TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-xxq4-3742-3h28
Summary: Generation of Error Message Containing Sensitive Information in microweber
Aliases: CVE-2022-0504
Severity: MODERATE
CWE: CWE-209
Published: 2022-02-09T00:00:31Z

microweber version 1.2.10 and prior may generate an error message containing sensitive information.
Vulnerability: GHSA-44cg-qcpr-fwjh
Summary: Cross site scripting in francoisjacquet/rosariosis
Aliases: CVE-2021-44565
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-25T00:01:07Z

A Cross Site Scripting (XSS) vulnerabilty exits in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php, which allows remote malicious users to inject arbitrary JaveScript of HTML.An example of affected components are all Markdown input fields.
Vulnerability: GHSA-3c33-3465-fhx2
Summary: Exposure of Resource to Wrong Sphere in LibreNMS
Aliases: CVE-2020-15877
Severity: HIGH
CWE: CWE-668
Published: 2021-09-08T17:27:16Z

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
Vulnerability: GHSA-455w-gv5p-wgg3
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0260
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-26T22:10:48Z

pimcore is vulnerable to Stored XSS at Name field in the setting tab of the Global Targeting Rules.
Vulnerability: GHSA-4574-qv3w-fcmg
Summary:  Deserialization of Untrusted Data in codeception/codeception
Aliases: CVE-2021-23420
Severity: CRITICAL
CWE: CWE-502
Published: 2021-09-01T18:36:15Z

This affects the package codeception/codeception from 4.0.0 before 4.1.22 and before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.
Vulnerability: GHSA-g9rq-x4fj-f5hx
Summary: Remote Code Execution Through Image Uploads in BookStack
Aliases: CVE-2020-5256
Severity: HIGH
CWE: CWE-95
Published: 2020-03-13T20:21:27Z

### Impact

A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process.

This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. 

### Patches

The issue was addressed in a series of patches: v0.25.3, v0.25.4 and v0.25.5.
Users should upgrade to at least v0.25.5 to avoid this patch but ideally the latest BookStack version as previous versions are un-supported.

### Workarounds

Depending on BookStack version, you could use the [local_secure](https://www.bookstackapp.com/docs/admin/upload-config/#local-secure) image storage option, or use s3 or a similar compatible service.

Preventing direct execution of any `php` files, apart from the `public/index.php` file, though web-server configuration would also prevent this.

### References

[BookStack Beta v0.25.3](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3)
[BookStack Beta v0.25.4](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4)
[BookStack Beta v0.25.5](https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the BookStack GitHub repository](BookStackApp/BookStack/issues).
* Ask on the [BookStack Discord chat](https://discord.gg/ztkBqR2).
* Follow the [BookStack Security advise](https://github.com/BookStackApp/BookStack#-security) to contact someone privately.
Vulnerability: GHSA-wq4r-8342-jmc9
Summary: SQL injection in vhs (aka VHS: Fluid ViewHelpers)
Aliases: CVE-2021-28381
Severity: CRITICAL
CWE: CWE-89
Published: 2021-03-29T20:24:44Z

The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.
Vulnerability: GHSA-m6j4-8r7p-wpp3
Summary: BuddyPress privilege escalation via REST API
Aliases: CVE-2021-21389
Severity: HIGH
CWE: CWE-863
Published: 2021-10-06T17:46:55Z

### Impact
It's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the BuddyPress REST API members endpoint.

### Patches
The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

### References
https://buddypress.org/2021/03/buddypress-7-2-1-security-release/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [HackerOne](https://hackerone.com/wordpress)
Vulnerability: GHSA-6r86-2jm9-9mh4
Summary: File upload restriction bypass in Zenario CMS
Aliases: CVE-2022-23043
Severity: HIGH
CWE: CWE-434
Published: 2022-02-25T00:01:07Z

Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.
Vulnerability: GHSA-pc32-x737-74cv
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0704
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-17T00:00:48Z

