aswin1906/github-advisory-2022 huggingface dataset:
Use of Uninitialized Resource in flumedb.
Advisory: GHSA-p46c-w9m3-7qr2
Aliases: CVE-2021-45684
Published: 2022-01-06T22:18:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. There are two of such cases (go_offset_log::read_entry() & offset_log::read_entry()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Use After Free in rusqlite
Advisory: GHSA-4qr3-m7ww-hh9g
Aliases: CVE-2021-45717
Published: 2022-01-06T22:01:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.
Server-Side Request Forgery in Apache Kylin
Advisory: GHSA-wrx7-qgmj-mf2q
Aliases: CVE-2021-27738
Published: 2022-01-08T00:43:04Z

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.
Infinite loop in Apache CFX
Advisory: GHSA-g23v-p5jq-jvh4
Aliases: CVE-2021-30468
Published: 2022-01-06T18:37:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. This issue affects Apache CXF versions prior to 3.4.4; Apache CXF versions prior to 3.3.11.
Cross-site Scripting in Apache Knox SSO
Advisory: GHSA-vv38-4xcj-q4rw
Aliases: CVE-2021-42357
Published: 2022-01-21T23:52:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.
Cross-site scripting in Apache NiFi
Advisory: GHSA-pqhq-xx62-2v2p
Aliases: CVE-2020-1933
Published: 2022-01-06T20:35:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.
SQL Injection in showdoc
Advisory: GHSA-9cq5-xgg4-x477
Aliases: CVE-2022-0362
Published: 2022-01-27T00:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Showdoc verions 2.10.2 and prior is vulnerable to SQL injection. A patch is available in the `master` branch of the repository.
UltraJSON vulnerable to Out-of-bounds Write
Advisory: GHSA-fh56-85cw-5pq6
Aliases: CVE-2021-45958
Published: 2022-01-21T23:27:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

UltraJSON (aka ujson) 1.34 through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).
Book page text, count, and author/title length is not limited in PocketMine-MP
Advisory: GHSA-p62j-hrxm-xcxf
Published: 2022-01-06T23:53:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
Players can fill book pages with as many characters as they like; the server does not check this.
In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs".

This causes a variety of problems:
- Oversized NBT on the wire costing excess bandwidth for server and client
- Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific)
- Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)

This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.

### Patches
The bug has been fixed in 3.26.5 and 4.0.5.

### Workarounds
Ban writable books, or use a plugin to cancel `PlayerEditBookEvent` to cancel the event if `strlen(text) > 1024 || mb_strlen(text) > 256`.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
calibre-web is vulnerable to Business Logic Errors
Advisory: GHSA-xp7p-3gx7-j6wx
Aliases: CVE-2021-4171
Published: 2022-01-21T23:44:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

calibre-web is vulnerable to Business Logic Errors
CSRF vulnerability and missing permission checks in Jenkins Publish Over SSH Plugin
Advisory: GHSA-884c-9wwh-9p6v
Aliases: CVE-2022-23111
Published: 2022-01-13T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
pimcore is vulnerable to SQL Injection
Advisory: GHSA-vj9x-w7ch-f46p
Aliases: CVE-2022-0258
Published: 2022-01-21T23:50:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
OS Command Injection in diskusage-ng
Advisory: GHSA-3269-x4pw-vffg
Aliases: CVE-2020-7631
Published: 2022-01-07T00:21:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.
Improper Certificate Validation in Apache IoTDB
Advisory: GHSA-wc6f-cjcp-cc33
Aliases: CVE-2020-1952
Published: 2022-01-06T19:45:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
Incorrect Comparison in cvxopt
Advisory: GHSA-8rh6-h94m-vj54
Aliases: CVE-2021-41500
Published: 2022-01-07T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.
Use After Free in lru
Advisory: GHSA-v362-2895-h9r2
Aliases: CVE-2021-45720
Published: 2022-01-07T22:37:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Lru crate has two functions for getting an iterator. Both iterators give references to key and value. Calling specific functions, like pop(), will remove and free the value, and but it's still possible to access the reference of value which is already dropped causing use after free.
Denial of service in sidekiq
Advisory: GHSA-jrfj-98qg-qjgv
Aliases: CVE-2022-23837
Published: 2022-01-27T14:42:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In `api.rb` in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
Umbraco ApplicationURL Overwrite
Advisory: GHSA-jrmq-rv9w-63rv
Aliases: CVE-2022-22690
Published: 2022-01-21T23:34:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the administrator invites users to the site. For Umbraco versions less than 9.2.0, if the Application URL is not specifically configured, the attacker can manipulate this value and store it persistently affecting all users for components where the "UmbracoApplicationUrl" is used. For example, the attacker is able to change the URL users receive when resetting their password so that it points to the attackers server, when the user follows this link the reset token can be intercepted by the attacker resulting in account takeover.
Insufficient user authorization in Moodle
Advisory: GHSA-93pj-4p65-qmr9
Aliases: CVE-2022-0334
Published: 2022-01-28T22:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
october/system arbitrary code execution
Advisory: GHSA-5hfj-r725-wpc4
Aliases: CVE-2021-32650
Published: 2022-01-14T21:08:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

