizeOfDimension(value, i);
    embedding_size *= dim;
    output_shape->data[k] = dim;
  } 
```

Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication.

In certain scenarios, this can then result in heap OOB read/write.
  
### Patches
We have patched the issue in GitHub commits [f19be71717c497723ba0cea0379e84f061a75e01](https://github.com/tensorflow/tensorflow/commit/f19be71717c497723ba0cea0379e84f061a75e01), [1de49725a5fc4e48f1a3b902ec3599ee99283043](https://github.com/tensorflow/tensorflow/commit/1de49725a5fc4e48f1a3b902ec3599ee99283043) and [a4e401da71458d253b05e41f28637b65baf64be4](https://github.com/tensorflow/tensorflow/commit/a4e401da71458d253b05e41f28637b65baf64be4).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Improper Control of Dynamically-Managed Code Resources in Crafter CMS Crafter Studio
Advisory: GHSA-wq3v-3grq-6f86
Aliases: CVE-2020-25802
Published: 2022-02-09T23:07:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.