aswin1906/github-advisory-2022 huggingface dataset:
TensorFlow vulnerable to segfault in `BlockLSTMGradV2`
Advisory: GHSA-f7r5-q7cx-h668
Aliases: CVE-2022-35964
Published: 2022-09-16T22:14:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of `BlockLSTMGradV2` does not fully validate its inputs.
 - `wci`, `wcf`, `wco`, `b` must be rank 1
 - `w`, cs_prev`, `h_prev` must be rank 2
 - `x` must be rank 3
This results in a a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf

use_peephole = False
seq_len_max = tf.constant(1, shape=[], dtype=tf.int64)
x = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
cs_prev = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
h_prev = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
w = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
wci = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
wcf = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
wco = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
b = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
i = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
cs = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
f = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
o = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
ci = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
co = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
h = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
cs_grad = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
h_grad = tf.constant(0.504355371, shape=[1,1,1], dtype=tf.float32)
tf.raw_ops.BlockLSTMGradV2(seq_len_max=seq_len_max, x=x, cs_prev=cs_prev, h_prev=h_prev, w=w, wci=wci, wcf=wcf, wco=wco, b=b, i=i, cs=cs, f=f, o=o, ci=ci, co=co, h=h, cs_grad=cs_grad, h_grad=h_grad, use_peephole=use_peephole)
```

### Patches
We have patched the issue in GitHub commit [2a458fc4866505be27c62f81474ecb2b870498fa](https://github.com/tensorflow/tensorflow/commit/2a458fc4866505be27c62f81474ecb2b870498fa).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.
`os_socketaddr` invalidly assumes the memory layout of std::net::SocketAddr
Advisory: GHSA-c439-chv8-8g2j
Published: 2022-09-02T22:29:41Z

The [`os_socketaddr`](https://crates.io/crates/os_socketaddr) crate has assumed `std::net::SocketAddrV4` and `std::net::SocketAddrV6` have the same memory layout as the system C representation `sockaddr`. It has simply casted the pointers to convert the socket addresses to the system representation.

These layout were [changed into idiomatic rust types](https://github.com/rust-lang/rust/pull/78802) in nightly `std`. Starting from rustc 1.64 the affected versions of this crate will have undefined behaviour.
personnummer/dart vulnerable to Improper Input Validation
Advisory: GHSA-4xh4-v2pq-jvhm
Aliases: CVE-2023-22963
Published: 2022-09-19T22:47:29Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)
typemap is Unmaintained
Advisory: GHSA-vfv3-9w6v-23jp
Published: 2022-09-16T17:13:21Z

The maintainer seems unreachable. The crate may or may not be usable as-is despite no maintenance and may not work in future versions of Rust. The last release seems to have been seven years ago.
API token stored in plain text by Jenkins CONS3RT Plugin
Advisory: GHSA-fmq9-r4p2-8272
Aliases: CVE-2022-41255
Published: 2022-09-22T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins CONS3RT Plugin 1.0.0 and earlier stores Cons3rt API token unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

This API token can be viewed by users with access to the Jenkins controller file system.
Centreon contains cross-site scripting vulnerability via esc_name parameter
Advisory: GHSA-rv5q-72p2-2q24
Aliases: CVE-2022-40044
Published: 2022-09-27T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the `esc_name` (Escalation Name) parameter at `Configuration/Notifications/Escalations`. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. Versions 21.04.16, 21.10.8, and 22.04.2 contain patches.
Microweber vulnerable to  HTML Injection in create tag functionality
Advisory: GHSA-gm8c-w9cm-c445
Aliases: CVE-2022-3245
Published: 2022-09-21T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit f20abf30a1d9c1426c5fb757ac63998dc5b92bfc and is anticipated to be part of version 1.3.2.
