TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-2p6g-gjp8-ggg9
Summary: Validation bypass in personnummer
Severity: LOW
Published: 2020-09-09T17:29:34Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-qrvj-274h-hfcg
Summary: Deserialization of Untrusted Data in topthink/framework
Aliases: CVE-2021-36567
Severity: CRITICAL
CWE: CWE-502
Published: 2021-12-07T00:00:27Z

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
Vulnerability: GHSA-vrgp-3ph6-2wwq
Summary: SQL Injection in Dolibarr
Aliases: CVE-2021-36625
Severity: HIGH
CWE: CWE-89
Published: 2022-04-01T00:00:41Z

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
Vulnerability: GHSA-322v-p3jc-7hrg
Summary: Cross-Site Request Forgery in Anchor CMS
Aliases: CVE-2022-25576
Severity: MODERATE
CWE: CWE-352
Published: 2022-03-26T00:00:34Z

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
Vulnerability: GHSA-389p-fchr-q2mg
Summary: Path Traversal in ImpressCMS
Aliases: CVE-2022-24977
Severity: CRITICAL
CWE: CWE-22
Published: 2022-02-15T00:02:47Z

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.
Vulnerability: GHSA-246r-r2wf-frhx
Summary: Malicious password-reset in Akaunting
Aliases: CVE-2021-36804
Severity: HIGH
CWE: CWE-640
Published: 2021-09-01T18:31:36Z

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.
Vulnerability: GHSA-347x-877p-hcwx
Summary: Information Disclosure in Password Reset
Aliases: CVE-2020-11063
Severity: LOW
CWE: CWE-204
Published: 2020-05-13T22:19:21Z

In TYPO3 CMS 10.4.0 through 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts.

This has been fixed in 10.4.2.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-001
Vulnerability: GHSA-7289-chwj-7h86
Summary: Path traversal in librenms/librenms
Aliases: CVE-2021-44278
Severity: CRITICAL
CWE: CWE-22
Published: 2021-12-10T20:18:30Z

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
Vulnerability: GHSA-g92x-8m54-p89v
Summary: Cross-Site Request Forgery in snipe-it
Aliases: CVE-2021-3858
Severity: MODERATE
CWE: CWE-352
Published: 2021-10-21T17:48:55Z

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-jx5q-g37m-h5hj
Summary: Client-Side JavaScript Prototype Pollution in oro/platform
Aliases: CVE-2021-43852
Severity: MODERATE
CWE: CWE-74, CWE-1321
Published: 2022-01-06T18:29:51Z

### Summary

By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution.

### Workarounds

Configure WAF to drop requests containing next strings: `__proto__` , `constructor[prototype]`, `constructor.prototype`
Vulnerability: GHSA-g485-29gq-6h2h
Summary: Sensitive Data Exposure in miniorange_saml
Aliases: CVE-2021-36786
Severity: HIGH
CWE: CWE-922
Published: 2021-09-01T18:36:24Z

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
Vulnerability: GHSA-7322-jrq4-x5hf
Summary: File reference keys leads to incorrect hashes on HMAC algorithms
Aliases: CVE-2021-41106
Severity: MODERATE
CWE: CWE-345
Published: 2021-09-29T17:09:40Z

### Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

### Patches

All versions have been patched to always load the file contents, deprecated the `Lcobucci\JWT\Signer\Key\LocalFileReference`, and suggest `Lcobucci\JWT\Signer\Key\InMemory` as the alternative.

### Workarounds

Use `Lcobucci\JWT\Signer\Key\InMemory` instead of `Lcobucci\JWT\Signer\Key\LocalFileReference` to create the instances of your keys:

```diff
-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');
```
Vulnerability: GHSA-9vwf-54m9-gc4f
Summary: snipe-it is vulnerable to Improper Access Control
Aliases: CVE-2021-4089
Severity: MODERATE
CWE: CWE-863, CWE-284
Published: 2021-12-16T14:32:39Z

snipe-it is vulnerable to Improper Access Control
Vulnerability: GHSA-rphc-h572-2x9f
Summary: Cross-site Scripting in showdoc/showdoc
Aliases: CVE-2022-0960
Severity: CRITICAL
CWE: CWE-79, CWE-434
Published: 2022-03-15T00:00:55Z

ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.
Vulnerability: GHSA-wwgq-9jhf-qgw6
Summary: Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
Aliases: CVE-2021-41273
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-18T15:46:57Z

### Impact
Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints:

* Sending a test email.
* Generating a node auto-deployment token.

