deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-jm35-h8q2-73mp
Package: devise-two-factor (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
Vulnerable versions: < 4.0.2
Patched in: 4.0.2

Summary: Improper one time password handling in devise-two-factor

Details:
### Impact
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.
 
### Patches
This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.

### Credit for discovery
Benoit Côté-Jodoin
Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106
GitHub Security Advisory: GHSA-fp4w-jxhp-m23p
Package: bundler (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
Vulnerable versions: >= 2.2.11, < 2.2.18
Patched in: 2.2.18

Summary: Dependency Confusion in Bundler

Details:
Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.
GitHub Security Advisory: GHSA-7627-mp87-jf6q
Package: cocoapods-downloader (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: >= 1.6.2, < 1.6.3
Patched in: 1.6.3

Summary: Command injection in cocoapods-downloader

Details:
The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
GitHub Security Advisory: GHSA-7627-mp87-jf6q
Package: cocoapods-downloader (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: < 1.6.0
Patched in: 1.6.0

Summary: Command injection in cocoapods-downloader

Details:
The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
GitHub Security Advisory: GHSA-g397-v4w5-4m79
Package: cocoapods-downloader (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: < 1.6.2
Patched in: 1.6.2

Summary: Command injection in cocoapods-downloader

Details:
The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
GitHub Security Advisory: GHSA-v222-6mr4-qj29
Package: asciidoctor-include-ext (RUBYGEMS)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 0.4.0
Patched in: 0.4.0

Summary: Command Injection vulnerability in asciidoctor-include-ext

Details:
### Impact

Applications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor) with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext) (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. ~~This attack is possible even when `allow-uri-read` is disabled!~~ (EDIT: it’s not)


### Patches

The vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).

### Workarounds

```rb
require 'asciidoctor/include_ext'

class Asciidoctor::IncludeExt::IncludeProcessor
  # Overrides superclass private method to mitigate Command Injection
  # vulnerability in asciidoctor-include-ext <0.4.0.
  def target_uri?(target)
    target.downcase.start_with?('http://', 'https://') \
      && URI.parse(target).is_a?(URI::HTTP)
  rescue URI::InvalidURIError
    false
  end
end
```

### References

* https://sakurity.com/blog/2015/02/28/openuri.html

### Credits

This vulnerability was discovered by Joern Schneeweisz from the GitLab Security Research Team.


### For more information

See commit message c7ea001.

If you have any questions or comments about this advisory open an issue in [jirutka/asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext/issues/).
GitHub Security Advisory: GHSA-h99w-9q5r-gjq9
Package: puma (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: < 4.3.12
Patched in: 4.3.12

Summary: Puma vulnerable to HTTP Request Smuggling

Details:
When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.

The following vulnerabilities are addressed by this advisory:
- Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings should be rejected and the final encoding must be `chunked`.
- Lenient parsing of malformed `Content-Length` headers and chunk sizes, when only digits and hex digits should be allowed.
- Lenient parsing of duplicate `Content-Length` headers, when they should be rejected.
- Lenient parsing of the ending of chunked segments, when they should end with `\r\n`.

The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. 

These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves.

- Nginx (latest)
- Apache (latest)
- Haproxy 2.5+
- Caddy (latest)
- Traefik (latest)
GitHub Security Advisory: GHSA-h99w-9q5r-gjq9
Package: puma (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 5.0.0, < 5.6.4
Patched in: 5.6.4

Summary: Puma vulnerable to HTTP Request Smuggling

Details:
When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.

The following vulnerabilities are addressed by this advisory:
- Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings should be rejected and the final encoding must be `chunked`.
- Lenient parsing of malformed `Content-Length` headers and chunk sizes, when only digits and hex digits should be allowed.
- Lenient parsing of duplicate `Content-Length` headers, when they should be rejected.
- Lenient parsing of the ending of chunked segments, when they should end with `\r\n`.

The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. 

These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves.

- Nginx (latest)
- Apache (latest)
- Haproxy 2.5+
- Caddy (latest)
- Traefik (latest)
GitHub Security Advisory: GHSA-69p3-xp37-f692
Package: kubeclient (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 4.9.3
Patched in: 4.9.3

Summary: Improper Certificate Validation in kubeclient

Details:
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
GitHub Security Advisory: GHSA-vvff-6wrr-4g7q
Package: foreman_ansible (RUBYGEMS)
Severity: HIGH (CVSS 8.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 2.0.0
Patched in: 2.0.0

Summary: Missing Authentication for Critical Function in Foreman Ansible

Details:
An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
GitHub Security Advisory: GHSA-6mq2-37j5-w6r6
Package: webrick (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 1.3.1
Patched in: 1.4.0

Summary: WEBrick Improper Input Validation vulnerability

Details:
WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
GitHub Security Advisory: GHSA-w749-p3v6-hccq
Package: activestorage (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 7.0.0, <= 7.0.2.2
Patched in: 7.0.2.3