lakeFS vulnerable to authenticated users deleting files they are not authorized to delete
Advisory: GHSA-28q9-9c3g-v3f9
Published: 2022-09-23T15:13:14Z

### Impact

Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete.

### Patches

lakeFS v0.82.0 and later

### Workarounds

Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts with "AWS".

### References

[advisories/GHSA-28q9-9c3g-v3f9](https://github.com/treeverse/lakeFS/security/advisories/GHSA-28q9-9c3g-v3f9)

### For more information
If you have any questions or comments about this advisory:

Ask on the [lakeFS Slack](https://github.com/treeverse/lakeFS/security/advisories/lakefs.io/slack) #help channel
Email us at [security@treeverse.io](mailto:security@treeverse.io)
jwcrypto token substitution can lead to authentication bypass
Advisory: GHSA-gwp4-mcv4-w95j
Aliases: CVE-2022-3102
Published: 2022-09-21T16:58:31Z

The JWT code can auto-detect the type of token being provided, and this can lead the application to incorrect conclusions about the trustworthiness of the token.
Quoting the private disclosure we received : "Under certain circumstances, it is possible to substitute a [..] signed JWS with a JWE that is encrypted with the public key that is normally used for signature validation."
This substitution attack can occur only if the validating application also have access to the private key, normally used to sign the tokens, available during validation of the received JWT.
The significance of this attacks depends on the use of the token, it may lead to authentication bypass or authorization bypass (respectively if claims are used to authenticate or authorize certain actions), because the attacker has full control of the data placed in the JWE and can inject any desired claim value.

Several mitigating factors exist that can protect applications from this issue:
- If the private key corresponding to the public key used to encrypt the JWE is not available to the application an exception will be raised.
- If the JWK is specified with the 'use' parameter set to 'sig' (as expected for keys used only for signing/verification) an exception will be raised.
- If the JWK is specified with the 'key_ops' parameter set and it does not include the 'decrypt' operation an exception will be raised.
- Applications may check the token type before validation, in this case they would fail to detect an expected JWS

Normally, signing and validation are done by different applications, so this scenario should be unlikely. However it is possible to have applications that both sign and validate tokens and do not separate JWKs in use, or do not set a JWK 'use' type.

Due to the mitigating factors, and the fact that specific operational constraints and conditions need to be in place to successfully exploit this issue to generate an authentication bypass, we rate this security issue as moderate. Other avenues may decide on a different rating based on use case, always verify what conditions apply to your use of the library to assess risk.

Many thanks to Tom Tervoort of Secura for finding and reporting this issue.
Binary vulnerable to Slice Memory Allocation with Excessive Size Value
Advisory: GHSA-4p6f-m4f9-ch88
Aliases: CVE-2022-36078
Published: 2022-09-16T21:25:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact
> _What kind of vulnerability is it? Who is impacted?_

The vulnerability is a memory allocation vulnerability that can be exploited to allocate slices in memory with (arbitrary) excessive size value, which can either exhaust available memory or crash the whole program.

When using `github.com/gagliardetto/binary` to parse unchecked (or wrong type of) data from untrusted sources of input (e.g. the blockchain) into slices, it's possible to allocate memory with excessive size.

When `dec.Decode(&val)` method is used to parse data into a structure that is or contains slices of values, the length of the slice was previously read directly from the data itself without any checks on the size of it, and then a slice was allocated. This could lead to an overflow and an allocation of memory with excessive size value.

Example:

```go
package main

import (
	"github.com/gagliardetto/binary" // any version before v0.7.1 is vulnerable
	"log"
)

type MyStruct struct {
	Field1 []byte // field is a slice (could be a slice of any type)
}

func main() {
	// Let's assume that the data is coming from the blockchain:
	data := []byte{0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10}
	
	var val MyStruct
	// - To determine the size of the val.Field1 slice, the decoder will read the length
	//   of the slice from the data itself without any checks on the size of it.
	//
	// - This could lead to an allocation of memory with excessive size value.
	//   Which means: []byte{0x01, 0x02, 0x03, 0x04} will be read as the length
	//   of the slice (= 67305985) and then an allocation of memory with 67305985 bytes will be made.
	//
	dec := binary.NewBorshDecoder(data)
	err := dec.Decode(&val)  // or binary.UnmarshalBorsh(&val, data) or binary.UnmarshalBin(&val, data) etc.
	if err != nil {
		log.Fatal(err)
	}
}
```

### Patches
> _Has the problem been patched? What versions should users upgrade to?_

The vulnerability has been patched in `github.com/gagliardetto/binary` `v0.7.1`

Users should upgrade to `v0.7.1` or higher.

To upgrade to `v0.7.1` or higher, run:

```bash
go get github.com/gagliardetto/binary@v0.7.1

# or

go get github.com/gagliardetto/binary@latest
```

### Workarounds
> _Is there a way for users to fix or remediate the vulnerability without upgrading?_

A workaround is not to rely on the `dec.Decode(&val)` function to parse the data, but to use a custom `UnmarshalWithDecoder()` method that reads and checks the length of any slice.

### References
> _Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/gagliardetto/binary](https://github.com/gagliardetto/binary)
* DM me on [twitter](https://twitter.com/immaterial_ink)
Denial of Service via stack overflow
Advisory: GHSA-9fwf-46g9-45rx
Aliases: CVE-2022-40154
Published: 2022-09-17T00:00:41Z
Withdrawn: 2022-12-06T13:41:12Z

## Withdrawn

This advisory has been withdrawn because it has been found to be a duplicate. Please see the issue [here](https://github.com/x-stream/xstream/issues/304#issuecomment-1293654236) for more information.

## Original Despcription 

Those using FasterXML/woodstox to serialise XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

This vulnerability is only relevant for users making use of the DTD parsing functionality.
traitobject is Unmaintained
Advisory: GHSA-pp8r-vv2j-9j5v
Published: 2022-09-16T17:12:59Z

Crate `traitobject` has not had a release for over five years.

In addition there is an existing security advisory that has not been addressed:

 - [RUSTSEC-2020-0027](https://rustsec.org/advisories/RUSTSEC-2020-0027)

## Possible Alternative(s)

 The below list has not been vetted in any way and may or may not contain alternatives;

 - [destructure_traitobject]

[destructure_traitobject]: https://crates.io/crates/destructure_traitobject
lz4-sys vulnerable to memory corruption via issue in liblz4
Advisory: GHSA-9q5j-jm53-v7vr
Published: 2022-09-01T22:24:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

lz4-sys up to v1.9.3 bundles a version of liblz4 that is vulnerable to
[CVE-2021-3520](https://nvd.nist.gov/vuln/detail/CVE-2021-3520).

Attackers could craft a payload that triggers an integer overflow upon
decompression, causing an out-of-bounds write.

The flaw has been corrected in version v1.9.4 of liblz4, which is included
in lz4-sys 1.9.4.
steal vulnerable to Prototype Pollution via requestedVersion variable
Advisory: GHSA-93q5-3xpc-8vg3
Aliases: CVE-2022-37257
Published: 2022-09-16T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal via the requestedVersion variable in the npm-convert.js file.
Pimcore vulnerable to cross site scripting
Advisory: GHSA-wqr6-57qm-hhr5
Aliases: CVE-2022-3255
Published: 2022-09-22T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can perform any action within the application that the user can perform; view any information that the user is able to view; modify any information that the user is able to modify; and/or initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user. A patch for this issue is available at commit 1e916e7d668c9e47b217e20cc0ea4812f466201b and anticipated to be part of version 10.5.7.
Mattermost subject to Denial of Service via upload of special GIF
Advisory: GHSA-m7w4-q5vg-5xfp
Aliases: CVE-2022-3257
Published: 2022-09-25T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service.
YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module