At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system.

### Patches
This has been addressed in https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5 which will be released as `1.6.6`.

### Workarounds
Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.
Vulnerability: GHSA-ph62-8768-r87v
Summary: Arbitrary file delete in ectouch/ectouch
Aliases: CVE-2022-25098
Severity: CRITICAL
Published: 2022-02-25T00:01:04Z

ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
Vulnerability: GHSA-gvj8-4cj4-h776
Summary: Object state limitation has no effect
Severity: CRITICAL
CWE: CWE-281
Published: 2022-04-29T15:40:48Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Vulnerability: GHSA-48p3-xfvw-g59c
Summary: Incorrect Access Control in ImpressCMS
Aliases: CVE-2021-26598
Severity: MODERATE
CWE: CWE-287
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
Vulnerability: GHSA-wc7v-77jr-5c3m
Summary: bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3944
Severity: LOW
CWE: CWE-352
Published: 2021-12-03T20:38:37Z

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-vwxp-9qmf-w299
Summary: Cross-site Scripting in LiveHelperChat
Aliases: CVE-2022-0394
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-01T00:49:48Z

LiveHelperChat (remdex/livehelperchat in Packagist) has a stored Cross-site Scripting (XSS) vulnerability prior to version 3.93.
Vulnerability: GHSA-rfjc-xrmf-5vvw
Summary: Privilege escalation by backend users assigned to the default "Publisher" system role
Aliases: CVE-2020-15248
Severity: LOW
CWE: CWE-863, CWE-269
Published: 2020-11-23T19:47:27Z

### Impact
Backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to "Developer" access. 

### Patches
Issue has been patched in Build 470 (v1.0.470) & v1.1.1.

### Workarounds
Apply https://github.com/octobercms/october/commit/78a37298a4ed4602b383522344a31e311402d829 to your installation manually if unable to upgrade to Build 470 or v1.1.1.

### References
Reported by [Hoan Hoang](https://github.com/hoanhp)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1098" alt="Screen Shot 2020-10-10 at 1 37 25 PM" src="https://user-images.githubusercontent.com/7253840/95663611-e6326c80-0afd-11eb-8a1e-8b767a7202fb.png">
Vulnerability: GHSA-xp5q-77mh-6hm2
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3728
Severity: MODERATE
CWE: CWE-352
Published: 2021-08-25T14:50:17Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-3wwj-wh2w-g4xp
Summary: CRLF Injection in microweber
Aliases: CVE-2022-0666
Severity: HIGH
CWE: CWE-93
Published: 2022-02-19T00:01:35Z

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-4p92-fv6v-fhfj
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0723
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-27T00:00:15Z

Microweber prior to 1.2.11 is vulnerable to reflected cross-site scripting.
Vulnerability: GHSA-j5qg-w9jg-3wg3
Summary: Inability to de-op players if listed in ops.txt with non-lowercase letters
Severity: LOW
Published: 2021-12-16T18:53:57Z

### Impact
Originally reported in iTXTech/Genisys#1188

```txt
PotterHarry98
potterharry98
```

`deop PotterHarry98`

will remove `potterharry98` from the ops.txt but not `PotterHarry98`.

Operator permissions are checked using `Config->exists()` with `lowercase=true`, which will result in a match:
https://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449

This means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.

### Patches
4d37b79ff7f9d9452e988387f97919a9a1c4954e

### Workarounds
This can be easily addressed by removing the offending lines from ops.txt manually.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-m6q5-wv4x-fv6h
Summary: Cross-site Scripting in Drupal Core
Aliases: CVE-2020-13668
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-12T00:00:47Z

Access Bypass vulnerability in Drupal Core allows for an attacker to leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Vulnerability: GHSA-qv7g-j98v-8pp7
Summary: XSS vulnerability on email template preview page
Aliases: CVE-2021-41236
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T18:34:35Z

### Summary

Email template preview is vulnerable to XSS payload added to email template content. The attacker should have permission to create or edit an email template. For successful payload, execution attacked user should preview a vulnerable email template.

