aswin1906/github-advisory-2022 huggingface dataset:
Incorrect reliance on Trait memory layout in mopa
Advisory: GHSA-2gxj-qrp2-53jv
Aliases: CVE-2021-45695
Published: 2022-01-06T22:11:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The mopa crate redefines the deprecated TraitObject struct from core::raw. This is done to then transmute a reference to a trait object (&dyn Trait for any trait Trait) into this struct and retrieve the data field for the purpose of downcasting. This is used to implement downcast_ref_unchecked(), in terms of which downcast_ref() is also implemented. Same goes for mutable reference downcasting and Box downcasting.

The Rust compiler explicitly reserves the right to change the memory layout of &dyn Trait for any trait Trait. The worst case scenario is that it swaps data and vtable, making an executable location breach and compromisation of ASLR possible, since reads from data would read vtable instead. Likewise, arbitrary code execution is also theoretically possible if reads of vtable generated by the compiler read data instead.
Arbitrary code execution in H2 Console
Advisory: GHSA-45hx-wfhj-473x
Aliases: CVE-2022-23221
Published: 2022-01-21T23:07:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.
columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())
Advisory: GHSA-9mp7-45qh-r8j8
Aliases: CVE-2021-45685
Published: 2022-01-06T22:13:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (ColumnarReadExt::read_typed_vec()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Inadequate Encryption Strength in Apache NiFi
Advisory: GHSA-rfmp-jvr7-hx78
Aliases: CVE-2020-9491
Published: 2022-01-06T20:41:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.
Exposure of sensitive information in follow-redirects
Advisory: GHSA-74fj-2j2h-c42q
Aliases: CVE-2022-0155
Published: 2022-01-12T22:46:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Advisory: GHSA-75vw-3m5v-fprh
Aliases: CVE-2022-0239
Published: 2022-01-21T23:43:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Regular Expression Denial of Service (ReDoS) in lodash
Advisory: GHSA-29mw-wpgm-hmr9
Aliases: CVE-2020-28500
Published: 2022-01-06T20:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions. 

Steps to reproduce (provided by reporter Liyuan Chen):
```js
var lo = require('lodash');

function build_blank(n) {
    var ret = "1"
    for (var i = 0; i < n; i++) {
        ret += " "
    }
    return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s) var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0) var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1) var time2 = Date.now();
lo.trimEnd(s) var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2)
```
Invalid URL generation in bitlyshortener
Advisory: GHSA-rcrv-228c-gprj
Published: 2022-01-21T18:39:40Z

### Impact
Due to a sudden upstream breaking change by Bitly, versions of `bitlyshortener` <0.6.0 generate invalid short URLs. All users are affected and must update immediately.

### Patches
Upgrading `bitlyshortener` to 0.6.0 or newer will prevent the generation such invalid short URLs.

### Workarounds
A workaround is to replace "https://j.mp/" in each generated short URL with "https://bit.ly/".

### References
* [Release notes](https://github.com/impredicative/bitlyshortener/releases)
Denial of Service in Apache James
Advisory: GHSA-r58x-wjg8-63m9
Aliases: CVE-2021-40110
Published: 2022-01-08T00:40:30Z

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.
Out-of-bounds Write in nix
Advisory: GHSA-76w9-p8mg-j927
Aliases: CVE-2021-45707
Published: 2022-01-06T22:07:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

On certain platforms, if a user has more than 16 groups, the nix::unistd::getgrouplist function will call the libc getgrouplist function with a length parameter greater than the size of the buffer it provides, resulting in an out-of-bounds write and memory corruption.

The libc getgrouplist function takes an in/out parameter ngroups specifying the size of the group buffer. When the buffer is too small to hold all of the requested user's group memberships, some libc implementations, including glibc and Solaris libc, will modify ngroups to indicate the actual number of groups for the user, in addition to returning an error. The version of nix::unistd::getgrouplist in nix 0.16.0 and up will resize the buffer to twice its size, but will not read or modify the ngroups variable. Thus, if the user has more than twice as many groups as the initial buffer size of 8, the next call to getgrouplist will then write past the end of the buffer.