Advisory: GHSA-mqh9-5jp9-6799
Aliases: CVE-2022-3000
Published: 2022-09-21T00:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the `LayoutEditor` module. A patch is available at commit eebc12601495ada38495076bec12841b2477516b.
Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization
Advisory: GHSA-j2mj-g8jp-gjfm
Aliases: CVE-2022-41228
Published: 2022-09-22T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials. Version 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent
Advisory: GHSA-w3w9-vrf5-8mx8
Aliases: CVE-2022-36032
Published: 2022-09-16T18:48:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact

In ReactPHP's HTTP server component versions below v1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like `__Host-` and `__Secure-` confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-7070 and CVE-2020-8184 for more information. 

### Patches

* https://github.com/reactphp/http/commit/663c9a3b77b71463fa7fcb76a6676ffd16979dd6 - Fixed in [reactphp/http `v1.7.0`](https://github.com/reactphp/http/releases/tag/v1.7.0)

### Workarounds

Infrastructure or DevOps can place a reverse proxy in front of the ReactPHP HTTP server to filter out any unexpected `Cookie` request headers.

### References

* CVE-2020-7070, https://bugs.php.net/bug.php?id=79699 and https://github.com/php/php-src/commit/6559fe912661ca5ce5f0eeeb591d928451428ed0
* CVE-2020-8184, https://hackerone.com/reports/895727 and https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c
* Originally introduced via https://github.com/reactphp/http/pull/175

### Credits

* Thanks to Marco Squarcina (TU Wien) for reporting this and working with us to coordinate this security advisory

### For more information

If you have any questions or comments about this advisory:

* [Join the discussion](https://github.com/orgs/reactphp/discussions/465)
* Email us at support@reactphp.org
matrix-js-sdk subject to impersonated messages due to permissive key forwarding
Advisory: GHSA-6263-x97c-c4gg
Aliases: CVE-2022-39249
Published: 2022-09-30T00:40:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

## Impact

An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others.

This attack is possible due to the matrix-js-sdk implementing a too permissive [key forwarding](https://spec.matrix.org/v1.3/client-server-api/#key-requests) strategy on the receiving end.

Key forwarding is a mechanism allowing clients to recover from “unable to decrypt” messages when they missed the initial key distribution, at the time the message was originally sent. Examples include accessing message history before they joined the room but also when some network/federation errors have occurred.

## Patches

The default policy for accepting key forwards has been made more strict in the matrix-js-sdk. matrix-js-sdk will now only accept forwarded keys in response to previously issued requests and only from own, verified devices.

A unique exception to this rule is with the experimental [MSC3061](https://github.com/matrix-org/matrix-spec-proposals/pull/3061), that is forwarding room keys for past messages when invited in a room configured with the proper history visibility setting. Such key forwards are parked upon receipt and are only accepted if the SDK receives an invitation for that room from the inviter in a limited time window.

The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages).

### Workarounds

As this attack requires coordination between a malicious homeserver and an attacker, if you trust your homeserver, no particular workaround is needed.

## References
Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

## For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
ansi_term is Unmaintained
Advisory: GHSA-74w3-p89x-ffgh
Published: 2022-09-16T21:03:19Z
Withdrawn: 2022-09-19T14:25:17Z

## Withdrawn Advisory
This advisory has been withdrawn because it does not discuss a particular vulnerability in the code of `ansi_term`.

## Original Description
The maintainer has adviced this crate is deprecated and will not receive any maintenance.

The crate does not seem to have much dependencies and may or may not be ok to use as-is.

Last release seems to have been three years ago.
TensorFlow vulnerable to OOB read in `Gather_nd` in TF Lite
Advisory: GHSA-pxrw-j2fv-hx3h
Aliases: CVE-2022-35937
Published: 2022-09-16T21:04:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

### Impact
The [`GatherNd`](https://github.com/tensorflow/tensorflow/blob/f463040eb3997e42e60a2ffc6dc72de7ef11dbb4/tensorflow/lite/kernels/gather_nd.cc#L105-L111) function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered.