Assuming an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.

### Patches

Issue has been patched in Build 473 and v1.1.6

### Workarounds

Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade.

### References

Credits to:
• Sushi Yushi

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Path traversal in Apache Karaf
Advisory: GHSA-544x-2jx9-4pfg
Aliases: CVE-2022-22932
Published: 2022-01-28T22:25:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326
Use of Uninitialized Resource in gfx-auxil
Advisory: GHSA-ff2r-xpwq-6whj
Aliases: CVE-2021-45689
Published: 2022-01-06T22:12:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Subdomain Takeover in Interactsh server
Advisory: GHSA-m36x-mgfh-8g78
Aliases: CVE-2023-36474
Published: 2022-01-27T15:15:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A domain configured with interactsh server was vulnerable to subdomain takeover for specfic subdomain, i.e `app`, Interactsh server before `< 1.0.0` used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default which intended to used for hosting interactsh [web client](https://github.com/projectdiscovery/interactsh-web) using GitHub pages. It turns out to be a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a cname entry pointing to GitHub pages, making them vulnerable to subdomain takeover.

This issue was initially reported to us as a subdomain takeover for one of our domains that runs interactsh server by **Melih** at `security@projectdiscovery.io`, and after conducting an internal investigation, we determined that it was an issue with the default config of interactsh server affecting all the server running self-hosted instance of interactsh, as a result - cname entry has been removed in the latest release.

#### Impact
This allows one to host / run arbitrary client side code (XSS) in a user's browser when browsing the vulnerable subdomain, for more details on the impact, please read this [detailed blogpost](https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/) from Detectify.
#### Patches
Update to [Interactsh server v1.0.0 ](https://github.com/projectdiscovery/interactsh/releases/tag/v1.0.0)with `go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest`

#### References
https://github.com/projectdiscovery/interactsh/issues/136

#### For more information
If you have any questions or comments about this advisory:
* Email us at [security@projectdiscovery.io](mailto:security@projectdiscovery.io)
CSRF vulnerability in Jenkins batch task Plugin
Advisory: GHSA-mh8g-8jwp-q6xw
Aliases: CVE-2022-23115
Published: 2022-01-13T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task.
Insufficient user authorization in Moodle
Advisory: GHSA-m434-m5pv-p35w
Aliases: CVE-2022-0333
Published: 2022-01-28T22:08:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Missing authentication in ShenYu
Advisory: GHSA-7rjp-fgwj-47rw
Aliases: CVE-2022-23945
Published: 2022-01-28T22:14:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Wechat-php-sdk is affected by a Cross Site Scripting vulnerability.
Advisory: GHSA-rwqq-p4p9-5wpq
Aliases: CVE-2021-43678
Published: 2022-01-07T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.
Incorrect Permission Assignment for Critical Resource in Jenkins Credentials Binding Plugin
Advisory: GHSA-gqm2-2gcx-p88w
Aliases: CVE-2022-20616
Published: 2022-01-13T00:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Credentials Binding Plugin prior to 1.27.1 and 1.24.1 does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read access to validate if a credential ID refers to a secret file credential and whether it’s a zip file.