Summary: Possible code injection vulnerability in Rails / Active Storage

Details:
The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.
GitHub Security Advisory: GHSA-w749-p3v6-hccq
Package: activestorage (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 6.1.0, <= 6.1.4.6
Patched in: 6.1.4.7

Summary: Possible code injection vulnerability in Rails / Active Storage

Details:
The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.
GitHub Security Advisory: GHSA-w749-p3v6-hccq
Package: activestorage (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 6.0.0, <= 6.0.4.6
Patched in: 6.0.4.7

Summary: Possible code injection vulnerability in Rails / Active Storage

Details:
The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.
GitHub Security Advisory: GHSA-w749-p3v6-hccq
Package: activestorage (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 5.2.0, <= 5.2.6.2
Patched in: 5.2.6.3

Summary: Possible code injection vulnerability in Rails / Active Storage

Details:
The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.
GitHub Security Advisory: GHSA-5629-8855-gf4g
Package: solidus_core (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-305: Authentication Bypass by Primary Weakness, CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 3.1.0, < 3.1.3
Patched in: 3.1.3

Summary: Authentication Bypass by CSRF Weakness 

Details:
### Impact
The actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end.

### Patches
For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`.

### Workarounds
Look at the workarounds described at [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### References
- [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
GitHub Security Advisory: GHSA-5629-8855-gf4g
Package: solidus_core (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-305: Authentication Bypass by Primary Weakness, CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 3.0.0, < 3.0.3
Patched in: 3.0.3

Summary: Authentication Bypass by CSRF Weakness 

Details:
### Impact
The actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end.

### Patches
For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`.

### Workarounds
Look at the workarounds described at [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### References
- [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
GitHub Security Advisory: GHSA-5629-8855-gf4g
Package: solidus_core (RUBYGEMS)
Severity: CRITICAL (CVSS 9.3)
CWE: CWE-305: Authentication Bypass by Primary Weakness, CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2.11.12
Patched in: 2.11.12

Summary: Authentication Bypass by CSRF Weakness 

Details:
### Impact
The actual vulnerability has been discovered on `solidus_auth_devise`. See [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2) for details.

The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update `solidus_auth_devise`. For this reason, it has been marked as low impact on this end.

### Patches
For extra security, update `solidus_core` to versions `3.1.3`, `3.0.3` or `2.11.12`.

### Workarounds
Look at the workarounds described at [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### References
- [GHSA-xm34-v85h-9pg2](https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
GitHub Security Advisory: GHSA-x24j-87x9-jvv5
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-669: Incorrect Resource Transfer Between Spheres, CWE-863: Incorrect Authorization
Vulnerable versions: >= 9.0.0.pre1, < 9.2.5
Patched in: 9.2.5

Summary: Publify `guest` role users can self-register even when the admin does not allow it

Details:
In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. `guest` role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.
GitHub Security Advisory: GHSA-cm9w-c4rj-r2cf
Package: view_component (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.32.0, < 2.49.1
Patched in: 2.49.1

Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component

Details:
This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display.

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github/view_component](http://github.com/github/view_component) project
GitHub Security Advisory: GHSA-cm9w-c4rj-r2cf
Package: view_component (RUBYGEMS)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.31.0, < 2.31.2
Patched in: 2.31.2

Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component

Details:
This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display.

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github/view_component](http://github.com/github/view_component) project
GitHub Security Advisory: GHSA-cxf7-qrc5-9446
Package: image_processing (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-20: Improper Input Validation, CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 1.12.2
Patched in: 1.12.2

Summary: Remote shell execution vulnerability in image_processing

Details:
### Impact

When using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

```rb
ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED
```

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

### Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

### Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

```rb
operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)
```
GitHub Security Advisory: GHSA-w542-cpp9-r3g7
Package: field_test (RUBYGEMS)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 0.2.0, <= 0.3.2
Patched in: 0.4.0

Summary: Field Test CSRF vulnerability

Details:
The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods in versions v0.2.0 through v0.3.2.

## Impact
The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods, like basic authentication. Session-based authentication methods (like Devise's default authentication) are not affected.

A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, a single endpoint is affected, which allows for changing the variant assigned to a user.

All users running an affected release should upgrade immediately.

## Technical Details
Field Test uses the `protect_from_forgery` method from Rails to prevent CSRF. However, this defaults to `:null_session`, which has no effect on non-session based authentication methods. This has been changed to `protect_from_forgery with: :exception`.
GitHub Security Advisory: GHSA-jrfj-98qg-qjgv
Package: sidekiq (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 5.2.10
Patched in: 5.2.10

Summary: Denial of service in sidekiq

Details:
In `api.rb` in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
GitHub Security Advisory: GHSA-jrfj-98qg-qjgv
Package: sidekiq (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 6.0.0, < 6.4.0
Patched in: 6.4.0

Summary: Denial of service in sidekiq

Details:
In `api.rb` in Sidekiq before 6.4.0 and 5.2.10, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.