### Patches
We have patched the issue in GitHub commit [595a65a3e224a0362d7e68c2213acfc2b499a196](https://github.com/tensorflow/tensorflow/commit/595a65a3e224a0362d7e68c2213acfc2b499a196).


The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Hui Peng from Baidu Security.
wee_alloc is Unmaintained
Advisory: GHSA-rc23-xxgq-x27g
Published: 2022-09-16T17:18:28Z

Two of the maintainers have indicated that the crate may not be maintained.

The crate has open issues including memory leaks and may not be suitable for production use.

It may be best to switch to the default Rust standard allocator on wasm32 targets.

Last release seems to have been three years ago.
Pebble Templates protection mechanism bypass can lead to arbitrary code execution
Advisory: GHSA-wxx5-w9jc-48wx
Aliases: CVE-2022-37767
Published: 2022-09-13T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.
Craft CMS Stored Cross-site Scripting in User Addresses Title
Advisory: GHSA-8r89-x93x-mjq2
Aliases: CVE-2022-37250
Published: 2022-09-17T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in `/admin/myaccount`.
snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write
Advisory: GHSA-c4r9-r8fh-9vj2
Aliases: CVE-2022-38749
Published: 2022-09-06T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Denial of Service via stack overflow
Advisory: GHSA-5hc5-c3m9-8vcj
Aliases: CVE-2022-40155
Published: 2022-09-17T00:00:41Z
Withdrawn: 2022-12-06T13:41:51Z

## Withdrawn

This advisory has been withdrawn because it has been found to be a duplicate. Please see the issue [here](https://github.com/x-stream/xstream/issues/304#issuecomment-1293654236) for more information.

## Original Despcription 

Those using FasterXML/woodstox to serialise XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack.

This vulnerability is only relevant for users making use of the DTD parsing functionality.
FeehiCMS vulnerable to Cross-Site scripting via crafted payload
Advisory: GHSA-5mqq-7g25-r4wx
Aliases: CVE-2022-40408
Published: 2022-09-30T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

FeehiCMS versions 2.0.1.1 and prior contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module. There are no patches and no known workarounds for this issue.
hoek subject to prototype pollution via the clone function.
Advisory: GHSA-c429-5p7v-vgjp
Aliases: CVE-2020-36604
Published: 2022-09-25T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

hoek versions prior to 8.5.1, and 9.x prior to 9.0.3 are vulnerable to prototype pollution in the clone function. If an object with the __proto__ key is passed to clone() the key is converted to a prototype. This issue has been patched in version 9.0.3, and backported to 8.5.1.
rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames
Advisory: GHSA-m379-x4xc-38x9
Aliases: CVE-2022-3167
Published: 2022-09-09T00:00:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

rdiffweb prior to 2.4.1 is vulnerable to Improper Restriction of Rendered UI Layers or Frames. This allows attackers to perform clickjacking attacks that can trick victims into performing actions such as entering passwords, liking or deleting posts, and/or initiating an account deletion. This issue has been patched in version 2.4.1.
Snipe-IT vulnerable to Improper Authentication
Advisory: GHSA-fhvv-p968-6vvj
Aliases: CVE-2022-3173
Published: 2022-09-18T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the `View and Modify License Files` permission may access files uploaded to licenses as long as they have the `View` permission for licenses.
Denial of Service due to parser crash
Advisory: GHSA-4rv7-wj6m-6c6r
Aliases: CVE-2022-40156
Published: 2022-09-17T00:00:41Z
Withdrawn: 2022-12-06T13:39:44Z

## Withdrawn

This advisory has been withdrawn because it has been found to be a duplicate. Please see the issue [here](https://github.com/x-stream/xstream/issues/304#issuecomment-1293654236) for more information.

## Original Despcription 

Those using FasterXML/woodstox to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

This vulnerability is only relevant for users making use of the DTD parsing functionality.
Apache Geode vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-q4q3-r45f-7gwg
Aliases: CVE-2022-37021
Published: 2022-09-01T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.
matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions
Advisory: GHSA-2pvj-p485-cp3m
Aliases: CVE-2022-39246
Published: 2022-09-30T04:33:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact
An attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others.

This attack is possible due to the matrix-android-sdk2 implementing a too permissive [key forwarding](https://spec.matrix.org/v1.3/client-server-api/#key-requests) strategy on the receiving end.

Key forwarding is a mechanism allowing clients to recover from “unable to decrypt” messages when they missed the initial key distribution, at the time the message was originally sent. Examples include accessing message history before they joined the room but also when some network/federation errors have occurred.

### Patches

The default policy for accepting key forwards has been made more strict in the matrix-android-sdk2. The matrix-android-sdk2 will now only accept forwarded keys in response to previously issued requests and only from own, verified devices.

A unique exception to this rule is with the experimental [MSC3061](https://github.com/matrix-org/matrix-spec-proposals/pull/3061), that is forwarding room keys for past messages when invited in a room configured with the proper history visibility setting. Such key forwards are parked upon receipt and are only accepted if the SDK receives an invitation for that room from the inviter in a limited time window. 

The SDK now sets a `trusted` flag on the decrypted message upon decryption, based on whether the key used to decrypt the message was received from a trusted source. Clients need to ensure that messages decrypted with a key with `trusted = false` are decorated appropriately (for example, by showing a warning for such messages).

### Workarounds
Current users of the SDK can disable key forwarding in their forks using `CryptoService#enableKeyGossiping(enable: Boolean)`.

### References
Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

### For more information
If you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
parse-server's session object properties can be updated by foreign user if object ID is known
Advisory: GHSA-6w4q-23cf-j9jp
Aliases: CVE-2022-39225
Published: 2022-09-21T18:32:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

### Impact

A foreign user can write to the session object of another user if the session object ID is known. For example, a foreign user can assign the session object to their own user by writing to the `user` field and then read any custom fields of that session object.

Note that assigning a session to a foreign user does not usually change the privileges of neither of the two users, according to how Parse Server uses session objects internally. However, if custom logic is used to relate specific session objects to privileges this vulnerability may have a higher level of severity.

The vulnerability does not allow a foreign user to assign a session object to themselves, read the session token, and then reassign the session object to the original user to then authenticate as that user with the known session token. The vulnerability only exists for foreign session objects, a user cannot assign their own session to another user.

While it is unlikely that the session object ID of another user is known, it is possible to brute-force guess an object ID, even though the attacker would not know to which user a successfully guessed session object ID belongs.

### Patches

The fix prevents writing to foreign session objects, even if the session object ID is known.

### Workarounds

Add a `beforeSave` trigger to the `_Session` class and prevent writing if the requesting user is different from the user in the session object.

### References

- GitHub advisory [GHSA-6w4q-23cf-j9jp](https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp)
Apache Batik vulnerable to Server-Side Request Forgery
Advisory: GHSA-53jm-3hc9-fqqc
Aliases: CVE-2022-38648
Published: 2022-09-23T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.
Gophish before 0.12.0 vulnerable to Open Redirect
Advisory: GHSA-hvw3-p9px-gpc9
Aliases: CVE-2022-25295
Published: 2022-09-12T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

This affects the package github.com/gophish/gophish before 0.12.0. The Open Redirect vulnerability exists in the next query parameter. The application uses url.Parse(r.FormValue("next")) to extract path and eventually redirect user to a relative URL, but if next parameter starts with multiple backslashes like \\\\\\example.com, browser will redirect user to http://example.com.
Project Wonder WebObjects vulnerable to Arbitrary HTTP Header Injection and Cross-site Scripting
Advisory: GHSA-xv7r-9vq4-9wrq