### Workarounds

There are no workarounds that address this vulnerability.
Vulnerability: GHSA-86pv-95mj-7w5f
Summary: Stored XSS vulnerability on Bounce Management Callback
Aliases: CVE-2021-27910
Severity: HIGH
CWE: CWE-79
Published: 2021-09-01T18:40:48Z

### Impact
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.

An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function.

The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:

* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-7mv4-4xpg-xq44
Summary: FormField with square brackets in field name skips validation
Aliases: CVE-2020-26138
Severity: MODERATE
CWE: CWE-20
Published: 2022-03-26T00:14:34Z

FileField with array notation skips validation

The FileField class is commonly used for file upload in custom code on a Silverstripe website. This field is designed to be used with a single file upload.

PHP allows for submitting multiple values by adding square brackets to the field name. When this is done to a FileField, it will be coerced into allowing multiple files by using this notation. This is not a supported feature, though nothing is done to prevent this.

In this scenario, validation such as limiting allowed extensions is not applied, and the FileField->saveInto() behaviour is not triggered. If custom controller logic is used to process the file uploads, it might implicitly rely on validation to be provided by the Form system, which is not the case.
Vulnerability: GHSA-579x-cjvr-cqj9
Summary: Observable Response Discrepancy in Lost Password Service
Aliases: CVE-2021-39189
Severity: MODERATE
CWE: CWE-203, CWE-204
Published: 2021-09-20T19:53:55Z

### Impact
It is possible to enumerate usernames via the forgot password functionality

### Patches
Update to version `10.1.3` or apply this patch manually: https://github.com/pimcore/pimcore/pull/10223.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/10223.patch manually.
Vulnerability: GHSA-974j-wjxx-wggj
Summary: Incorrect Access Control vulnerability in api-platform/core
Aliases: CVE-2019-1000011
Severity: MODERATE
CWE: CWE-284
Published: 2019-10-14T21:23:26Z

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
Vulnerability: GHSA-mr6r-82x4-f4jj
Summary: Timing attacks might allow practical recovery of the long-term private key
Aliases: CVE-2019-10764
Severity: HIGH
CWE: CWE-203
Published: 2019-11-20T01:34:50Z

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.
Vulnerability: GHSA-mxh3-2699-98g9
Summary: Cross-site Scripting pimcore
Aliases: CVE-2022-0510
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T00:00:28Z

pimcore version 10.3.0 and prior is vulnerable to cross-site scripting.
Vulnerability: GHSA-gj85-pvp5-mvf9
Summary: Cross-site Scripting in Beanstalk console
Aliases: CVE-2022-0501
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-06T00:00:54Z

Beanstalk console prior to version 1.7.12 is vulnerable to cross-site scripting.
Vulnerability: GHSA-xmq3-hgjx-6997
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0705
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-17T00:00:47Z

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Vulnerability: GHSA-hfm8-2q22-h7hv
Summary: Cross-site Scripting in pegasus/google-for-jobs
Aliases: CVE-2021-43561
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-15T17:39:18Z

An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
Vulnerability: GHSA-427g-2r83-3ccm
Summary: Information disclosure through processing of external XML entities
Aliases: CVE-2019-8126
Severity: MODERATE
CWE: CWE-776, CWE-611
Published: 2019-11-12T22:59:24Z

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.
Vulnerability: GHSA-cpv8-6xgr-rmf6
Summary: Cross-site Scripting in Dolibarr
Aliases: CVE-2021-25955
Severity: CRITICAL
CWE: CWE-79
Published: 2021-08-30T16:22:46Z

In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account takeover of the admin and due to other vulnerability (Improper Access Control on Private notes) a low privileged user can update the private notes which could lead to privilege escalation.
Vulnerability: GHSA-x8xx-x82q-42q3
Summary: Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel
Aliases: CVE-2022-25336
Severity: MODERATE
CWE: CWE-668
Published: 2022-02-19T00:01:25Z

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, since not all possible attack vectors are removed from the original file name.