The issue would require editing /etc/groups to exploit, which is usually only editable by the root user.
Umbraco Persistent Password Reset Poison
Advisory: GHSA-r8pr-83cc-ccv7
Aliases: CVE-2022-22691
Published: 2022-01-21T23:34:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset token if/when the link is followed. A related vulnerability (CVE-2022-22690) could allow this flaw to become persistent so that all password reset URLs are affected persistently following a successful attack. See the AppCheck advisory for further information and associated caveats.
Code injection in ShenYu
Advisory: GHSA-gh38-x2wm-xmc8
Aliases: CVE-2021-45029
Published: 2022-01-28T22:13:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Cross-site Scripting in DayByDay CRM
Advisory: GHSA-jr37-66pj-36v7
Aliases: CVE-2022-22109
Published: 2022-01-08T00:32:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
Cross site scripting in dolibarr
Advisory: GHSA-g5jm-xhwm-9xp9
Aliases: CVE-2022-22293
Published: 2022-01-03T00:00:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.
NumPy Buffer Overflow (Disputed)
Advisory: GHSA-6p56-wp2h-9hxr
Aliases: CVE-2021-33430
Published: 2022-01-07T00:09:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.

NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.
Comment reply notifications sent to incorrect users
Advisory: GHSA-xqxm-2rpm-3889
Aliases: CVE-2022-21683
Published: 2022-01-21T23:43:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

### Impact
When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not had editing access to, as long as they have left a comment or reply somewhere on the site.

### Patches
A patched version has been released as Wagtail 2.15.2 (for the current LTS), which restores the intended behaviour - to send notifications for new replies to the participants in the active thread only (editing permissions are not considered).

### Workarounds
New comments can be disabled by setting `WAGTAILADMIN_COMMENTS_ENABLED = False` in the Django settings file.

### Acknowledgements

Many thanks to Ihor Marhitych for identifying this issue.

### For more information
If you have any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at security@wagtail.io (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)
Infinite Loop in Apache Xerces Java
Advisory: GHSA-h65f-jvqw-m9fj
Aliases: CVE-2022-23437
Published: 2022-01-27T16:13:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
Sandbox bypass in Latte templates
Advisory: GHSA-36m2-8rhx-f36j
Aliases: CVE-2022-21648
Published: 2022-01-06T23:17:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

### Impact
The problem affects users who use the sandbox in Latte and templates from untrusted sources.

### Patches
Sandbox first appeared in Latte 2.8.0. The issue is fixed in the versions 2.8.8, 2.9.6 and 2.10.8. 

### References
The issues were discovered by
- JinYiTong (https://github.com/JinYiTong)
- 赵钰迪 <20212010122@fudan.edu.cn>
Use After Free in rusqlite
Advisory: GHSA-f6f2-3w33-54r9
Aliases: CVE-2021-45714
Published: 2022-01-06T22:02:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_aggregate_function has a use-after-free.
Missing authentication in ShenYu
Advisory: GHSA-6v39-p2xq-g5c3
Aliases: CVE-2022-23944
Published: 2022-01-28T22:13:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Uncontrolled Resource Consumption in parse-link-header
Advisory: GHSA-q674-xm3x-2926
Aliases: CVE-2021-23490
Published: 2022-01-06T21:37:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
IBX-1392: Image filenames sanitization
Advisory: GHSA-44m4-9cjp-j587
Published: 2022-01-21T23:24:14Z

ezsystems/ezpublish-kernel versions 7.5.* before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files.
Improper Access Control in snipe-it
Advisory: GHSA-xc47-3rch-cv57
Aliases: CVE-2022-0178
Published: 2022-01-26T20:24:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Users with no system permissions are able to see and create personal access tokens
Sandbox Bypass in Apache Velocity Engine
Advisory: GHSA-59j4-wjwp-mw9m
Aliases: CVE-2020-13936
Published: 2022-01-06T20:32:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Code Injection in microweber
Advisory: GHSA-p5hj-xxfr-pwc3
Aliases: CVE-2022-0282
Published: 2022-01-21T18:02:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Code Injection in Packagist microweber/microweber prior to 1.2.11.
AjaxNetProfessional deserializes arbitrary JavaScript objects
Advisory: GHSA-5q7q-qqw2-hjq7
Aliases: CVE-2021-43853
Published: 2022-01-06T18:32:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

### Overview

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects.

### Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

XSS effects vary in range from petty nuisance to significant security risk, depending on the sensitivity of the data handled by the vulnerable site and the nature of any security mitigation implemented by the site's owner network.

### Releases

Releases before version 21.12.22.1 are affected. Please be careful to download any binary DLL from other web sites, especially we found NuGet packages not owned by us that contain vulnerable versions.

### Workarounds

A workaround exists that replaces one of the core JavaScript files embedded in the library. Using a XML configuration allows to replace the default JavaScript code to be replaced with the version on GitHub.

```xml
<configuration>
	<configSections>
		<sectionGroup name="ajaxNet">
			<section name="ajaxSettings" type="AjaxPro.AjaxSettingsSectionHandler,AjaxPro.2" requirePermission="false" restartOnExternalChanges="true"/>
		</sectionGroup>
	</configSections>
	<ajaxNet>
		<ajaxSettings>
			<coreScript>~/ajaxpro-core-fixed.js</coreScript>
		</ajaxSettings>
	</ajaxNet>
</configuration>
```

Copy the file core.js from the main project folder to your web server root folder and rename that ajaxpro-core-fixed.js.

Clients need to refresh the web page to download the changed JavaScript code.

### References

Commit fixing the issue: c89e39b9679fcb8ab6644fe21cc7e652cb615e2b

Note: the official Ajax.NET Professional (AjaxPro) NuGet package is available here: https://www.nuget.org/packages/AjaxNetProfessional/

### For more information

If you have any questions or comments about this advisory:
* Open an issue on this GitHub repository
Arbitrary PHP code execution in Drupal
Advisory: GHSA-8cw5-rv98-5c46
Aliases: CVE-2019-6339
Published: 2022-01-06T22:30:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6, and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in
PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.
Uncapped length of skin data fields submitted by players
Advisory: GHSA-c6fg-99pr-25m9
Published: 2022-01-06T23:53:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Some skin data fields (e.g. skinID, geometryName) are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave.

This is problematic due to the 32767 byte limit on `TAG_String`s. If any of these fields exceeds 32767 bytes, an exception will be thrown during data saving, which will cause the server to crash.

Other fields (such as skinGeometryData) are also uncapped, but those have a much larger 2 GB length limit, so this is not a concern for those, particularly considering the decompressed packet size limit of 2 MB.

### Patches
PM3: 958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb
PM4: 6492cac5c10f9fa8443ceddd2191a7b65b73f601

### Workarounds
A plugin may check player skins during `PlayerLoginEvent` and `PlayerSkinChangeEvent` and ensure that the offending fields are not larger than 32767 bytes.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Prototype Pollution in cached-path-relative
Advisory: GHSA-wg6g-ppvx-927h
Aliases: CVE-2021-23518
Published: 2022-01-27T14:27:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

The package cached-path-relative before 1.1.0 is vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
Username spoofing in OnionShare
Advisory: GHSA-68vr-8f46-vc9f
Aliases: CVE-2022-21696
Published: 2022-01-21T23:20:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-005
- Vulnerability type: Improper Input Sanitization
- Threat level: Low

## Description:

It is possible to change the username to that of another chat participant with an additional space character at the end of the name string.

## Technical description:

Assumed users in Chat:

- Alice
- Bob
- Mallory

1. Mallory renames to `Alice `.
2. Mallory sends message as `Alice `.
3. Alice and Bob receive a message from Mallory disguised as `Alice `, which is hard to distinguish from the `Alice`
in the web interface.

![otf-005-a](https://user-images.githubusercontent.com/156128/140666112-8febd4d8-6761-41aa-955c-48be76f3c657.png)
![otf-005-b](https://user-images.githubusercontent.com/156128/140666113-1713ddf7-cef6-4dac-b718-9af1dc4ffdcd.png)

Other (invisible) whitespace characters were found to be working as well.

## Impact:

An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.

