aswin1906/github-advisory-2022 huggingface dataset:
Integer overflow in TFLite array creation
Advisory: GHSA-9gwq-6cwj-47h3
Aliases: CVE-2022-23558
Published: 2022-02-09T23:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

### Impact 
An attacker can craft a TFLite model that would cause an integer overflow [in `TfLiteIntArrayCreate`](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L53-L60):

```cc
TfLiteIntArray* TfLiteIntArrayCreate(int size) {
  int alloc_size = TfLiteIntArrayGetSizeInBytes(size);
  // ...
  TfLiteIntArray* ret = (TfLiteIntArray*)malloc(alloc_size);
  // ...
} 
```

The [`TfLiteIntArrayGetSizeInBytes`](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L24-L33) returns an `int` instead of a `size_t`:

```cc
int TfLiteIntArrayGetSizeInBytes(int size) {
  static TfLiteIntArray dummy;

  int computed_size = sizeof(dummy) + sizeof(dummy.data[0]) * size;
#if defined(_MSC_VER)
  // Context for why this is needed is in http://b/189926408#comment21
  computed_size -= sizeof(dummy.data[0]);
#endif
  return computed_size;
}
```

An attacker can control model inputs such that `computed_size` overflows the size of `int` datatype.

### Patches
We have patched the issue in GitHub commit [a1e1511dde36b3f8aa27a6ec630838e7ea40e091](https://github.com/tensorflow/tensorflow/commit/a1e1511dde36b3f8aa27a6ec630838e7ea40e091).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Remote code execution in DolphinScheduler
Advisory: GHSA-jpj4-5xwp-cv23
Aliases: CVE-2020-11974
Published: 2022-02-09T22:44:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
Apache Cassandra vulnerable to Code Injection due to unsafe configuration
Advisory: GHSA-8ffc-79xg-29w8
Aliases: CVE-2021-44521
Published: 2022-02-12T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Data Amplification in Play Framework
Advisory: GHSA-r8rm-4hfj-2x87
Aliases: CVE-2020-26882
Published: 2022-02-10T20:23:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
Improper Restriction of XML External Entity Reference
Advisory: GHSA-88cc-g835-76rp
Aliases: CVE-2020-13692
Published: 2022-02-10T00:30:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H

PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
Improper Privilege Management in Snipe-IT
Advisory: GHSA-j57w-3c39-gpp5
Aliases: CVE-2022-0611
Published: 2022-02-17T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.
Allocation of Resources Without Limits or Throttling in metadata-extractor
Advisory: GHSA-4v6p-cxf9-98rf
Aliases: CVE-2022-24614
Published: 2022-02-25T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Improper Certificate Validation in Hutool
Advisory: GHSA-p7w9-8mxw-p3g7
Aliases: CVE-2022-22885
Published: 2022-02-17T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
Cross-site Scripting in enshrined/svg-sanitize
Advisory: GHSA-fqx8-v33p-4qcc
Aliases: CVE-2022-23638
Published: 2022-02-14T22:54:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
SVG sanitizer library before version `0.15.0` did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML (fetched as `text/html`) was susceptible to cross-site scripting. Plain SVG files (fetched as `image/svg+xml`) were not affected.