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Vulnerability: GHSA-w267-m9c4-8555
Summary: Shopware user session is not logged out if the password is reset via password recovery
Aliases: CVE-2022-24744
Severity: LOW
CWE: CWE-613
Published: 2022-03-10T17:37:43Z

### Impact
User session is not logged out if the password is reset via password recovery

## Patches
Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-f884-gm86-cg3q
Summary: PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841
Severity: HIGH
Published: 2020-01-07T17:20:47Z

### Impact

We have identified that some ps_facetedsearch module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

### Patches

In the [security patch](https://github.com/PrestaShop/ps_facetedsearch/releases/tag/v3.4.1), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com
Vulnerability: GHSA-7r79-mrp6-8mhq
Summary: Rate limit missing in microweber
Aliases: CVE-2022-0777
Severity: HIGH
CWE: CWE-640
Published: 2022-03-02T00:00:19Z

Microweber prior to version 1.3 does not rate limit password reset emails.
Vulnerability: GHSA-4pc3-96mx-wwc8
Summary: Remote code execution in PHPMailer
Aliases: CVE-2016-10045
Severity: CRITICAL
CWE: CWE-77
Published: 2020-03-05T22:09:14Z

### Impact
The `isMail` transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the `mail` command and consequently execute arbitrary code by leveraging improper interaction between the `escapeshellarg` function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

This issue really emphasises that it&#39;s worth avoiding the built-in PHP `mail()` function entirely.

### Patches
Fixed in 5.2.20

### Workarounds
Send via SMTP to localhost instead of calling the `mail()` function.

### References
https://nvd.nist.gov/vuln/detail/CVE-2016-10045
See also https://nvd.nist.gov/vuln/detail/CVE-2016-10033

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-xcr3-4qvr-54rh
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-1351
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-15T00:00:45Z

Pimcore prior to version 10.4 is vulnerable to stored cross-site scripting in Tooltip.
Vulnerability: GHSA-g39q-f4rm-85x4
Summary: OS Command Injection in baserCMS
Aliases: CVE-2021-20682
Severity: HIGH
CWE: CWE-78
Published: 2021-06-08T20:10:37Z

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors.
Vulnerability: GHSA-x8wj-6m73-gfqp
Summary: Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle
Aliases: CVE-2020-5237
Severity: HIGH
CWE: CWE-23, CWE-22
Published: 2020-02-18T18:59:24Z

### Impact
The vulnerability was identified in the web service for a chunked file
upload. While the names of the POST parameters vary with the used
frontend, their values are always used in the same way to build a path
where the chunks are stored and assembled temporarily. By not validating
these parameters properly, OneupUploaderBundle is susceptible to a path
traversal vulnerability which can be exploited to upload files to
arbitrary folders on the filesystem. The assembly process can further be
misused with some restrictions to delete and copy files to other
locations.

The vulnerability can be exploited by any users that have legitimate
access to the upload functionality and can lead to arbitrary code
execution, denial of service and disclosure of confidential information.

### Patches
Yes, see version 1.9.3 and 2.1.5.

### References
https://owasp.org/www-community/attacks/Path_Traversal

### Credits:
This security vulnerability was found by Thibaud Kehler of SySS GmbH.
E-Mail: thibaud.kehler@syss.de
Vulnerability: GHSA-xh99-hw7h-wf63
Summary: Unchecked validity of Facing values in PlayerActionPacket
Severity: HIGH
Published: 2022-01-13T22:25:44Z

### Impact
A remote attacker may crash a server by sending `PlayerActionPacket` with invalid facing values (e.g. negative), specifically with `START_BREAK` or `CRACK_BLOCK` actions, or with a `UseItemTransactionData` (typically in `InventoryTransactionPacket`).

### Patches
f126479c37ff00a717a828f5271cf8e821d12d6c

### Workarounds
Using a plugin, cancel `DataPacketReceiveEvent` if the packet is `PlayerActionPacket` and the facing is outside the range 0-5 when receiving START_BREAK or CRACK_BLOCK actions, or UseItemTransactionData. However, beware that negative values may be legitimate in some cases.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-qw36-p97w-vcqr
Summary: Cookie persistence after password changes in symfony/security-bundle
Aliases: CVE-2021-41268
Severity: MODERATE
CWE: CWE-384
Published: 2021-11-24T20:05:22Z

Description
-----------

Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password. 

Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.

Resolution
----------

Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc) for branch 5.3.

Credits
-------

We would like to thank Thibaut Decherit for reporting the issue and Wouter J for fixing the issue.
Vulnerability: GHSA-jh5x-hfhg-78jq
Summary: Deserialization of Untrusted Data in Archive_Tar
Aliases: CVE-2020-28948
Severity: HIGH
CWE: CWE-502
Published: 2021-04-22T16:20:50Z

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. See: https://github.com/pear/Archive_Tar/issues/33
Vulnerability: GHSA-8wcc-f2vq-h4gx
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0370
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T23:06:22Z

Stored XSS is found in Settings>Live help configuration>Personal Theme>static content. Under the NAME field put a payload {{constructor.constructor('alert(1)')()}} while creating content, and you will see that the input gets stored, and every time the user visits, the payload gets executed.
Vulnerability: GHSA-w6j8-jc36-x5q9
Summary: Improper Neutralization of Text-Values in Object Version Preview
Aliases: CVE-2021-39166
Severity: HIGH
CWE: CWE-79
Published: 2021-09-01T18:22:09Z

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources.
Vulnerability: GHSA-c697-r227-pq6h
Summary: Unrestricted Upload of File with Dangerous Type in pimcore
Aliases: CVE-2022-0263
Severity: HIGH
CWE: CWE-434
Published: 2022-01-21T23:33:58Z

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore
Vulnerability: GHSA-gp6w-ccqv-p7qr
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3729
Severity: MODERATE
CWE: CWE-352
Published: 2021-08-25T14:49:58Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-hx6g-q9v2-xh7v
Summary: Information exposure in elgg
Aliases: CVE-2021-3980
Severity: HIGH
CWE: CWE-359
Published: 2021-12-16T15:30:48Z

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'.
Vulnerability: GHSA-gxmc-5wj3-jx64
Summary: Cross-site scripting in application/controllers/dropbox.php in JustWriting
Aliases: CVE-2021-41467
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-04T20:13:25Z

Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
Vulnerability: GHSA-p48w-vf3c-rqjx
Summary: Cross-Site Scripting in Bootstrap Package
Aliases: CVE-2021-21365
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-29T21:51:21Z

### Problem
It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

The following templates are affected by the vulnerability:

* `Resources/Private/Partials/ContentElements/Carousel/Item/CallToAction.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/Header.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/Text.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/TextAndImage.html`
* `Resources/Private/Partials/ContentElements/Header/SubHeader.html`

Users of the extension, who have overwritten  the affected templates with custom code must manually apply the security fix as shown in [this Git commit](https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b).

### Solution
Update to version 7.1.2, 8.0.8, 9.0.4, 9.1.3, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described.

Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.
Vulnerability: GHSA-mhfv-8rc9-w38c
Summary: Arbitrary shell execution
Severity: HIGH
Published: 2022-03-26T00:06:00Z

Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
Vulnerability: GHSA-536p-4pcj-5mr9
Summary: raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
Aliases: CVE-2021-38557
Severity: HIGH
CWE: CWE-732, CWE-276
Published: 2021-09-02T17:10:52Z

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.
Vulnerability: GHSA-93wh-35r4-6qmw
Summary: Exposure of Sensitive Information to an Unauthorized Actor in moodle
Aliases: CVE-2021-20281
Severity: MODERATE
CWE: CWE-200
Published: 2021-03-29T20:43:23Z

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Vulnerability: GHSA-g475-pch5-6wvv
Summary: Authentication bypass in MAGMI
Aliases: CVE-2020-5777
Severity: CRITICAL
CWE: CWE-287
Published: 2021-05-06T18:54:35Z