Credentials Binding Plugin 1.27.1 and 1.24.1 performs permission checks when validating secret file credentials IDs.
Stored XSS vulnerability in Matrix Project Plugin
Advisory: GHSA-vqwg-4v6f-h6x5
Aliases: CVE-2022-20615
Published: 2022-01-13T00:01:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Matrix Project Plugin prior to 1.20 and 1.18.1 does not escape HTML metacharacters in node and label names, and label descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Matrix Project Plugin 1.20 and 1.18.1 escapes HTML metacharacters in node and label names, and label descriptions.
Improper Privilege Management in apache-airflow
Advisory: GHSA-4jh2-3c85-q67h
Aliases: CVE-2021-45230
Published: 2022-01-28T21:55:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
Out-of-Bounds read in stringstream
Advisory: GHSA-qpw2-xchm-655q
Published: 2022-01-06T20:31:01Z
Withdrawn: 2021-03-19T20:58:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

# WITHDRAWN

This is a duplicate of GHSA-mf6x-7mm4-x2g7
Path Traversal in rust-embed
Advisory: GHSA-xrg3-hmf3-rvgw
Aliases: CVE-2021-45712
Published: 2022-01-06T22:03:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

When running in debug mode and the debug-embed (off by default) feature is not enabled, the generated get method does not check that the input path is a child of the folder given.

This allows attackers to read arbitrary files in the file system if they have control over the filename given. The following code will print the contents of your /etc/passwd if adjusted with a correct number of ../s depending on where it is run from.
Resource Exhaustion Denial of Service in http-proxy-agent 
Advisory: GHSA-86wf-436m-h424
Aliases: CVE-2019-10196
Published: 2022-01-06T20:30:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
Cross-Site Request Forgery (CSRF) in livehelperchat
Advisory: GHSA-6jmh-9gqm-5xrx
Aliases: CVE-2022-0226
Published: 2022-01-26T20:21:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.
Cross-site Scripting when rendering error messages in laminas-form
Advisory: GHSA-jq4p-mq33-w375
Aliases: CVE-2022-23598
Published: 2022-01-28T23:08:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact

When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in vulnerable versions of laminas-form, the value was not being escaped for HTML contexts, which can potentially lead to a Reflected Cross-Site Scripting (XSS) attack.

### Patches

The following versions were issued to mitigate the vulnerability:

- 2.17.1
- 3.0.2
- 3.1.1

### Workarounds

At the top of a view script where you call the `formElementErrors()` view helper, place the following code:

```php
use Laminas\Form\ElementInterface;
use Laminas\View\PhpRenderer;

$escapeMessages = function (ElementInterface $formOrElement, PhpRenderer $renderer): void {
    $messages = $element->getMessages();
    if (! $messages) {
        return;
    }

    $escaped  = [];
    array_walk_recursive(
        $messages,
        static function (string $item) use (&$escaped, $renderer): void {
            $escaped[] = $renderer->escapeHtml($item);
        }
    };

    $element->setMessages($escaped);
};
```

Before calling `formElementErrors()` with a form, fieldset, or element, call the above closure as follows

```php
// Usage with a form
// $this is the view renderer
$escapeMessages($form, $this);

// Usage with a fieldset
// $this is the view renderer
$escapeMessages($fieldset, $this);

// Usage with a form element
// $this is the view renderer
$escapeMessages($element, $this);
```

### For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/laminas/laminas-form/issues/new)
* Email us at [security@getlaminas.org](mailto:security@getlaminas.org)
Infinite Loop in Apache James
Advisory: GHSA-fqgw-6qj5-8hmp
Aliases: CVE-2021-40111
Published: 2022-01-08T00:40:37Z

In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
Memory leak in micronaut-core
Advisory: GHSA-2457-2263-mm9f
Aliases: CVE-2022-21700
Published: 2022-01-21T23:19:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact

Sending an invalid Content Type header leads to memory leak in `DefaultArgumentConversionContext` as this type is erroneously used in static state.