### Patches
This issue is fixed in `0.15.0` and higher.

### Workarounds
There is currently no workaround available without upgrading.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Github](https://github.com/darylldoyle/svg-sanitizer/issues)
* Email us at [daryll@enshrined.co.uk](mailto:daryll@enshrined.co.uk)
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Pipeline: Shared Groovy Libraries Plugin
Advisory: GHSA-5hfv-mg5x-mv32
Aliases: CVE-2022-25178
Published: 2022-02-16T00:01:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Pipeline: Shared Groovy Libraries Plugin does not restrict the names of resources passed to the libraryResource step, allowing attackers able to configure Pipelines permission to read arbitrary files on the Jenkins controller file system.
Unauthorized access to Class instance in Jinjava
Advisory: GHSA-2hjr-fg6c-v2h6
Aliases: CVE-2020-12668
Published: 2022-02-09T00:33:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure.
Denial of Service in Bytom
Advisory: GHSA-vc3x-gx6c-g99f
Aliases: CVE-2018-18206
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.
Improper input validation in Drupal core
Advisory: GHSA-fmfv-x8mp-5767
Aliases: CVE-2022-25271
Published: 2022-02-18T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Cross-site scripting in json-sanitizer
Advisory: GHSA-g8jj-899q-8x3j
Aliases: CVE-2020-13973
Published: 2022-02-10T23:04:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
OS Command Injection in git-add-remote
Advisory: GHSA-h9v8-rm3m-5h5f
Aliases: CVE-2020-7630
Published: 2022-02-10T23:47:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.
Jenkins Snow Commander Plugin 2.0 vulnerable to Cross-Site Request Forgery
Advisory: GHSA-fhfh-6cjg-57rg
Aliases: CVE-2022-25192
Published: 2022-02-16T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Snow Commander Plugin 2.0 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Improper Restriction of XML External Entity Reference in Jenkins Chef Sinatra
Advisory: GHSA-38w8-h222-wrpp
Aliases: CVE-2022-25209
Published: 2022-02-16T00:01:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.

As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Insufficient Session Expiration in Apache NiFi Registry
Advisory: GHSA-rcwj-2hj2-vmjj
Aliases: CVE-2020-9482
Published: 2022-02-09T00:23:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi Registry.
Missing server signature validation in OctoberCMS
Advisory: GHSA-53m6-44rc-h2q5
Aliases: CVE-2022-23655
Published: 2022-02-24T13:09:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

### Impact

This advisory affects authors of plugins and themes listed on the October CMS marketplace where an end-user will inadvertently expose authors to potential financial loss by entering their private license key into a compromised server.

It has been disclosed that a project fork of October CMS v1.0 is using a compromised gateway to access the October CMS marketplace service. The compromised gateway captures the personal/business information of users and authors, including private source code files. It was also disclosed that captured plugin files are freely redistributed to other users without authorization.

1. End-users are provided with a forked version of October CMS v1.0. The provided software is modified to use a compromised gateway server.

2. The user is instructed to enter their October CMS license key into the administration panel to access the October CMS marketplace. The key is sent to the compromised server while appearing to access the genuine October CMS gateway server.

3. The compromised gateway server uses a "man in the middle" mechanism that captures information while forwarding the request to the genuine October CMS gateway and relaying the response back to the client.

4. The compromised gateway server stores the license key and other information about the user account including client name, email address and contents of purchased plugins and privately uploaded plugin files. 

5. The stored plugin files are made available to other users of the compromised gateway server.

### Patches

The issue has been patched in Build 475 (v1.0.475) and v1.1.11.

### Workarounds

Apply https://github.com/octobercms/october/commit/e3b455ad587282f0fbcb7763c6d9c3d000ca1e6a to your installation manually if unable to upgrade to Build 475 or v1.1.11.

### Recommendations

We recommend the following steps to make sure your account information stays secure:

- Do not share your license key with anyone except October CMS.
- Check to make sure that your gateway update server has not been modified.
- Be aware of phishing websites, including other platforms that use the same appearance.
- For authors, you may contact us for help requesting the removal of affected plugins.
- Before providing plugin support, verify that the user holds a legitimate copy of the plugin.

### References

Credits for research on this exploit:
• Nikita Khaetsky

### For more information

If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Cross-site Scripting in Microweber
Advisory: GHSA-hj8g-cw8x-2c6m
Aliases: CVE-2022-0719
Published: 2022-02-24T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H

Microweber prior to version 1.3 is vulnerable to reflected cross-site scripting.
Symlink Attack in Libcontainer and Docker Engine
Advisory: GHSA-g7v2-2qxx-wjrw
Aliases: CVE-2015-3627
Published: 2022-02-15T01:18:02Z

Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Arbitrary code execution in Magnolia CMS
Advisory: GHSA-m4hg-5p2m-fm5m
Aliases: CVE-2021-46361
Published: 2022-02-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
Out of bounds read in Tensorflow
Advisory: GHSA-vjg4-v33c-ggc4
Aliases: CVE-2022-21730
Published: 2022-02-09T18:29:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