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections (default 151) is lower than Apache (or another web server) setting MaxRequestWorkers (formerly MaxClients) (default 256). This can be done by sending at least 151 simultaneous requests to the Magento website to trigger a "Too many connections" error, then use default magmi:magmi basic authentication to remotely bypass authentication.
Vulnerability: GHSA-f6p7-8xfw-fjqq
Summary: Authenticated Stored XSS in Administration
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-21T14:29:26Z

### Impact
Authenticated Stored XSS in Administration

### Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
Vulnerability: GHSA-277v-gwfr-hmpj
Summary: Missing Authentication for Critical Function in LibreNMS
Aliases: CVE-2019-10668
Severity: MODERATE
CWE: CWE-306
Published: 2019-10-11T18:43:06Z

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.
Vulnerability: GHSA-4hjq-422q-4vpx
Summary: Secret data exfiltration via symfony parameters
Aliases: CVE-2021-27908
Severity: MODERATE
CWE: CWE-732
Published: 2021-04-06T17:20:58Z

### Impact
Symfony parameters (which is what Mautic transforms configuration parameters into) can be used within other Symfony parameters by design. However, this also means that an admin who is normally not privy to certain parameters, such as database credentials, could expose them by leveraging any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.

For example,

1. Go to Configuration page -> Landing Page Settings -> Analytics script and enter this: <`script> console.log("db password is: %mautic.db_password%"); </script>`
2. Visit any landing page and open the JS dev console. You will see the following message with real instance db password: `db password is: <real password>`

Risk rating: ModerateCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

### Patches
Upgrade to 3.3.2

### Workarounds
No

### References
No

### For more information
If you have any questions or comments about this advisory:

* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-wg4r-q74r-p7c8
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0941
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:01:03Z

ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-xwjr-6fj7-fc6h
Summary: Local File Inclusion by unauthenticated users
Aliases: CVE-2020-15246
Severity: HIGH
CWE: CWE-863, CWE-22
Published: 2020-11-23T19:48:12Z

### Impact
An attacker can exploit this vulnerability to read local files on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request.

### Patches
Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

### Workarounds
Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1105" alt="Screen Shot 2020-10-10 at 1 05 19 PM" src="https://user-images.githubusercontent.com/7253840/95663086-4ffc4780-0af9-11eb-9bb6-fd40cf11c033.png">
Vulnerability: GHSA-4mg9-vhxq-vm7j
Summary: SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
Severity: HIGH
CWE: CWE-89
Published: 2021-04-29T21:52:53Z

### Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

### Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

### Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.
Vulnerability: GHSA-x7hc-x7fm-f7qh
Summary: Cross-Site Scripting in Content Preview (CType menu)
Aliases: CVE-2021-21370
Severity: LOW
CWE: CWE-79
Published: 2021-03-23T01:54:17Z

> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.1)
> * CWE-79
> * Status: **DRAFT**

### Problem
It has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-008](https://typo3.org/security/advisory/typo3-core-sa-2021-008)
Vulnerability: GHSA-r5gm-4p5w-pq2p
Summary: Remote code execution in verot/class.upload.php
Aliases: CVE-2019-19576
Severity: CRITICAL
CWE: CWE-434
Published: 2020-01-16T22:17:40Z

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
Vulnerability: GHSA-rwqq-p4p9-5wpq
Summary: Wechat-php-sdk is affected by a Cross Site Scripting vulnerability.
Aliases: CVE-2021-43678
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-07T00:00:29Z

Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.
Vulnerability: GHSA-q7j5-9j77-g4gq
Summary: Remote code execution in turn extension for TYPO3
Aliases: CVE-2020-15515
Severity: HIGH
CWE: CWE-74
Published: 2020-07-29T18:07:41Z

The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.
Vulnerability: GHSA-59cf-m7v5-wh5w
Summary: Cross-Site Scripting in SVG Sanitizer
Aliases: CVE-2020-11070
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-13T22:17:34Z

Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting.