### Patches

The problem is patched in Micronaut 3.2.7 and above.

### Workarounds

The default content type binder can be replaced in an existing Micronaut application to mitigate the issue:

```java
package example;

import java.util.List;
import io.micronaut.context.annotation.Replaces;
import io.micronaut.core.convert.ConversionService;
import io.micronaut.http.MediaType;
import io.micronaut.http.bind.DefaultRequestBinderRegistry;
import io.micronaut.http.bind.binders.RequestArgumentBinder;
import jakarta.inject.Singleton;

@Singleton
@Replaces(DefaultRequestBinderRegistry.class)
class FixedRequestBinderRegistry extends DefaultRequestBinderRegistry {

    public FixedRequestBinderRegistry(ConversionService conversionService,
                                      List<RequestArgumentBinder> binders) {
        super(conversionService, binders);
    }

    @Override
    protected void registerDefaultConverters(ConversionService<?> conversionService) {
        super.registerDefaultConverters(conversionService);
        conversionService.addConverter(CharSequence.class, MediaType.class, charSequence -> {
            try {
                return MediaType.of(charSequence);
            } catch (IllegalArgumentException e) {
                return null;
            }
        });
    }
}
```

### References

Commit that introduced the vulnerability https://github.com/micronaut-projects/micronaut-core/commit/b8ec32c311689667c69ae7d9f9c3b3a8abc96fe3

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Micronaut Core](https://github.com/micronaut-projects/micronaut-core/issues)
* Email us at [info@micronaut.io](mailto:info@micronaut.io)
Cross-site scripting in Apache Syncome EndUser
Advisory: GHSA-6qj8-c27w-rp33
Aliases: CVE-2019-17557
Published: 2022-01-06T19:38:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager
Advisory: GHSA-f8x6-m9f5-ffp8
Aliases: CVE-2021-23814
Published: 2022-01-06T21:08:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

This affects the package unisharp/laravel-filemanager from 0.0.0. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload window - Upload an image file, then capture the request - Edit the request contents with a malicious file (webshell) - Enter the path of file uploaded on URL - Remote Code Execution **Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).
Incorrect Default Permissions and Improper Access Control in snipe-it
Advisory: GHSA-w3v3-cxq5-9vr4
Aliases: CVE-2022-0179
Published: 2022-01-21T23:58:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions.
Sandbox Escape by math function in smarty
Advisory: GHSA-29gp-2c3m-3j6m
Aliases: CVE-2021-29454
Published: 2022-01-12T22:43:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

### Impact
Template authors could run arbitrary PHP code by crafting a malicious math string.
If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.

### Patches
Please upgrade to 4.0.2 or 3.1.42 or higher.

### References
See [documentation on Math function](https://www.smarty.net/docs/en/language.function.math.tpl).

### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Unchecked validity of Facing values in PlayerActionPacket
Advisory: GHSA-xh99-hw7h-wf63
Published: 2022-01-13T22:25:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
A remote attacker may crash a server by sending `PlayerActionPacket` with invalid facing values (e.g. negative), specifically with `START_BREAK` or `CRACK_BLOCK` actions, or with a `UseItemTransactionData` (typically in `InventoryTransactionPacket`).

### Patches
f126479c37ff00a717a828f5271cf8e821d12d6c

### Workarounds
Using a plugin, cancel `DataPacketReceiveEvent` if the packet is `PlayerActionPacket` and the facing is outside the range 0-5 when receiving START_BREAK or CRACK_BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Access key stored in plain text by Jenkins Metrics Plugin
Advisory: GHSA-gg9m-x3cg-69vh
Aliases: CVE-2022-20621
Published: 2022-01-13T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Metrics Plugin 4.0.2.8 and earlier stores access keys unencrypted in its global configuration file `jenkins.metrics.api.MetricsAccessKey.xml` on the Jenkins controller as part of its configuration.