### Impact 
The [implementation of `FractionalAvgPoolGrad`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_avg_pool_op.cc#L209-L360) does not consider cases where the input tensors are invalid allowing an attacker to read from outside of bounds of heap:

```python
import tensorflow as tf

@tf.function
def test():
  y = tf.raw_ops.FractionalAvgPoolGrad(
    orig_input_tensor_shape=[2,2,2,2],
    out_backprop=[[[[1,2], [3, 4], [5, 6]], [[7, 8], [9,10], [11,12]]]],
    row_pooling_sequence=[-10,1,2,3],
    col_pooling_sequence=[1,2,3,4],
    overlapping=True)
  return y
    
test()
```

### Patches
We have patched the issue in GitHub commit [002408c3696b173863228223d535f9de72a101a9](https://github.com/tensorflow/tensorflow/commit/002408c3696b173863228223d535f9de72a101a9).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Denial of service in github.com/nats-io/nats-server/server
Advisory: GHSA-m4jx-6526-vvhm
Aliases: CVE-2020-28466
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers - Running a NATS service which is exposed to untrusted users presents a heightened risk. Any remote execution flaw or equivalent seriousness, or denial-of-service by unauthenticated users, will lead to prompt releases by the NATS maintainers. Fixes for denial of service issues with no threat of remote execution, when limited to account holders, are likely to just be committed to the main development branch with no special attention. Those who are running such services are encouraged to build regularly from git.
crossbeam-utils Race Condition vulnerability
Advisory: GHSA-qc84-gqf4-9926
Aliases: CVE-2022-23639
Published: 2022-02-16T22:36:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

The affected version of this crate incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. 

However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`.

This can cause the following problems:

- Unaligned memory accesses
- Data race

Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue.

32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue.
32-bit targets with `Atomic{I,U}64` and `{i,u}64` have the same alignment are also not affected by this issue.

The following is a complete list of the builtin targets that may be affected. (last update: nightly-2022-02-11)

- armv7-apple-ios (tier 3)
- armv7s-apple-ios (tier 3)
- i386-apple-ios (tier 3)
- i586-unknown-linux-gnu
- i586-unknown-linux-musl
- i686-apple-darwin (tier 3)
- i686-linux-android
- i686-unknown-freebsd
- i686-unknown-haiku (tier 3)
- i686-unknown-linux-gnu
- i686-unknown-linux-musl
- i686-unknown-netbsd (tier 3)
- i686-unknown-openbsd (tier 3)
- i686-wrs-vxworks (tier 3)

([script to get list](https://gist.github.com/taiki-e/3c7891e8c5f5e0cbcb44d7396aabfe10))

### Patches

This has been fixed in crossbeam-utils 0.8.7.

Affected 0.8.x releases have been yanked.

### References

https://github.com/crossbeam-rs/crossbeam/pull/781 

### License

This advisory is in the public domain.
Integer overflow in Tensorflow
Advisory: GHSA-c6fh-56w7-fvjw
Aliases: CVE-2022-21727
Published: 2022-02-09T18:29:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

### Impact 
The [implementation of shape inference for `Dequantize`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/ops/array_ops.cc#L3001-L3034) is vulnerable to an integer overflow weakness:

```python
import tensorflow as tf

input = tf.constant([1,1],dtype=tf.qint32)

@tf.function
def test():
  y = tf.raw_ops.Dequantize(
    input=input,
    min_range=[1.0],
    max_range=[10.0],
    mode='MIN_COMBINED',
    narrow_range=False,
    axis=2**31-1,
    dtype=tf.bfloat16)
  return y

test()
``` 

The `axis` argument can be `-1` (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes `axis + 1`, an attacker can trigger an integer overflow:

```cc
  int axis = -1; 
  Status s = c->GetAttr("axis", &axis);
  // ...
  if (axis < -1) {
    return errors::InvalidArgument("axis should be at least -1, got ",
                                   axis);
  }
  // ...
  if (axis != -1) {
    ShapeHandle input;
    TF_RETURN_IF_ERROR(c->WithRankAtLeast(c->input(0), axis + 1, &input));
    // ...
  }
```
  