Aliases: CVE-2022-37724
Published: 2022-09-15T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Project Wonder WebObjects 1.0 through 7.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available at commit number b0d2d74f13203268ea254b02552600850f28014b.
Weight not properly refunded after EVM execution
Advisory: GHSA-v57h-6hmh-g2p4
Aliases: CVE-2022-39242
Published: 2022-09-23T22:07:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact

Previously, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can construct blocks with transactions that have large amount of refunds or unused gases with reverts, and as a result inflate up the chain gas prices. This issue is fixed by properly refund unused weights after each EVM execution.

The impact of this issue is limited in that the spamming attack would still be costly for any adversary, and it has no ability to alter any chain state. 

### Patches

The issue is fixed in https://github.com/paritytech/frontier/pull/851

### Workarounds

None.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Frontier repo](https://github.com/paritytech/frontier/issues)
* Email [Wei](mailto:wei@that.world)
steal vulnerable to Regular Expression Denial of Service via input variable
Advisory: GHSA-7f3x-2wcx-hww8
Aliases: CVE-2022-37260
Published: 2022-09-16T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal via the input variable in main.js.
TYPO3 CMS vulnerable to User Enumeration via Response Timing
Advisory: GHSA-m392-235j-9r7r
Aliases: CVE-2022-36105
Published: 2022-09-16T17:16:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
It has been discovered that observing response time during user authentication (backend and frontend) can be used to distinguish between existing and non-existing user accounts.

Extension authors of 3rd party TYPO3 extensions providing a custom authentication service should check if the extension is affected by the described problem. Affected extensions must implement new `MimicServiceInterface::mimicAuthUser`, which simulates corresponding times regular processing would usually take.

### Solution
Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above.

### Credits
Thanks to Vautia who reported this issue and to TYPO3 core & security team members Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2022-007](https://typo3.org/security/advisory/typo3-core-sa-2022-007)
* [Vulnerability Report on huntr.dev](https://huntr.dev/bounties/7d519735-2877-4fad-bd77-accde3e290a7/) (embargoed +30 days)
rdiffweb CSRF could lead to disabling notifications in user profile
Advisory: GHSA-9vxf-mcm6-5m42
Aliases: CVE-2022-3233
Published: 2022-09-22T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

rdiffweb prior to 2.4.6 is vulnerable to Cross-Site Request Forgery (CSRF), which could lead to disabling notifications in a user's profile.
Moodle Cross-site Scripting vulnerability
Advisory: GHSA-fm6m-fg23-67jq
Aliases: CVE-2021-36568
Published: 2022-09-14T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11.x prior to 3.11.10, Moodle 3.10.4, and Moodle 3.9.7.
rdiffweb vulnerable to Use of Cache Containing Sensitive Information
Advisory: GHSA-7fqm-jm52-f9vc
Aliases: CVE-2022-3292
Published: 2022-09-29T00:00:19Z

rdiffweb prior to version 2.4.9 is vulnerable to Use of Cache Containing Sensitive Information. Due to improper cache control, an attacker can view sensitive information even if they are not logged into an account. Version 2.4.9 contains a patch for this issue.
Budibase Improper Access Control vulnerability
Advisory: GHSA-x92g-49gh-63qm
Aliases: CVE-2022-3225
Published: 2022-09-17T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Improper Access Control in GitHub repository budibase/budibase prior to 1.3.20.
TensorFlow vulnerable to `CHECK` fail in `Save` and `SaveSlices`
Advisory: GHSA-m6vp-8q9j-whx4
Aliases: CVE-2022-35983
Published: 2022-09-16T22:31:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK` fail that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
filename = tf.constant("")
tensor_names = tf.constant("")
# Save
data = tf.cast(tf.random.uniform(shape=[1], minval=-10000, maxval=10000, dtype=tf.int64, seed=-2021), tf.uint64)
tf.raw_ops.Save(filename=filename, tensor_names=tensor_names, data=data, )
# SaveSlices
shapes_and_slices = tf.constant("")
data = tf.cast(tf.random.uniform(shape=[1], minval=-10000, maxval=10000, dtype=tf.int64, seed=9712), tf.uint32)
tf.raw_ops.SaveSlices(filename=filename, tensor_names=tensor_names, shapes_and_slices=shapes_and_slices, data=data, )
```