## Recommendation:

- Remove non-visible characters from the username
Cross-Site Request Forgery in Moodle
Advisory: GHSA-9328-7pcw-vw69
Aliases: CVE-2020-1692
Published: 2022-01-06T18:34:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.
Cross-site Scripting in Netgen Tags Bundle
Advisory: GHSA-xvvv-wj7j-r9jm
Aliases: CVE-2021-45895
Published: 2022-01-06T22:04:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.
Use of Uninitialized Resource in messagepack-rs.
Advisory: GHSA-hr52-f9vp-582c
Aliases: CVE-2021-45692
Published: 2022-01-06T22:12:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.
Cross-site Scripting in HTML2PDF
Advisory: GHSA-6m93-343m-3jrc
Aliases: CVE-2021-45394
Published: 2022-01-21T23:29:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
Incorrect hash in sha2
Advisory: GHSA-fc7x-2cmc-8j2g
Aliases: CVE-2021-45696
Published: 2022-01-06T22:10:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The v0.9.7 release of the sha2 crate introduced a new AVX2-accelerated backend which was automatically enabled for all x86/x86_64 CPUs where AVX2 support was autodetected at runtime.

This backend was buggy and would miscompute results for long messages (i.e. messages spanning multiple SHA blocks).

The crate has since been yanked, but any users who upgraded to v0.9.7 should immediately upgrade to v0.9.8 and recompute any hashes which were previously computed by v0.9.7.
Deserialization of Untrusted Data in Codeigniter4
Advisory: GHSA-w6jr-wj64-mc9x
Aliases: CVE-2022-21647
Published: 2022-01-06T22:52:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

### Impact
Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4.
Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, 
and possibly execute existing PHP code on the server.
We are aware of a working exploit, which can lead to SQL injection.

### Patches
Upgrade to v4.1.6 or later.

### Workarounds
Do not use:
- `old()` and form_helper
- `RedirectResponse::withInput()` and `redirect()->withInput()`

### References
- [PHP Object Injection | OWASP](https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
pytorch-lightning is vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-2vj5-px25-gjrp
Aliases: CVE-2021-4118
Published: 2022-01-06T23:58:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

pytorch-lightning is vulnerable to Deserialization of Untrusted Data.
Access to restricted PHP code by dynamic static class access in smarty
Advisory: GHSA-4h9c-v5vg-5m6m
Aliases: CVE-2021-21408
Published: 2022-01-12T22:43:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
Template authors could run restricted static php methods.

### Patches
Please upgrade to 3.1.40 or higher.

### References
See the [documentation on Smarty security features](https://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security) on the static_classes access filter.

### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Cross-site Scripting in livehelperchat
Advisory: GHSA-w4hp-pcp8-qhf3
Aliases: CVE-2022-0387
Published: 2022-01-28T23:06:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Stored XSS is found in Settings>Live help configuration>Departments->Departments groups->edit When a user creates a new webhook under the NAME field and puts a payload {{constructor.constructor('alert(1)')()}}, the input gets stored, at user edit groupname , the payload gets executed.
Out-of-bounds Write in vec-const
Advisory: GHSA-x76r-966h-5qv9
Aliases: CVE-2021-45680
Published: 2022-01-06T22:15:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the vec-const crate before 2.0.0 for Rust. It tries to construct a Vec from a pointer to a const slice, leading to memory corruption.
Inefficient Regular Expression Complexity in marked
Advisory: GHSA-rrrm-qjm4-v8hf
Aliases: CVE-2022-21680
Published: 2022-01-14T21:04:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `block.def` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from "marked";

marked.parse(`[x]:${' '.repeat(1500)}x ${' '.repeat(1500)} x`);
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)
Out-of-bounds Write in derive-com-impl
Advisory: GHSA-w4cc-pc2h-whcj
Aliases: CVE-2021-45681
Published: 2022-01-06T22:16:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the derive-com-impl crate before 0.1.2 for Rust. An invalid reference (and memory corruption) can occur because AddRef might not be called before returning a pointer.
archivy is vulnerable to Cross-Site Request Forgery (CSRF)
Advisory: GHSA-9236-8w7q-rmrv
Aliases: CVE-2021-4162
Published: 2022-01-06T21:59:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