The second issue is that direct access to the images is not access controlled. This is by design, for performance reasons, and documented as such. But it does mean that images not meant to be publicly accessible can be accessed, provided that the image path and filename is correctly deduced and/or guessed, through dictionary attacks and similar.
Vulnerability: GHSA-xh9g-cp3v-p8q4
Summary: Missing Authorization in Crater Invoice
Aliases: CVE-2022-0203
Severity: MODERATE
CWE: CWE-862, CWE-284
Published: 2022-01-27T00:01:17Z

Crater Invoice prior to version 6.0.2 has a missing authorization vulnerability..
Vulnerability: GHSA-82rr-mq4r-p4r3
Summary: SQL injection in francoisjacquet/rosariosis
Aliases: CVE-2021-44567
Severity: CRITICAL
CWE: CWE-89
Published: 2022-02-25T00:01:08Z

An SQL Injection vulnerability exits in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.
Vulnerability: GHSA-7vph-p634-vrqf
Summary: Command Injection in RaspAP 2.6.6
Aliases: CVE-2021-38556
Severity: HIGH
CWE: CWE-77
Published: 2021-09-02T17:11:00Z

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
Vulnerability: GHSA-p5hj-xxfr-pwc3
Summary: Code Injection in microweber
Aliases: CVE-2022-0282
Severity: HIGH
CWE: CWE-94
Published: 2022-01-21T18:02:39Z

Code Injection in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-jv64-2m3x-6v4q
Summary: Cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS
Aliases: CVE-2021-41948
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-30T00:00:36Z

A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List of subjects".
Vulnerability: GHSA-7vwg-39h8-8qp8
Summary: /user/sessions endpoint allows detecting valid accounts
Severity: HIGH
CWE: CWE-203
Published: 2021-03-11T17:42:01Z

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
Vulnerability: GHSA-79mg-4w23-4fqc
Summary: Unauthenticated SQL Injection in Cachet
Aliases: CVE-2021-39165
Severity: HIGH
CWE: CWE-287, CWE-89
Published: 2021-08-30T16:12:58Z

### Impact
In Cachet versions through 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session.

### Patches

The original repository of [https://github.com/CachetHQ/Cachet](https://github.com/CachetHQ/Cachet) is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected. 

Update to version 2.5 or later in the [https://github.com/fiveai/Cachet fork](https://github.com/fiveai/Cachet) to fix this vulnerability.
Vulnerability: GHSA-9722-rr68-rfpg
Summary: Upload whitelisted files to any directory in OctoberCMS
Aliases: CVE-2020-5297
Severity: LOW
CWE: CWE-73
Published: 2020-06-03T21:58:27Z

### Impact
An attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/6711dae8ef70caf0e94cec434498012a2ccd86b8 to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1241" alt="Screen Shot 2020-03-31 at 12 21 10 PM" src="https://user-images.githubusercontent.com/7253840/78061230-255f5400-734a-11ea-92b4-1120f6960505.png">
Vulnerability: GHSA-3vg7-jw9m-pc3f
Summary: Broken Access Control in Form Framework
Aliases: CVE-2021-21357
Severity: HIGH
CWE: CWE-434, CWE-22, CWE-20
Published: 2021-03-23T01:53:57Z


### Problem
Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework.

In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation.

A valid backend user account with access to the form module is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 contributor Ralf Zimmermann who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-003](https://typo3.org/security/advisory/typo3-core-sa-2021-003)
Vulnerability: GHSA-gwpx-q2h9-wxgx
Summary: elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Aliases: CVE-2021-3964
Severity: MODERATE
CWE: CWE-639
Published: 2021-12-03T20:43:25Z

elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Vulnerability: GHSA-673x-f5wx-fxpw
Summary: Cross Site Scripting and RCE in baserCMS
Aliases: CVE-2020-15159
Severity: LOW
CWE: CWE-79
Published: 2020-08-28T21:45:15Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).