### Patches
We have patched the issue in GitHub commit [b64638ec5ccaa77b7c1eb90958e3d85ce381f91b](https://github.com/tensorflow/tensorflow/commit/b64638ec5ccaa77b7c1eb90958e3d85ce381f91b).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
      
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
OS Command Injection in install-package
Advisory: GHSA-6m4r-m3gc-h4r5
Aliases: CVE-2020-7629
Published: 2022-02-10T23:48:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Multiple `CHECK`-fails in `function.cc` in TensowFlow
Advisory: GHSA-43jf-985q-588j
Aliases: CVE-2022-23586
Published: 2022-02-09T23:27:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
A malicious user can cause a denial of service by altering a `SavedModel` such that [assertions in `function.cc`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/function.cc) would be falsified and crash the Python interpreter.
### Patches
We have patched the issue in GitHub commits [dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2](https://github.com/tensorflow/tensorflow/commit/dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2) and [3d89911481ba6ebe8c88c1c0b595412121e6c645](https://github.com/tensorflow/tensorflow/commit/3d89911481ba6ebe8c88c1c0b595412121e6c645).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Memory exhaustion in Tensorflow
Advisory: GHSA-98j8-c9q4-r38g
Aliases: CVE-2022-21733
Published: 2022-02-10T00:20:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

### Impact 
The [implementation of `StringNGrams`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/string_ngrams_op.cc#L29-L161) can be used to trigger a denial of service attack by causing an OOM condition after an integer overflow:

```python
import tensorflow as tf

tf.raw_ops.StringNGrams(
  data=['123456'],
  data_splits=[0,1],
  separator='a'*15,
  ngram_widths=[],
  left_pad='',
  right_pad='',
  pad_width=-5, 
  preserve_short_sequences=True)
```

We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output.

### Patches
We have patched the issue in GitHub commit [f68fdab93fb7f4ddb4eb438c8fe052753c9413e8](https://github.com/tensorflow/tensorflow/commit/f68fdab93fb7f4ddb4eb438c8fe052753c9413e8).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Allocation of Resources Without Limits or Throttling in Keycloak
Advisory: GHSA-52rg-hpwq-qp56
Aliases: CVE-2020-10758
Published: 2022-02-09T00:56:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.
SQL injection in MCMS
Advisory: GHSA-2pmw-cvc7-frvh
Aliases: CVE-2021-44868
Published: 2022-02-18T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak
Advisory: GHSA-c597-f74m-jgc2
Aliases: CVE-2020-1758
Published: 2022-02-09T00:56:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.
Code injection in ezsystems/ezpublish-kernel
Advisory: GHSA-xwv6-v7qx-f5jc
Aliases: CVE-2022-25337
Published: 2022-02-19T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, since not all possible attack vectors are removed from the original file name.

The second issue is that direct access to the images is not access controlled. This is by design, for performance reasons, and documented as such. But it does mean that images not meant to be publicly accessible can be accessed, provided that the image path and filename is correctly deduced and/or guessed, through dictionary attacks and similar.
HashiCorp Consul Ingress Gateway Panic Can Shutdown Servers
Advisory: GHSA-hj93-5fg3-3chr
Aliases: CVE-2022-24687
Published: 2022-02-25T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

HashiCorp Consul and Consul Enterprise 1.8.0 through 1.9.14, 1.10.7, and 1.11.2 has Uncontrolled Resource Consumption. Clusters with at least one ingress gateway configured may allow a user with `service:write` permission to register a specifically-defined service that can cause the Consul server to panic and shutdown. Versions 1.9.15, 1.10.8, and 1.11.3 contain patches for the problem.
Deserialization exploitation in Apache Dubbo
Advisory: GHSA-74mg-6xqx-2vrq
Aliases: CVE-2020-11995
Published: 2022-02-09T22:27:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HashMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
OCI Manifest Type Confusion Issue
Advisory: GHSA-qq97-vm5h-rrhg
Published: 2022-02-08T18:53:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

### Impact

Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.