An updated version 1.0.3 is available from the TYPo3 extension manager and at https://extensions.typo3.org/extension/download/svg_sanitizer/1.0.3/zip/
Users of the extension are advised to update the extension as soon as possible.
Vulnerability: GHSA-h7qw-mxrm-c6h2
Summary: Unauthenticated crypto and weak IV in Magento\Framework\Encryption
Aliases: CVE-2016-6485
Severity: HIGH
CWE: CWE-327
Published: 2019-11-20T01:33:05Z

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
Vulnerability: GHSA-97cc-825c-399g
Summary: Cross site scripting in remdex/livehelperchat
Aliases: CVE-2021-4050
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-10T20:33:29Z

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-m5vx-8chx-qvmm
Summary: Form validation can be skipped
Aliases: CVE-2021-32697
Severity: MODERATE
CWE: CWE-20
Published: 2021-06-22T15:15:08Z

### Impact
By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators.
We consider the severity _low_ because it is not possible to _change_ any form values since the form state is secured with an HMAC that is still verified.
That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent.

### Patches
https://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246

### Workarounds
Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data.
Alternatively a custom Finisher can be added as first finisher.

### References
This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567
Original report: https://tickets.neos.io/#ticket/zoom/411 (internal)
Vulnerability: GHSA-mrvj-7q4f-5p42
Summary: Cross-site scripting in eZ Platform Kernel
Severity: HIGH
CWE: CWE-79
Published: 2021-03-19T19:56:42Z

### Impact
In file upload it is possible by certain means to upload files like .html and .js. These may contain XSS exploits which will be run when links to them are accessed by victims.

### Patches
The fix consists simply of adding common types of scriptable file types to the configuration of the already existing filetype blacklist feature. See "Patched versions". As such, this can also be done manually, without installing the patched versions. This may be relevant if you are currently running a considerably older version of the kernel package and don't want to upgrade it at this time. Please see the settting "ezsettings.default.io.file_storage.file_type_blacklist" at:
https://github.com/ezsystems/ezplatform-kernel/blob/master/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml#L109

### Important note
You should adapt this setting to your needs. Do not add file types to the blacklist that you actually need to be able to upload. For instance, if you need your editors to be able to upload SVG files, then don't blacklist that. Instead, you could e.g. use an approval workflow for such content.
Vulnerability: GHSA-jj8r-p9f5-fmvv
Summary: Cross-site Scripting in TYPO3 extension
Aliases: CVE-2021-36785
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-30T17:22:25Z

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.
Vulnerability: GHSA-w7r7-r8r9-vrg2
Summary: Session fixation in change password form
Aliases: CVE-2019-12203
Severity: MODERATE
CWE: CWE-384
Published: 2019-11-12T23:01:39Z

SilverStripe through 4.3.3 allows session fixation in the "change password" form.
Vulnerability: GHSA-pj4j-287j-f742
Summary: Cross-site Scripting in Contao
Aliases: CVE-2018-10125
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T20:49:48Z

Contao before 4.5.7 has XSS in the system log.
Vulnerability: GHSA-hxmr-5gv9-6p8v
Summary: Cross-site Scripting in librenms
Aliases: CVE-2022-0575
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-15T00:02:47Z

Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-g3h8-cg9x-47qw
Summary: PHP Phar archives could be uploaded by Panel users as content files and executed in Kirby
Aliases: CVE-2020-26255
Severity: LOW
CWE: CWE-434
Published: 2020-12-08T14:42:08Z

### Impact

An editor with full access to the Kirby Panel can upload a PHP `.phar` file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file.

Visitors without Panel access *cannot* use this attack vector.

### Patches

The problem has been patched in [Kirby 2.5.14](https://github.com/getkirby-v2/panel/releases/tag/2.5.14) and [Kirby 3.4.5](https://github.com/getkirby/kirby/releases/tag/3.4.5). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases/) to fix the vulnerability.

**Note:** Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

### Workarounds

Kirby 2 sites on older releases can also be patched by applying the [changes from this commit](https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881).

### Credits

Thanks to Thore Imhof of Accenture for reporting the problem.
Vulnerability: GHSA-mxr5-mc97-63rc
Summary: Account Takeover in Octobercms
Aliases: CVE-2021-32648
Severity: HIGH
CWE: CWE-287
Published: 2021-08-30T16:13:02Z

### Impact

An attacker can request an account password reset and then gain access to the account using a specially crafted request.