* Impact: XSS to RCE via Arbitrary file upload.
* Attack vector is: Administrator must be logged in.
* Components are: ThemeFilesController.php, UploaderFilesController.php.
* Tested baserCMS Version : 4.3.6 (Latest)
* Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
* Patches : https://basercms.net/security/20200827

Found by Vulnerability Research team in [Flatt Security Inc.](https://flatt.tech/)
Vulnerability: GHSA-g7w8-pp9w-7p32
Summary: Creation of order credits was not validated by acl in admin orders
Severity: LOW
CWE: CWE-306
Published: 2021-06-28T16:57:32Z

### Impact
Creation of order credits was not validated by ACL in admin orders

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-xpfv-89vg-r562
Summary: Cross Site Request Forgery in Moodle
Aliases: CVE-2022-0335
Severity: HIGH
CWE: CWE-352
Published: 2022-01-28T22:07:23Z

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Vulnerability: GHSA-68wg-qv6r-j4vp
Summary: SQL Injection in usmanhalalit/pixie
Aliases: CVE-2019-10766
Severity: CRITICAL
CWE: CWE-89
Published: 2019-11-20T17:44:54Z

Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
Vulnerability: GHSA-7fjp-g4m7-fx23
Summary: User (Encrypted) Password Field Being Serialised
Severity: LOW
CWE: CWE-200
Published: 2021-04-13T15:12:26Z

### Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.

### Patches
Issue has been patched in version 0.3.7-beta and onwards.

### Workarounds
Add the 'password' field to the Users model file in the hidden array:

```php

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'remember_token',
        'password',
    ];
```


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)
* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)
Vulnerability: GHSA-g54x-29xv-58h5
Summary: Remote code execution in Subrion
Aliases: CVE-2021-43464
Severity: HIGH
Published: 2022-04-05T00:00:23Z

Subrion is an open source php content management system. A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().
Vulnerability: GHSA-79hv-pfx6-hhpj
Summary: Cross-site scripting (XSS)
Aliases: CVE-2021-28088
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-12T21:34:02Z

Cross-site scripting (XSS) in modules/content/admin/content.php in ImpressCMS profile 1.4.2 allows remote attackers to inject arbitrary web script or HTML parameters through the "Display Name" field.
Vulnerability: GHSA-crf2-xm6x-46p6
Summary: Observable Timing Discrepancy in OpenMage LTS
Aliases: CVE-2020-15151
Severity: HIGH
CWE: CWE-203, CWE-352
Published: 2020-08-19T18:02:36Z

### Impact
This vulnerability allows to circumvent the **formkey protection** in the Admin Interface and increases the attack surface for  **Cross Site Request Forgery** attacks 

### Patches
The latest OpenMage Versions up from 19.4.6 and 20.0.2 have this Issue solved


### References
Related to Adobes CVE-2020-9690 ( https://helpx.adobe.com/security/products/magento/apsb20-47.html )
fixed in Magento2 https://github.com/magento/magento2/commit/52d72b8010c9cecb5b8e3d98ec5edc1ddcc65fb4
as part of 2.4.0/2.3.5-p2
Vulnerability: GHSA-2rxh-h6h9-qrqc
Summary: Class destructors causing side-effects when being unserialized in TYPO3 CMS
Aliases: CVE-2020-11066
Severity: HIGH
CWE: CWE-915
Published: 2020-05-13T23:18:38Z

Calling unserialize() on malicious user-submitted content can result in the following scenarios:
- trigger deletion of arbitrary directory in file system (if writable for web server)
- trigger message submission via email using identity of web site (mail relay)

Another insecure deserialization vulnerability is required to actually exploit mentioned aspects.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-004
Vulnerability: GHSA-64fq-9c6w-rq44
Summary: Improper Neutralization of Formula Elements in a CSV File in Kimai 2
Aliases: CVE-2021-43515
Severity: HIGH
CWE: CWE-1236
Published: 2022-04-09T00:00:25Z

A CSV Injection vulnerablity exists in Kimai Kimai 2 prior to 1.14.1 via a description in a new timesheet.
Vulnerability: GHSA-qcgx-7p5f-hxvr
Summary: Discoverability of user password hash in Statamic CMS
Aliases: CVE-2022-24784
Severity: LOW
CWE: CWE-326, CWE-200
Published: 2022-03-29T22:11:45Z

## Description

It was possible to confirm a single character of a user's password hash (just the hash, not the password) using a specially crafted regular expression filter in the users endpoint of the REST API. Many requests could eventually uncover the entire hash.