This access key can be viewed by users with access to the Jenkins controller file system.

Metrics Plugin 4.0.2.8.1 stores access key encrypted once its configuration is saved again.

Additionally, the token value is only displayed once when it is generated.
Zalgo-like output that crashes the server
Advisory: GHSA-2w8g-m5j8-7m87
Published: 2022-01-12T21:45:59Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

[`colors`](https://npmjs.com/package/colors) package caused zalgo-like output (see https://github.com/soketi/soketi/issues/276, https://github.com/Marak/colors.js/issues/289), breaking the servers.

**Only NPM users that recently upgraded or installed the NPM package are affected.**

Docker users seem to not be affected as the dependencies were bundled at the time of the build, which were tested.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Latest patch. `0.26.1` to be exact at the time of writing.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You cannot get around this as it's related to dependencies.

### References
_Are there any links users can visit to find out more?_

- https://github.com/Marak/colors.js/issues/289

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issues board](https://github.com/soketi/soketi/issues)
* Email us at [alex@renoki.org](mailto:alex@renoki.org)
Insecure Java Deserialization in Apache Karaf
Advisory: GHSA-jh5g-9m4v-9vv9
Aliases: CVE-2021-41766
Published: 2022-01-28T22:24:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).
Cross-site Scripting in Pimcore
Advisory: GHSA-f7q6-xxph-mfm8
Aliases: CVE-2022-0251
Published: 2022-01-27T00:01:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore prior to version 10.2.10 contains a cross-site scripting vulnerability.
Use After Free in tremor-script
Advisory: GHSA-q2x5-6q7q-r872
Aliases: CVE-2021-45701
Published: 2022-01-06T22:10:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.
Cross-site Scripting in pimcore
Advisory: GHSA-4f5x-q4jc-xfcf
Aliases: CVE-2022-0262
Published: 2022-01-21T23:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore.
SQL Injection in Apache Kylin
Advisory: GHSA-5429-pjww-7675
Aliases: CVE-2021-36774
Published: 2022-01-08T00:43:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Apache Kylin allows users to read data from other database systems using JDBC. The MySQL JDBC driver supports certain properties, which, if left unmitigated, can allow an attacker to execute arbitrary code from a hacker-controlled malicious MySQL server within Kylin server processes. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions.
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Advisory: GHSA-m6w8-fq7v-ph4m
Published: 2022-01-13T16:09:36Z

### Impact

The `GovernorCompatibilityBravo` module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function `foo(uint256)` is created as `propose([target], [0], ["foo(uint256)"], ["0x00..01"])`. If the function selector is provided as part of the encoded proposal data the issue is not present, e.g. the same proposal is created as `propose([target], [0], ["0x2fbebd3800..01"])`, where `2fbebd38` is the function selector.

We've assessed the instances of this contract found on chain, and did not find any occurrence of this bug in the past. Proposal creation through Tally or OpenZeppelin Defender is not affected. The core `Governor` contract on its own is not affected.

### Patches

A fix is included in version v4.4.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Do not create proposals using explicit function signatures. Instead, use the `propose` function without the `signatures` argument, and create the proposal using the fully ABI-encoded function call including the function selector in the `calldatas` argument as explained above.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/issues/3099

### Credits

This issue was identified and reported by @GeraldHost.

### For more information

If you have any questions, comments, or need assistance regarding this advisory, email us at security@openzeppelin.com.

To submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).
Uncontrolled Resource Consumption in simple_asn1
Advisory: GHSA-g4h2-4wvh-grc5
Aliases: CVE-2021-45711
Published: 2022-01-06T22:05:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied by a remote attacker, has a second character greater than 0x7f.
Apache NiFi Insertion of Sensitive Information into Log File
Advisory: GHSA-w4fj-ccr6-7pcp
Aliases: CVE-2020-1928
Published: 2022-01-06T20:40:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
Deserialization of Untrusted Data in Dubbo
Advisory: GHSA-vp5x-3v8r-qprw
Aliases: CVE-2021-43297
Published: 2022-01-12T22:51:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Denial of service in bingrep
Advisory: GHSA-gm68-g349-gxgg
Aliases: CVE-2021-39480
Published: 2022-01-28T22:35:16Z

Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).
Missing Authorization in DayByDay CRM
Advisory: GHSA-44gv-fgcj-w546
Aliases: CVE-2022-22107
Published: 2022-01-08T00:31:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Use After Free in rusqlite
Advisory: GHSA-92cx-4xm7-jr9m
Aliases: CVE-2021-45713
Published: 2022-01-06T22:02:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.
Server Side Twig Template Injection
Advisory: GHSA-mrq4-7ch7-2465
Aliases: CVE-2022-21686
Published: 2022-01-27T18:32:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
Prototype Pollution in realms-shim
Advisory: GHSA-pwm7-qr6j-3vjg
Aliases: CVE-2021-23594
Published: 2022-01-12T22:56:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
Cross-site Scripting in Crater Invoice
Advisory: GHSA-6vfw-74wr-3chh
Aliases: CVE-2022-0372
Published: 2022-01-28T00:03:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability.
Cross-site Scripting in Apache Pluto
Advisory: GHSA-x588-g38j-f672
Aliases: CVE-2021-36737
Published: 2022-01-08T00:46:20Z

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
Improper Initialization in Pillow
Advisory: GHSA-pw3c-h7wp-cvhx
Aliases: CVE-2022-22815
Published: 2022-01-12T20:07:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Pillow is the friendly PIL (Python Imaging Library) fork. `path_getbbox` in `path.c` in Pillow before 9.0.0 improperly initializes `ImagePath.Path`.
Classic Buffer Overflow in pyo
Advisory: GHSA-5f5c-687x-g5qm
Aliases: CVE-2021-41499
Published: 2022-01-07T00:10:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Buffer Overflow Vulnerability exists in ajaxsoundstudio.com in Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by deliberately passing on an overlong audio file name.
Cross-site Scripting in microweber
Advisory: GHSA-3j58-p785-f27x
Aliases: CVE-2022-0378
Published: 2022-01-28T22:15:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

There is a reflected cross sitem scripting attack in microweber via url parameters.
Use After Free in rusqlite
Advisory: GHSA-cm8g-544f-p9x9
Aliases: CVE-2021-45716
Published: 2022-01-06T22:03:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.
Prototype Pollution in node-forge debug API.
Advisory: GHSA-5rrq-pxf6-6jx5
Published: 2022-01-08T00:22:42Z

### Impact
The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised.  It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

### Patches
The `forge.debug` API and related functions were removed in 1.0.0.

### Workarounds
Don't use the `forge.debug` API directly or indirectly with untrusted input.

### References
- https://www.huntr.dev/bounties/1-npm-node-forge/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge).
* Email us at support@digitalbazaar.com.
Use of Uninitialized Resource in acc_reader.
Advisory: GHSA-p4cr-64x4-f92f
Aliases: CVE-2020-36514
Published: 2022-01-06T22:17:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.
Cross-Site Request Forgery in Jenkins Mailer Plugin
Advisory: GHSA-85rq-hp8x-ghjq
Aliases: CVE-2022-20613
Published: 2022-01-13T00:01:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins Mailer Plugin prior to 408.vd726a_1130320 and 1.34.2 does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Mailer Plugin 408.vd726a_1130320 and 1.34.2 require POST requests and Overall/Administer permission for the affected form validation method.
Prototype Pollution in extend2
Advisory: GHSA-gjm5-83cw-p3p2
Aliases: CVE-2021-23568
Published: 2022-01-12T22:59:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
Exposure of Sensitive Information to an Unauthorized Actor in Apache NiFi
Advisory: GHSA-rq96-qhc5-vm4r
Aliases: CVE-2021-44145
Published: 2022-01-05T17:33:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.
vditor Vulnerable to Cross-site Scripting in SVG events
Advisory: GHSA-cxm3-v4mv-6mh8
Aliases: CVE-2021-4103
Published: 2022-01-28T22:04:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vditor does not filter user input in SVG events, leading to XSS 