- To exploit this vulnerability, an attacker must know the username of an administrator and have access to the password reset form.

### Patches

- Issue has been patched in Build 472 and v1.1.5
- [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648)

### Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[**Update 2022-01-20**] [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648) can be found here.

### Recommendations

We recommend the following steps to make sure your server stays secure:

- Keep server OS and system software up to date.
- Keep October CMS software up to date.
- Use a multi-factor authentication plugin.
- Change the [default backend URL](https://github.com/octobercms/october/blob/1.1/config/cms.php#L39) or block public access to the backend area.
- Include the [Roave/SecurityAdvisories](https://github.com/Roave/SecurityAdvisories) Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

### References

Bugs found as part of Solar Security CMS Research. Credits to:
• Andrey Basarygin
• Andrey Guzei
• Mikhail Khramenkov
• Alexander Sidukov
• Maxim Teplykh

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-9f8f-574q-8jmf
Summary: Manipulation of product reviews via API
Aliases: CVE-2021-37707
Severity: MODERATE
CWE: CWE-20
Published: 2021-08-30T16:14:00Z

### Impact
Manipulation of product reviews via API

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-cjw5-f2x5-r4q5
Summary: Cross-site Scripting in TastyIgniter
Aliases: CVE-2022-0602
Severity: HIGH
CWE: CWE-79
Published: 2022-04-06T00:01:29Z

TastyIgniter prior to version 3.3.0 is vulnerable to Document Object Model (DOM) based Cross-site Scripting (XSS).
Vulnerability: GHSA-735v-wx75-xmmm
Summary: Cross-site Scripting in grav
Aliases: CVE-2022-0268
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-27T18:27:56Z

In grav prior to version 1.7.28, a low privilege user can create a page with arbitrary javascript by bypassing insufficent XSS filtering.
Vulnerability: GHSA-4p9g-qgx9-397p
Summary: Denial of Service in Page Error Handling
Aliases: CVE-2021-21359
Severity: MODERATE
CWE: CWE-405, CWE-674
Published: 2021-03-23T01:54:09Z

> ### Meta
> * CVSS:  `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C` (5.5)
> * CWE-405, CWE-674
> * Status: **DRAFT**

### Problem
Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content  to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.

### Solution
Update to TYPO3 versions 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Paul Keller, Mathias Bolt Lesniak and Kay Strobach who reported this issue and to TYPO3 framework merger Frank Nägler and to TYPO3 security team member Torben Hansen who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005)
Vulnerability: GHSA-cchx-mfrc-fwqr
Summary: Improper authentication in Symfony
Aliases: CVE-2019-10911
Severity: HIGH
CWE: CWE-287, CWE-200
Published: 2020-02-12T18:45:08Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Vulnerability: GHSA-vhrp-8qx4-vr6c
Summary: Incorrect Access Control in Ignition
Aliases: CVE-2021-43996
Severity: HIGH
CWE: CWE-284
Published: 2021-11-19T20:18:20Z

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.
Vulnerability: GHSA-f9p3-h6cg-2cjr
Summary: Improper neutralization of formula elements in yii-helpers
Aliases: CVE-2022-1544
Severity: HIGH
CWE: CWE-1236
Published: 2022-05-03T00:00:46Z

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Vulnerability: GHSA-7x2h-3v2v-24p9
Summary: Cross-Site Request Forgery in microweber
Aliases: CVE-2022-0505
Severity: MODERATE
CWE: CWE-352
Published: 2022-02-09T00:00:31Z

microweber version 1.2.10 and prior is vulnerable to cross-site request forgery.
Vulnerability: GHSA-jq4p-mq33-w375
Summary: Cross-site Scripting when rendering error messages in laminas-form
Aliases: CVE-2022-23598
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T23:08:29Z

### Impact

When rendering validation error messages via the `formElementErrors()` view helper shipped with laminas-form, many messages will contain the submitted value. However, in vulnerable versions of laminas-form, the value was not being escaped for HTML contexts, which can potentially lead to a Reflected Cross-Site Scripting (XSS) attack.