### Patches

Upgrade to at least `v2.8.0-beta.1`  if you are running `v2.x` release. If you use the code from the `main` branch, update at least to the commit after [b59a6f827947f9e0e67df0cfb571046de4733586](https://github.com/distribution/distribution/commit/b59a6f827947f9e0e67df0cfb571046de4733586).

### Workarounds

There is no way to work around this issue without patching.

### References

Due to [an oversight in the OCI Image Specification](https://github.com/opencontainers/image-spec/pull/411) that removed the embedded `mediaType` field from manifests, a maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image’s digest by modifying the `Content-Type` header returned by a registry. This can invalidate a common pattern of relying on container image digests for equivalence.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [distribution](https://github.com/distribution/distribution) 
* Open an issue in [distribution-spec](https://github.com/opencontainers/distribution-spec) 
* Email us at [cncf-distribution-security@lists.cncf.io](mailto:cncf-distribution-security@lists.cncf.io)
Man-in-the-Middle (MitM)
Advisory: GHSA-8w94-cf6g-c8mg
Aliases: CVE-2014-5277
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.
Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Advisory: GHSA-fmj2-7wx8-qj4v
Aliases: CVE-2020-11988
Published: 2022-02-09T00:45:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible
Advisory: GHSA-785x-qw4v-6872
Aliases: CVE-2020-14330
Published: 2022-02-09T22:00:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
Buffer Copy without Checking Size of Input in NumPy
Advisory: GHSA-f7c7-j99h-c22f
Aliases: CVE-2021-41496
Published: 2022-02-08T00:00:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values.
Cross site scripting in LibreNMS
Advisory: GHSA-vhm6-gw82-6f8j
Aliases: CVE-2022-0772
Published: 2022-02-28T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

LibreNMS prior to version 22.2.2 is vulnerable to cross-site scripting.
DoS vulnerability in bundled XStream library in Jenkins Core
Advisory: GHSA-34wx-x2w9-vqm3
Aliases: CVE-2022-0538
Published: 2022-02-10T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier is affected by the XStream library’s vulnerability [CVE-2021-43859](https://x-stream.github.io/CVE-2021-43859.html). This library is used by Jenkins to serialize and deserialize various XML files, like global and job `config.xml`, `build.xml`, and numerous others.

This allows attackers able to submit crafted XML files to Jenkins to be parsed as configuration, e.g. through the `POST config.xml` API, to cause a denial of service (DoS).
Improper Link Resolution Before File Access in Jenkins Pipeline: Shared Groovy Libraries Plugin
Advisory: GHSA-q234-x887-9rxh
Aliases: CVE-2022-25177
Published: 2022-02-16T00:01:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step, allowing attackers able to configure Pipelines to read arbitrary files on the Jenkins controller file system.
containerd v1.2.x can be coerced into leaking credentials during image pull
Advisory: GHSA-742w-89gc-8m9c
Aliases: CVE-2020-15157
Published: 2022-02-11T23:27:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

## Impact

If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise known as a “foreign layer”), the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 or later, the default containerd resolver will provide its authentication credentials if the server where the URL is located presents an HTTP 401 status code along with registry-specific HTTP headers.

If an attacker publishes a public image with a manifest that directs one of the layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used for pulling that image. In some cases, this may be the user's username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other cloud resources in the account.

The default containerd resolver is used by the cri-containerd plugin (which can be used by Kubernetes), the ctr development tool, and other client programs that have explicitly linked against it.

This vulnerability has been rated by the containerd maintainers as medium, with a CVSS score of 6.1 and a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N.

## Patches

This vulnerability has been fixed in containerd 1.2.14.  containerd 1.3 and later are not affected.

## Workarounds

If you are using containerd 1.3 or later, you are not affected.  If you are using cri-containerd in the 1.2 series or prior, you should ensure you only pull images from trusted sources.  Other container runtimes built on top of containerd but not using the default resolver (such as Docker) are not affected.