archivy is vulnerable to Cross-Site Request Forgery (CSRF). There is [a fix](https://github.com/archivy/archivy/commit/796c3ae318eea183fc88c87ec5a27355b0f6a99d) available in the master branch.
Weak Password Requirements in Daybyday CRM
Advisory: GHSA-96v6-hrwg-p378
Aliases: CVE-2022-22110
Published: 2022-01-08T00:31:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
Integer overflow in solana_rbpf
Advisory: GHSA-xwqr-xmgg-j69q
Aliases: CVE-2021-46102
Published: 2022-01-28T22:59:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via `addr = (sym.st_value + refd_pa) as u64`
Password stored in plain text by Jenkins Publish Over SSH Plugin
Advisory: GHSA-r3rr-wph6-9638
Aliases: CVE-2022-23114
Published: 2022-01-13T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Cross-site Scripting in epubjs
Advisory: GHSA-c6rp-xvqv-mwmf
Aliases: CVE-2021-33040
Published: 2022-01-21T23:52:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
Pac4j token validation bypass if OpenID Connect provider supports none algorithm
Advisory: GHSA-xhw6-hjc9-679m
Aliases: CVE-2021-44878
Published: 2022-01-08T00:36:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

If an OpenID Connect provider supports the “none” algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the “idtoken” response type which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.
Cross-site Scripting in microweber
Advisory: GHSA-m8rp-q82r-c5mf
Aliases: CVE-2022-0278
Published: 2022-01-21T18:06:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin
Advisory: GHSA-w4jv-6rg4-pr4m
Aliases: CVE-2022-20619
Published: 2022-01-13T00:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Bitbucket Branch Source Plugin 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 requires POST requests for the affected HTTP endpoint.
Hash collision in typelevel jawn
Advisory: GHSA-vc89-hccf-rq55
Aliases: CVE-2022-21653
Published: 2022-01-06T23:48:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext()` are vulnerable to a hash collision attack.  Most applications do not implement these traits directly, but inherit from a library:

Affected implementations include:
* `org.http4s` :: `http4s-play-json`
* `org.typelevel :: jawn-ast` (< 0.8.0)
* `org.typelevel :: jawn-play` (discontinued)
* `org.typelevel :: jawn-rojoma` (discontinued)
* `org.typelevel :: jawn-spray` (discontinued)

Unaffected implementations include:
* `io.argonaut :: argonaut-jawn`
* `io.circe :: circe-parser`
* `org.typelevel :: jawn-ast` (>= 0.8.0)
* `org.typelevel :: jawn-json4s` (discontinued)
* `org.typelevel :: jawn-argonaut` (discontinued)

### Patches

`jawn-parser-1.3.2` fixes the issue.

### Workarounds

Override `objectContext()` to use a collision-safe collection.  See [the patch](https://github.com/typelevel/jawn/pull/390/files) for an example in both `SimpleFacade` and `MutableFacade`.

### References

* https://github.com/typelevel/jawn/pull/390

### Credits

* @kag0, for the report and the patch

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [typelevel/jawn](https://github.com/typelevel/jawn)
* E-mail a maintainer:
  * [@rossabaker](mailto:ross@rossabaker.com)
Cross site scripting in three.js
Advisory: GHSA-7vvq-7r29-5vg3
Aliases: CVE-2022-0177
Published: 2022-01-27T16:00:48Z
Withdrawn: 2022-01-28T18:32:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

# CVE has been withdrawn

Versions of three.js prior to 0.137.0 load untrusted iframes and allow for attackers to inject arbitrary javascript into a users browser.
URL parsing in node-forge could lead to undesired behavior.
Advisory: GHSA-gf8q-jrpm-jvxq
Published: 2022-01-08T00:22:02Z

### Impact
The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.

### Patches
`forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.

### Workarounds
Ensure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input.

### References
- https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at support@digitalbazaar.com
Apache Solr Improper Input Validation and Path Traversal
Advisory: GHSA-pccr-q7v9-5f27
Aliases: CVE-2021-44548
Published: 2022-01-06T21:32:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.
Out-of-bounds Read in Pillow
Advisory: GHSA-xrcv-f9gm-v42c
Aliases: CVE-2022-22816
Published: 2022-01-12T20:07:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
XSS in svg2png (NPM package)
Advisory: GHSA-mpp5-2x55-49xw
Aliases: CVE-2020-11887
Published: 2022-01-06T19:45:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
Cross-Site Request Forgery (CSRF) in livehelperchat
Advisory: GHSA-8m28-w6xg-35hw
Aliases: CVE-2022-0231
Published: 2022-01-26T20:22:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Denial of service in CBOR library
Advisory: GHSA-6r92-cgxc-r5fg
Published: 2022-01-21T23:35:35Z

### Impact
Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.

Affected versions _include_ versions 4.0.0 through 4.5.0.