### Patches

The following versions were issued to mitigate the vulnerability:

- 2.17.1
- 3.0.2
- 3.1.1

### Workarounds

At the top of a view script where you call the `formElementErrors()` view helper, place the following code:

```php
use Laminas\Form\ElementInterface;
use Laminas\View\PhpRenderer;

$escapeMessages = function (ElementInterface $formOrElement, PhpRenderer $renderer): void {
    $messages = $element->getMessages();
    if (! $messages) {
        return;
    }

    $escaped  = [];
    array_walk_recursive(
        $messages,
        static function (string $item) use (&$escaped, $renderer): void {
            $escaped[] = $renderer->escapeHtml($item);
        }
    };

    $element->setMessages($escaped);
};
```

Before calling `formElementErrors()` with a form, fieldset, or element, call the above closure as follows

```php
// Usage with a form
// $this is the view renderer
$escapeMessages($form, $this);

// Usage with a fieldset
// $this is the view renderer
$escapeMessages($fieldset, $this);

// Usage with a form element
// $this is the view renderer
$escapeMessages($element, $this);
```

### For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/laminas/laminas-form/issues/new)
* Email us at [security@getlaminas.org](mailto:security@getlaminas.org)
Vulnerability: GHSA-75p7-527p-w8wp
Summary: Server-Side Request Forgery and Open Redirect in AllTube Download
Aliases: CVE-2022-24739
Severity: HIGH
CWE: CWE-918, CWE-601
Published: 2022-03-09T15:17:31Z

### Impact

On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).

The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.)

### Patches

3.0.3 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

The fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/3d092891044f2685ed66c73c870a021bee319c37/patches/youtube-dl-disable-generic.diff) to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.
However, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.

### References

* https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a
* https://github.com/ytdl-org/youtube-dl/issues/30691
Vulnerability: GHSA-w7x8-cq7r-g5g9
Summary: Cross Site Scripting in Microweber
Aliases: CVE-2021-33988
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-25T19:43:39Z

Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form.
Vulnerability: GHSA-gmr7-m73x-6c9q
Summary: Missing Authorization in TeamPass
Aliases: CVE-2020-11671
Severity: HIGH
CWE: CWE-862
Published: 2021-07-26T21:22:13Z

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.
Vulnerability: GHSA-f77h-m9w2-vvg2
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4017
Severity: HIGH
CWE: CWE-352
Published: 2021-12-03T20:38:57Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-356r-77q8-f64f
Summary: Cross-Site Request Forgery in firefly-iii
Aliases: CVE-2021-3819
Severity: MODERATE
CWE: CWE-352
Published: 2021-09-29T17:12:37Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). This has been mitigated in version 5.6.1
Vulnerability: GHSA-738m-f33v-qc2r
Summary: SMTP Injection in PHPMailer
Aliases: CVE-2015-8476
Severity: LOW
CWE: CWE-20
Published: 2020-03-05T22:09:19Z

### Impact
Attackers could inject arbitrary SMTP commands via by exploiting the fact that valid email addresses may contain line breaks, which are not handled correctly in some contexts.

### Patches
Fixed in 5.2.14 in [this commit](https://github.com/PHPMailer/PHPMailer/commit/6687a96a18b8f12148881e4ddde795ae477284b0).

### Workarounds
Manually strip line breaks from email addresses before passing them to PHPMailer.

### References
https://nvd.nist.gov/vuln/detail/CVE-2015-8476

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-p68v-frgx-4rjp
Summary: Denial of Service via Cache Flooding
Severity: LOW
CWE: CWE-400
Published: 2020-10-19T21:34:14Z

### Impact
 Denial of Service via Cache Flooding

### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
Vulnerability: GHSA-86r3-4gq8-xw8q
Summary: Remote Code Execution in Laravel
Aliases: CVE-2021-43503
Severity: CRITICAL
CWE: CWE-502
Published: 2022-04-09T00:00:25Z