## Credits

The containerd maintainers would like to thank Brad Geesaman, Josh Larsen, Ian Coldwater, Duffie Cooley, and Rory McCune for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/master/SECURITY.md).
Path traversal vulnerability in Jenkins Fortify Plugin
Advisory: GHSA-23h5-8ph6-7rfc
Aliases: CVE-2022-25188
Published: 2022-02-16T00:01:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fortify Plugin 20.2.34 and earlier does not sanitize the `appName` and `appVersion` parameters of its Pipeline steps, which are used to write to files inside build directories.

This allows attackers with Item/Configure permission to write or overwrite `.xml` files on the Jenkins controller file system with content not controllable by the attacker.

Fortify Plugin 20.2.35 sanitizes the `appName` and `appVersion` parameters of its Pipeline steps when determining the resulting filename.
Deserialization of untrusted data in Apache Cayenne
Advisory: GHSA-c58c-w527-h77p
Aliases: CVE-2022-24289
Published: 2022-02-12T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.
Capture-replay in Gitea
Advisory: GHSA-jrpg-35hw-m4p9
Aliases: CVE-2021-45327
Published: 2022-02-09T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gitea is a project to help users set up a self-hosted Git service. Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. This could allow a remote malicious user to execute arbitrary code.
Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds (Simple) Plugin
Advisory: GHSA-gc7q-7vg3-h8gf
Aliases: CVE-2022-25202
Published: 2022-02-16T00:01:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
URL Redirection to Untrusted Site ('Open Redirect')
Advisory: GHSA-jp55-vvmf-63mv
Aliases: CVE-2022-23618
Published: 2022-02-09T21:42:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

### Impact
There's no protection against URL redirection to untrusted site, in particular some well known parameters (xredirect) can be used to perform such redirections.

### Patches
The problem has been patched in XWiki 12.10.7 and XWiki 13.3RC1.

### Workarounds
There's no known workaround for this issue. 

### References
https://jira.xwiki.org/browse/XWIKI-10309

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
CSRF vulnerability in Jenkins Checkmarx Plugin allow capturing credentials
Advisory: GHSA-5pcf-vxm3-frph
Aliases: CVE-2022-25200
Published: 2022-02-16T00:01:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Checkmarx Plugin 2022.1.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified webserver using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Exposure of Sensitive Information to an Unauthorized Actor and Insertion of Sensitive Information Into Sent Data in Calico
Advisory: GHSA-pf59-j7c2-rh6x
Aliases: CVE-2020-13597
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure the node’s IPv6 interface due to the node accepting route advertisement by default, allowing the attacker to redirect full or partial network traffic from the node to the compromised pod.
Logic error in dolibarr/dolibarr
Advisory: GHSA-8vq6-5f66-hp3r
Aliases: CVE-2022-0746
Published: 2022-02-26T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In dolibarr/dolibarr prior to 16.0 any low privileged users could update their login name which should only be updated by admin.
Server Side Request Forgery in Grafana
Advisory: GHSA-wc9w-wvq2-ffm9
Aliases: CVE-2020-13379
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:F/RL:O/RC:C

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.
Missing authorization in xwiki-platform
Advisory: GHSA-gf7x-2j2x-7f73
Aliases: CVE-2022-23617
Published: 2022-02-09T21:41:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact

Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page.

### Patches

It has been patched in XWiki 13.2CR1 and 12.10.6

### Workarounds

There is no workaround beside patching.

### References

https://jira.xwiki.org/browse/XWIKI-18430

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Abort caused by allocating a vector that is too large in Tensorflow
Advisory: GHSA-627q-g293-49q7
Aliases: CVE-2022-23580
Published: 2022-02-07T22:01:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
During shape inference, TensorFlow can [allocate a large vector](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L788-L790) based on a value from a tensor controlled by the user:

```cc
  const auto num_dims = Value(shape_dim);
  std::vector<DimensionHandle> dims;
  dims.reserve(num_dims);
``` 
  