### PoC

```html
</a>
<svg><animate onbegin=alert(11) attributeName=x dur=1s>
```
OS command execution vulnerability in Docker Commons Plugin
Advisory: GHSA-jpxj-vgq5-prjc
Aliases: CVE-2022-20617
Published: 2022-01-13T00:01:03Z

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository.
Insertion of Sensitive Information into Log File in Apache NiFi
Advisory: GHSA-7q8g-gpfp-v8gx
Aliases: CVE-2020-1942
Published: 2022-01-06T20:40:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.
Missing Authorization in DayByDay CRM
Advisory: GHSA-w6rp-4vj7-v2m8
Aliases: CVE-2022-22111
Published: 2022-01-08T00:31:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
Command Injection in Apache Kylin
Advisory: GHSA-hw3m-8h25-8frw
Aliases: CVE-2021-45456
Published: 2022-01-08T00:42:59Z

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
XSS vulnerability on email template preview page
Advisory: GHSA-qv7g-j98v-8pp7
Aliases: CVE-2021-41236
Published: 2022-01-06T18:34:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

### Summary

Email template preview is vulnerable to XSS payload added to email template content. The attacker should have permission to create or edit an email template. For successful payload, execution attacked user should preview a vulnerable email template.

### Workarounds

There are no workarounds that address this vulnerability.
Regular Expression Denial of Service in postcss
Advisory: GHSA-566m-qj78-rww5
Aliases: CVE-2021-23382
Published: 2022-01-07T00:21:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

The package postcss versions before 7.0.36 or between 8.0.0 and 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern 
```regex
\/\*\s* sourceMappingURL=(.*)
```

### PoC
```js
var postcss = require("postcss")
function build_attack(n) {
    var ret = "a{}"
    for (var i = 0; i < n; i++) {
        ret += "/*# sourceMappingURL="
    }
    return ret + "!";
}
```
```js
postcss.parse('a{}/*# sourceMappingURL=a.css.map */') for (var i = 1; i <= 500000; i++) {
    if (i % 1000 == 0) {
        var time = Date.now();
        var attack_str = build_attack(i) try {
            postcss.parse(attack_str) var time_cost = Date.now() - time;
            console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms");
        } catch (e) {
            var time_cost = Date.now() - time;
            console.log("attack_str.length: " + attack_str.length + ": " + time_cost + " ms");
        }
    }
}
```
Window may read from uninitialized memory locations in rdiff
Advisory: GHSA-2rxc-8f9w-fjq8
Aliases: CVE-2021-45694
Published: 2022-01-06T22:14:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the rdiff crate through version 0.1.2 for Rust. Window may read from uninitialized memory locations.
OS Command Injection in Laravel Framework
Advisory: GHSA-w2pm-r78h-4m7v
Aliases: CVE-2020-19316
Published: 2022-01-06T23:13:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.
Use of Uninitialized Resource in binjs_io.
Advisory: GHSA-cw4j-cf6c-mmfv
Aliases: CVE-2021-45683
Published: 2022-01-06T22:14:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman
Advisory: GHSA-3cf2-x423-x582
Aliases: CVE-2021-4024
Published: 2022-01-06T21:12:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is open on the host's firewall, an attacker can potentially use the `gvproxy` API to forward ports on the host to ports in the VM, making private services on the VM accessible to the network. This issue could be also used to interrupt the host's services by forwarding all ports to the VM.
Cross-Site Request Forgery in com.softwaremill.akka-http-session:core_2.12
Advisory: GHSA-4jf5-jggp-g56j
Aliases: CVE-2020-28452
Published: 2022-01-06T20:23:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value, as the check in randomTokenCsrfProtection only checks that the two values are equal and non-empty.
Cross-Site Request Forgery in yetiforce
Advisory: GHSA-7g7r-gr46-q4p5
Aliases: CVE-2022-0269
Published: 2022-01-27T16:21:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.