The hash would not be in the response, however the presence or absence of a result would confirm if the character was in the right position. It would take a long time since the API has throttling enabled by default.

Additionally, the REST API would need to be enabled, as well as the users endpoint. Both of which are disabled by default.

## Resolution

Filtering by password or password hash has been disabled.

## Credits

We would like to thank Thibaud Kehler for reporting the issue.
Vulnerability: GHSA-q348-f93x-9gx4
Summary: Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain
Aliases: CVE-2021-30492
Severity: CRITICAL
CWE: CWE-918, CWE-20
Published: 2021-04-29T21:53:06Z

### Impact
Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

### Resolution
Validate the provided Zendesk subdomain to be a valid subdomain in:
* getAuthUrl
* getAccessToken
Vulnerability: GHSA-59x4-67mh-px54
Summary: Crypt_GPG does not prevent additional options in GPG calls
Aliases: CVE-2022-24953
Severity: MODERATE
CWE: CWE-20
Published: 2022-02-18T00:00:36Z

The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
Vulnerability: GHSA-h6m7-j4h3-9rf5
Summary: Remote Code Execution in SyliusResourceBundle
Aliases: CVE-2020-15146
Severity: CRITICAL
CWE: CWE-917, CWE-74
Published: 2020-08-19T19:52:30Z

### Impact

Request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: `<=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3`.

### Example

```yaml
sylius_grid:
    grids:
        foo:
            fields:
                bar:
                    options:
                        baz: "expr:service('sylius.repository.product').find($id)"
```

In this case, `$id` can be prepared in a way that calls other services. 

If you visit `/route?id="~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"`, it will result in a following expression `expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"")`, which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

### Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

### Workarounds

The fix requires adding `addslashes` in `OptionsParser::parseOptionExpression` to sanitize user input before evaluating it using the expression language.

```php
- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
```

### Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-5rcc-6cmj-7728
Summary: Cross-site Scripting in BookStack
Aliases: CVE-2022-0877
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-09T00:00:44Z

Iframe tags don't have a sandbox attribute, this makes an attacker able to execute malicious javascript via an iframe and perform phishing attacks. The sandbox attribute will block script execution and prevents the content to navigate its top-level browsing context which will stop this type of attack.
Vulnerability: GHSA-vpq7-m4qm-p2gp
Summary: Business Logic Errors in microweber
Aliases: CVE-2022-0596
Severity: MODERATE
Published: 2022-02-16T00:01:45Z

Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-h7f9-cvh5-qw7f
Summary: Path traversal in pimcore/pimcore
Aliases: CVE-2021-23340
Severity: HIGH
CWE: CWE-22
Published: 2021-02-25T16:32:46Z

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Vulnerability: GHSA-mj9p-v2r8-wf8w
Summary: Cross-site scripting in SimpleSAMLphp
Aliases: CVE-2020-5226
Severity: LOW
CWE: CWE-79
Published: 2020-01-24T21:26:54Z

### Background

SimpleSAMLphp allows users to report errors and failures to the system administrators via a web form. This web form gathers some contextual information automatically, but it also allows the user to provide their email address for follow-ups and a free-text explanation of what happened. Once submitted, the report is sent as an email to the administrative email address configured in the software.

### Description

The `www/erroreport.php` script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp  1.18.0, a new `SimpleSAML\Utils\EMail` class was introduced to handle sending emails, implemented as a wrapper of an external dependency.

This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of the free-text field in `www/errorreport.php` was removed to avoid double escaping. However, for those not using the new user interface yet, an email template is hardcoded into the class itself in plain PHP. Since no escaping is provided in this template, it is then possible to inject HTML inside the template by manually crafting the contents of the free-text field.

### Affected versions

SimpleSAMLphp versions 1.18.0 to 1.18.3, both inclusive.

### Impact

An attacker may take advantage of this issue to manually craft a modified email sent via the error reporting mechanism, such as this email might trick a system administrator into performing an action, such as introducing their credentials into a phishing web site that resembles the original.

Remote execution of javascript code is considered unfeasible since email clients do not run javascript present in emails, although there might be email clients which don't follow this rule, making the attack surface grow.