### Patches           
We have patched the issue in GitHub commit [1361fb7e29449629e1df94d44e0427ebec8c83c7](https://github.com/tensorflow/tensorflow/commit/1361fb7e29449629e1df94d44e0427ebec8c83c7).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Crypt_GPG does not prevent additional options in GPG calls
Advisory: GHSA-59x4-67mh-px54
Aliases: CVE-2022-24953
Published: 2022-02-18T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
Exposure of Resource to Wrong Sphere in Zip-Local
Advisory: GHSA-wxj7-97fp-j53j
Aliases: CVE-2021-23484
Published: 2022-02-01T00:46:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.
Cross-site Scripting in Drupal Core
Advisory: GHSA-m6q5-wv4x-fv6h
Aliases: CVE-2020-13668
Published: 2022-02-12T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Incorrect authorization in Drupal core
Advisory: GHSA-73q4-j324-2qcc
Aliases: CVE-2022-25270
Published: 2022-02-18T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "access in-place editing" permission viewing some content they are are not authorized to access. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Authorization bypass in url-parse
Advisory: GHSA-rqff-837h-mm52
Aliases: CVE-2022-0512
Published: 2022-02-15T00:02:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
Permissive parameters and privilege escalation
Advisory: GHSA-mrq8-53r4-3j5m
Aliases: CVE-2018-20301
Published: 2022-02-10T22:35:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.
Missing permission checks in Jenkins Chef Sinatra Plugin allow XXE
Advisory: GHSA-fq56-c7rj-j3j9
Aliases: CVE-2022-25208
Published: 2022-02-16T00:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML.

As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
On Windows, `git-sizer` might run a `git` executable within the repository being analyzed
Advisory: GHSA-57q7-rxqq-7vgp
Published: 2022-02-15T01:57:18Z

### Impact
On Windows, if `git-sizer` is run against a non-bare repository, and that repository has an executable called `git.exe`, `git.bat`, etc., then that executable might be run by `git-sizer` rather than the system `git` executable. An attacker could try to use social engineering to get a victim to run `git-sizer` against a hostile repository and thereby get the victim to run arbitrary code.

On Linux or other Unix-derived platforms, a similar problem could occur if the user's `PATH` has the current directory before the path to the standard `git` executable, but this is would be a very unusual configuration that has been known for decades to lead to all kinds of security problems.

### Patches
Users should update to git-sizer v1.4.0

### Workarounds
If you are on Windows, then either
* Don't run `git-sizer` against a repository that might contain hostile code, or, if you must…
* Run `git-sizer` against a bare clone of the hostile repository, or, if that is not possible…
* Make sure that the hostile repository doesn't have an executable in its top-level directory before running `git-sizer`.

If you are on Linux or other Unix-based system, then (for myriad reasons!) don't add the current directory to your `PATH`.

### References
* [Command PATH security in Go](https://blog.golang.org/path-security)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the `git-sizer` project](https://github.com/github/git-sizer).
* Email us at [GitHub support](mailto:support@github.com).
Unrestricted Upload of File with Dangerous Type in showdoc
Advisory: GHSA-6x3j-x9rp-whxp
Aliases: CVE-2022-0409
Published: 2022-02-20T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

showdoc prior to 2.10.2 is vulnerable to Unrestricted Upload of File with Dangerous Type.
Arbitrary Code Execution in Docker
Advisory: GHSA-5qgp-p5jc-w2rm
Aliases: CVE-2014-6407
Published: 2022-02-15T00:41:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
SSRF in Kitodo.Presentation
Advisory: GHSA-x832-r2rj-4g5p
Aliases: CVE-2022-24980
Published: 2022-02-20T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the Kitodo.Presentation (aka dlf) extension before 2.3.2, 3.x before 3.2.3, and 3.3.x before 3.3.4 for TYPO3. A missing access check in an eID script allows an unauthenticated user to submit arbitrary URLs to this component. This results in SSRF, allowing attackers to view the content of any file or webpage the webserver has access to.
Path Traversal in Crafter CMS Crafter Studio
Advisory: GHSA-f68h-hfqp-8rmv
Aliases: CVE-2017-15684
Published: 2022-02-09T23:08:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.