This vulnerability was privately reported to me.

### Patches
This issue has been fixed in version 4.5.1.  Users should use the latest version of this library. (The latest version is not necessarily 4.5.1.  Check the [NuGet page](https://www.nuget.org/packages/PeterO.Cbor) to see the latest version's version number.)

### Workarounds

Again, users should use the latest version of this library.

In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if&mdash;

- it begins with a byte other than 0x80 through 0xDF, or
- it does not contain a byte in the range 0xa0 through 0xBF.

Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR).
Cross-site Scripting in livehelperchat
Advisory: GHSA-59qh-g7m4-j9m9
Aliases: CVE-2022-0374
Published: 2022-01-28T23:06:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Stored XSS attacks exist in new the form creation flow. New forms can be given a title which will render javascript.
Unbounded memory usage on exposed HTTP/2 (non-gRPC) endpoints
Advisory: GHSA-m7vp-hqwv-7m5x
Published: 2022-01-12T22:33:04Z

### Impact
The net/http Go package has a reported vulnerability tracked under CVE-2021-44716 which allows attacker controlled HTTP/2 requests to trigger unbounded memory usage in HTTP/2 endpoints. gRPC endpoints are not vulnerable as they rely on their own HTTP/2 implementation instead of the net/http package. HTTP/2 endpoints consuming the net/http package within SPIRE server and agent (or other components in this repository) that are _on by default_ include the following:
- OIDC Discovery Provider
- K8s Workload Registrar in webhook mode

The following endpoints are vulnerable _when enabled_:
- SPIRE server bundle endpoint (i.e. Federation API)

The following endpoints are _NOT_ vulnerable, since HTTP/2 support in go is not enabled on non-TLS protected endpoints:
- SPIRE server/agent metrics endpoint when configured for Prometheus
- SPIRE server/agent health endpoints
- SPIRE server/agent profiling endpoints

### Patches
SPIRE 1.0.3 and 1.1.3 have been released with an upgraded Go toolchain which patches the vulnerability

### Workarounds
The vulnerability can be worked around entirely by including the `http2server=0` value in the `GODEBUG` environment variable (see https://github.com/golang/go/issues/50058). This turns off HTTP/2 support on all non-gRPC endpoints. They will still function with HTTP/1.1.

The risk associated with this vulnerability can be somewhat mitigated by limiting the exposure of the endpoints in question. If necessary, vulnerable components or endpoints that are optionally configured can be disabled temporarily.

### References
- https://github.com/golang/go/issues/50058
- https://go-review.googlesource.com/c/go/+/370574/
- https://nvd.nist.gov/vuln/detail/CVE-2021-44716
Potential exposure of tokens to an Unauthorized Actor
Advisory: GHSA-7w54-gp8x-f33m
Aliases: CVE-2022-21671
Published: 2022-01-12T22:44:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact

When using this library as a way to programmatically communicate with Replit in a standalone fashion, if there are multiple failed attempts to contact Replit through a WebSocket, the library will attempt to communicate using a fallback poll-based proxy. The URL of the proxy has changed, so any communication done to the previous URL could potentially reach a server that is outside of Replit's control and the token used to connect to the Repl could be obtained by an attacker, leading to full compromise of that Repl (not of the account).

### Patches

This was patched in 7.3.1, by updating the address of the fallback WebSocket polling proxy to the new one.

### Workarounds

Specify the new address for the polling host (`gp-v2.replit.com`) in the `ConnectArgs`:

```typescript
const connectOptions: ConnectArgs = {
  // ...
  pollingHost: 'gp-v2.replit.com',
};
client.connect(connectOptions);
```

### For more information

Thanks to https://hackerone.com/orlserg for disclosing this.