A Remote Code Execution (RCE) vulnerability exists in h laravel 5.8.38 via an unserialize pop chain in (1) __destruct in \Routing\PendingResourceRegistration.php, (2) __cal in Queue\Capsule\Manager.php, and (3) __invoke in mockery\library\Mockery\ClosureWrapper.php.
Vulnerability: GHSA-4286-h47h-m5v6
Summary: Improper Authentication in showdoc 
Aliases: CVE-2021-41745
Severity: HIGH
CWE: CWE-434, CWE-287
Published: 2021-10-25T19:43:24Z

ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.
Vulnerability: GHSA-6fmv-q269-55cw
Summary: Edit template, Remote Code Execution (RCE) Vulnerability in Latest Release 4.4.0
Aliases: CVE-2020-15277
Severity: HIGH
CWE: CWE-434, CWE-74
Published: 2020-10-30T17:05:59Z

baserCMS 4.4.0 and earlier is affected by Remote Code Execution (RCE).

Impact: XSS via Arbitrary script execution.
Attack vector is: Administrator must be logged in.
Components are: Edit template.
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by Aquilao Null
Vulnerability: GHSA-qf6q-qfwp-vp44
Summary: Origin Validation Error in Magento 2
Aliases: CVE-2020-8818
Severity: HIGH
CWE: CWE-346
Published: 2021-10-12T16:30:58Z

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Vulnerability: GHSA-jmhf-9fj8-88gh
Summary: Open Redirect in AllTube
Aliases: CVE-2022-0692
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-23T21:15:01Z

### Impact
Releases prior to 3.0.1 are vulnerable to an open redirect vulnerability that allows an attacker to construct a URL that redirects to an arbitrary external domain.

### Patches
3.0.1 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

### References
* https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
* https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0692
Vulnerability: GHSA-c53v-qmrx-93hg
Summary: Open redirect in shopware
Aliases: CVE-2022-21651
Severity: MODERATE
CWE: CWE-601
Published: 2022-01-06T23:49:19Z

### Impact

Arbitrary redirect while using certain URLs 

### Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Vulnerability: GHSA-rpg7-q4cv-p466
Summary: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4123
Severity: MODERATE
CWE: CWE-352
Published: 2021-12-17T20:00:16Z

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-q3x2-jvp3-wj78
Summary: Unrestricted XML files leading to cross-site scripting in Microweber
Aliases: CVE-2022-0963
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack.
Vulnerability: GHSA-9pgx-gcph-mpqr
Summary: XSS via the history parameter in SQL command
Aliases: CVE-2020-35572
Severity: MODERATE
CWE: CWE-79
Published: 2021-02-11T20:42:28Z

### Impact
Users of Adminer versions supporting SQL command (most versions, e.g. MySQL) using browsers not encoding URL parameters before sending to server (likely Edge, not Chrome, not Firefox) are affected.

### Patches
Patched by 5c395afc, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).

### Workarounds
Use browser which encodes URL parameters (e.g. Chrome or Firefox).

### References
https://sourceforge.net/p/adminer/bugs-and-features/775/

### For more information
If you have any questions or comments about this advisory:
* Comment at https://sourceforge.net/p/adminer/bugs-and-features/775/
Vulnerability: GHSA-88rc-3p98-rgvx
Summary: After order payment process manipulation in shopware/platform and shopware/core 
Severity: CRITICAL
CWE: CWE-668
Published: 2021-04-13T15:13:48Z

### Impact

After order payment process manipulation

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Vulnerability: GHSA-5f37-gxvh-23v6
Summary: Remote code execution in PHPMailer
Aliases: CVE-2016-10033
Severity: CRITICAL
CWE: CWE-77
Published: 2020-03-05T22:09:17Z

### Impact
The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \&quot; (backslash double quote) in a crafted `Sender` property.

### Patches
Fixed in 5.2.18

### Workarounds
Filter and validate user input before passing it to internal functions.

### References
https://nvd.nist.gov/vuln/detail/CVE-2016-10033
Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)