### Resolution

Upgrade the SimpleSAMLphp installation to version 1.18.4.

### Credit

This vulnerability was discovered and reported by Frederic Vleminckx.
Vulnerability: GHSA-x2j7-6hxm-87p3
Summary: Remote code injection
Aliases: CVE-2021-27903
Severity: CRITICAL
CWE: CWE-94, CWE-74
Published: 2021-07-02T18:36:41Z

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
Vulnerability: GHSA-xv7v-rf6g-xwrc
Summary: Directory Traversal in typo3/phar-stream-wrapper
Aliases: CVE-2019-11831
Severity: CRITICAL
CWE: CWE-502, CWE-22
Published: 2021-09-30T17:10:14Z

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
Vulnerability: GHSA-w2fr-65vp-mxw3
Summary: Deserialization of untrusted data in Symfony
Aliases: CVE-2019-10912
Severity: HIGH
CWE: CWE-502
Published: 2020-02-12T18:44:50Z

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
Vulnerability: GHSA-8xv9-qcr9-ww9j
Summary: Authenticated XML External Entity Processing
Severity: MODERATE
CWE: CWE-611
Published: 2020-10-19T21:32:18Z

### Impact
Authenticated XML External Entity Processing

### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020
Vulnerability: GHSA-j85q-whc9-g4p9
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc
Aliases: CVE-2021-3678
Severity: MODERATE
CWE: CWE-338
Published: 2021-09-02T17:07:48Z

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Vulnerability: GHSA-m2q4-qghh-p9cq
Summary: Server-Side Request Forgery in yoast_seo
Aliases: CVE-2021-31779
Severity: MODERATE
CWE: CWE-918
Published: 2021-05-21T19:21:38Z

The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.
Vulnerability: GHSA-cv9j-78f7-w6v9
Summary: Incorrect Authorization in TYPO3 extension
Aliases: CVE-2020-25025
Severity: MODERATE
CWE: CWE-863
Published: 2021-07-26T21:41:22Z

The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
Vulnerability: GHSA-jp6h-mxhx-pgqh
Summary: Shopware guest session is shared between customers
Aliases: CVE-2022-24745
Severity: MODERATE
CWE: CWE-384
Published: 2022-03-10T17:28:55Z

### Impact
Guest sessions are shared between customers when HTTP cache is enabled. Setups with Varnish are not affected by this issue

## Patches

We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds

### Security Plugin
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

### Disable HTTP Cache

Disabling HTTP Cache is also a valid workaround
Vulnerability: GHSA-4jhw-2p6j-5wmp
Summary: Open Redirection in Login Handling
Aliases: CVE-2021-21338
Severity: MODERATE
CWE: CWE-601
Published: 2021-03-23T01:53:35Z


### Problem
It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability.

### Solution
Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-001](https://typo3.org/security/advisory/typo3-core-sa-2021-001)
Vulnerability: GHSA-952m-m83c-3xm6
Summary: Open redirect in direct_mail
Aliases: CVE-2020-12699
Severity: MODERATE
CWE: CWE-601
Published: 2021-05-24T16:58:37Z

The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
Vulnerability: GHSA-x752-qjv4-c4hc
Summary: Remote code injection in dompdf/dompdf
Aliases: CVE-2022-28368
Severity: CRITICAL
CWE: CWE-74
Published: 2022-04-04T00:00:55Z

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
Vulnerability: GHSA-xx8f-qf9f-5fgw
Summary: Remote code execution in zendframework and laminas-http
Aliases: CVE-2021-3007
Severity: CRITICAL
CWE: CWE-502
Published: 2021-06-08T20:11:19Z

Zend Framework 3.0.0 has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the __destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: the code may be related to Laminas Project laminas-http. Zend Framework is no longer supported by the maintainer. However, not all Zend Framework 3.0.0 vulnerabilities exist in a Laminas Project release.
Vulnerability: GHSA-c32w-3cqh-f6jx
Summary: Weak Password Recovery Mechanism for Forgotten Password
Aliases: CVE-2021-25957
Severity: HIGH
CWE: CWE-640
Published: 2021-09-02T17:08:33Z

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.