### Patches
We have patched the issue in GitHub commit [5dd7b86b84a864b834c6fa3d7f9f51c87efa99d4](https://github.com/tensorflow/tensorflow/commit/5dd7b86b84a864b834c6fa3d7f9f51c87efa99d4).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Di Jin, Secure Systems Labs, Brown University
Parsing issue in matrix-org/node-irc leading to room takeovers
Advisory: GHSA-xvqg-mv25-rwvw
Aliases: CVE-2022-39203
Published: 2022-09-15T03:26:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel.

### Patched

The vulnerability has been patched in matrix-appservice-irc 0.35.0.

### Workarounds

Disable dynamic channel joining via `dynamicChannels.enabled` to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config.

### References

- https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity

### Credits

Discovered and reported by [Val Lorentz](https://valentin-lorentz.fr/).

### For more information

If you have any questions or comments about this advisory email us at [security@matrix.org](mailto:security@matrix.org).
Improper beacon events in matrix-js-sdk can result in availability issues
Advisory: GHSA-hvv8-5v86-r45x
Aliases: CVE-2022-39236
Published: 2022-09-29T14:36:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

### Impact
Improperly formed beacon events (from [MSC3488](https://github.com/matrix-org/matrix-spec-proposals/pull/3488)) can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer.

### Patches
This is patched in matrix-js-sdk v19.7.0

### Workarounds
Redacting applicable events, waiting for the sync processor to store data, and restarting the client can often fix it. Alternatively, redacting the applicable events and clearing all storage will fix the further perceived issues.

Downgrading to an unaffected version, noting that such a version may be subject to other vulnerabilities, will additionally resolve the issue.

### References
N/A - This was a logic error in the SDK.

### For more information
If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).
snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds Write
Advisory: GHSA-hhhw-99gj-p3c3
Aliases: CVE-2022-38750
Published: 2022-09-06T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Missing permission checks in Jenkins CONS3RT Plugin allow capturing credentials
Advisory: GHSA-74x9-fhc2-p79f
Aliases: CVE-2022-41254
Published: 2022-09-22T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
Advisory: GHSA-xpvp-h73c-m9rq
Aliases: CVE-2022-41224
Published: 2022-09-22T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the `l:helpIcon` UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.

As of publication, the Jenkins security team is unaware of any exploitable help icon/tooltip in Jenkins core or plugins published by the Jenkins project. The vast majority of help icons use the `l:help` component instead of l:helpIcon. The few known instances of `l:helpIcon` do not have user-controllable tooltip contents.
TensorFlow vulnerable to null dereference on MLIR on empty function attributes
Advisory: GHSA-fqxc-pvf8-2w9v
Aliases: CVE-2022-36000
Published: 2022-09-16T22:09:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
`Eig` can be fed an incorrect `Tout` input, resulting in a `CHECK` fail that can trigger a denial of service attack.
```python
import tensorflow as tf
import numpy as np 
arg_0=tf.constant(value=np.random.random(size=(2, 2)), shape=(2, 2), dtype=tf.float32)
arg_1=tf.complex128
arg_2=True
arg_3=''
tf.raw_ops.Eig(input=arg_0, Tout=arg_1, compute_v=arg_2, name=arg_3)
```

### Patches
We have patched the issue in GitHub commit [aed36912609fc07229b4d0a7b44f3f48efc00fd0](https://github.com/tensorflow/tensorflow/commit/aed36912609fc07229b4d0a7b44f3f48efc00fd0).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by 刘力源, Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology.
Denial of Service due to parser crash
Advisory: GHSA-3f7h-mf4q-vrm4
Aliases: CVE-2022-40152
Published: 2022-09-17T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Those using FasterXML/woodstox to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

This vulnerability is only relevant for users making use of the DTD parsing functionality.
OctoPrint vulnerable to Insufficient Session Expiration.
Advisory: GHSA-937f-qh3w-6g87
Aliases: CVE-2022-2888
Published: 2022-09-22T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. This issue is fixed in version 1.8.3.