If you have any questions or comments about this advisory:
* Open an issue in [replit/crosis](https://github.com/replit/crosis)
* Email us at [security@replit.com](mailto:security@replit.com)
Insertion of Sensitive Information into Log File in Apache NiFi Stateless
Advisory: GHSA-g644-pr5v-vppf
Aliases: CVE-2020-9486
Published: 2022-01-06T20:41:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.
SQL Injection in Log4j 1.2.x
Advisory: GHSA-65fg-84f6-3jq3
Aliases: CVE-2022-23305
Published: 2022-01-21T23:26:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Integer underflow in Frontier
Advisory: GHSA-cjg2-2fjg-fph4
Aliases: CVE-2022-21685
Published: 2022-01-14T21:03:36Z

### Impact

A bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds (and production WebAssembly binaries), the impact is limited as it can only cause a normal EVM out-of-gas. It is recommended that you apply the patch as soon as possible.

If you do not use MODEXP precompile in your runtime, then you are not impacted.

### Patches

Patches are applied in PR #549.

### Workarounds

None.

### References

Patch PR: #549

### Credits

Thanks to SR-Labs for discovering the security vulnerability, and thanks to PureStake team for the patches.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)
bookstack is vulnerable to Improper Access Control
Advisory: GHSA-ghhm-xrwp-75m9
Aliases: CVE-2021-4194
Published: 2022-01-08T00:34:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

bookstack is vulnerable to Improper Access Control
Use After Free in rusqlite
Advisory: GHSA-87xh-9q6h-r5cc
Aliases: CVE-2021-45715
Published: 2022-01-06T22:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free.
Directory-traversal in Django
Advisory: GHSA-jrh2-hc4r-7jwx
Aliases: CVE-2021-45452
Published: 2022-01-12T19:21:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.
jquery.terminal self XSS on user input
Advisory: GHSA-x9r5-jxvq-4387
Aliases: CVE-2021-43862
Published: 2022-01-06T22:48:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

### Impact
This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees.

Also if the application use execHash option and execute code from URL the attacker can use this URL to execute his code. The scope is limited because the javascript code inside html attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible.

### Patches
Fixed version 2.31.1

### Workarounds
The user can use formatting that wrap whole user input and it's no op.

```javascript
$.terminal.new_formatter([/([\s\S]+)/g, '[[;;]$1]']);
```
The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way).

### References
The issue was reported here [jcubic/jquery.terminal#727](https://github.com/jcubic/jquery.terminal/issues/727)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jcubic/jquery.terminal](https://github.com/jcubic/jquery.terminal)
* Email us at [jcubic@onet.pl](mailto:jcubic@onet.pl)
Kylin can receive user input and load any class through Class.forName(...).
Advisory: GHSA-q656-g2x3-8cgh
Aliases: CVE-2021-31522
Published: 2022-01-08T00:43:01Z

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Improper Access Control in Onionshare
Advisory: GHSA-w9m4-7w72-r766
Aliases: CVE-2022-21691
Published: 2022-01-21T23:20:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-004
- Vulnerability type: Improper Access Control
- Threat level: Moderate

## Description:

Chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

## Technical description:

![otf-004-a](https://user-images.githubusercontent.com/156128/140665619-e51cfac0-a60a-4c2f-9c8e-be26066e6f3f.png)
![otf-004-b](https://user-images.githubusercontent.com/156128/140665620-5d7c2770-c83f-4925-8912-f2849071a3b0.png)
![otf-004-c](https://user-images.githubusercontent.com/156128/140665622-78a71ace-c483-4b16-b205-481aafe7ff87.png)

This series of screenshots show Alice, Bob and Eve joined a chatroom and are the only participants in the chatroom. Eve seemingly leaves the chatroom, which leads Bob and Alice to believe they are having a private chat. The last screenshot shows that Eve only emitted the leave message and is still able to read the chat and possibly write messages.

This can be reproduced by joining the chat with two different instances, where one instance has slightly modified the client-side JavaScript code similar to OTF-003 (page 22). The joined emit needs to be removed from the connect event handler. Therefore the modified client is not listed in the userlist and has no active session. The modified non-listed user also needs to change their username to Eve, which is not shown in the chatroom. The modified client then emits the disconnect event and their connection is no longer usable.

This results in the leave message for Eve and the removal from the user-list but not in removal of the original session of the Eve who announced to join the chat.

## Impact:

An adversary with access to the chat environment can spoof his leave event but still persist in the chat with access to all sent messages and the possibility to write in the chat using OTF-003 (page 22).

## Recommendation:

- Implement proper session handling