TQRG/raw-osv-data huggingface dataset:
Vulnerability: GSD-2022-1000075
Summary: Malicious code in PyPi Humanqueenn version all
Published: 2022-02-02T18:55:16.940754Z

In the PyPi Easyfuncsys package there is malicious code that appears to be stealing Discord tokens allowing it to access Discord as that user, additionally it appears to be stealing leveldb files.
Vulnerability: GSD-2022-1000072
Summary: Backdoor in PyPi xss package version all
Published: 2022-02-02T18:47:52.318148Z

In the PyPi xss package there is malicious code that appears to be stealing Discord tokens allowing it to access Discord as that user.
Vulnerability: CAN-2022-1000071
Summary: Default Credentials in XB6 Fibre+ Gateway version XB6_0821
Published: 2022-02-01T19:38:14.238938Z

In Shaw Communications Inc XB6 Fibre+ Gateway version XB6_0821 a Default Credentials exists in the Router/Modem that can be attacked via local access resulting in Admin access to router
Vulnerability: GSD-2022-1000073
Summary: malicious code in PyPi Easyfuncsys version all
Published: 2022-02-02T18:51:06.691479Z

In the PyPi Easyfuncsys package there is malicious code that appears to be stealing Discord tokens allowing it to access Discord as that user, additionally it steals leveldb files, and runs a suspicious EXE.
Vulnerability: CAN-2022-1000284
Summary: Risk in WISP version general
Published: 2022-02-23T11:57:23.287111Z

In Netonix WISP version general a Risk exists in the Firmware update frequency/method/stability that can be attacked via N/A resulting in risk of use of older protocols / slower firmware patching speed / rushed instable updates
Vulnerability: GSD-2022-1000069
Summary: Hardware glitching attack in Trezor One Hardware Wallet version Unknown
Published: 2022-02-01T17:44:59.482663Z

The Trezor Hardware Wallet One based on the ARM Cortex-M3-based STM32 F2 uses the RDP2 security level by default (in SDP2 RAM cannot be copied), but the security can be downgraded to RDP1 (where the contents of memory can be copied) via glitch injection during device power on. Please note although the timing of the glitch is largely up to chance an attacker with access to the hardware and several hours can recover it through a simple brute force attack (power wallet on, glitch, repeat until it works). The exploitation of this vulnerability has been confirmed and a Youtube video with extensive details is available. As hardware wallets are explicitly designed to prevent physical attacks from recovering seed material this represents a major vulnerability.
Vulnerability: GSD-2022-1000284
Summary: Risk in WISP version general
Published: 2022-02-23T11:57:23.287111Z

In Netonix WISP version general a Risk exists in the Firmware update frequency/method/stability that can be attacked via N/A resulting in risk of use of older protocols / slower firmware patching speed / rushed instable updates
Vulnerability: GSD-2022-1000070
Summary: Reliance on improperly secured communications channel (Discord) in Grape Network version unknown
Published: 2022-02-01T17:45:15.768503Z

In Grape Network Grape Network version unknown a Reliance on improperly secured communications channel (Discord) exists in the Discord community "announcement" channels for multiple NFTs that can be attacked via unknown resulting in access Grape Network tokens was used to send Discord server messages resulting in social engineering of access to crypto wallets resulting in $1.3 Million USD (Monkey Kingdom) and $150,000 USD (Fractal) in stolen funds
Vulnerability: GSD-2022-1000071
Summary: Default Credentials in XB6 Fibre+ Gateway version XB6_0821
Published: 2022-02-01T19:38:14.238938Z

In Shaw Communications Inc XB6 Fibre+ Gateway version XB6_0821 a Default Credentials exists in the Router/Modem that can be attacked via local access resulting in Admin access to router
Vulnerability: GSD-2022-1000285
Summary: Unsafe default configuration values in Nginx version all version
Published: 2022-02-23T19:01:53.222611Z

# INFORMATIONAL

In Nginx, all versions,  a number of unsafe default configuration values exists in the web server that can be attacked via the network resulting in disclosure of information and availability. These include but are not limited to:

1. Not enough file descriptors per worker
2. The error_log off directive
3. Not enabling keepalive connections to upstream servers
4. Forgetting how directive inheritance works
5. The proxy_buffering off directive
6. Improper use of the if directive
7. Excessive health checks
8. Unsecured access to metrics
9. Using ip_hash when all traffic comes from the same /24 CIDR block
10. Not taking advantage of upstream groups
Vulnerability: GSD-2022-1000076
Summary: Unknown vulnerability in Wormhole on 2022-02-02 resulting in 120K ETH on Solana by an attacker.
Published: 2022-02-02T23:13:19.928218Z

An attacker was able to exploit a bug in Wormhole allowing them to mint 120K ETH on Solana worth approximately $300 Million USD. This has been confirmed with an on-chain message from Wormhole offering a $10 Million USD bug bounty if the newly minted tokens are returned to Wormhole. Wormhole has also stated that the vulnertability has been patched.
Vulnerability: GSD-2022-1000955
Summary: Access control check  in Elementor WordPress plugin version =<3.6.2
Published: 2022-04-13T16:18:45.179126Z

In Elementor WordPress plugin version 3.6.2 and earlier an access control check vulnerability exists. To quote Bill Toulas from BleepingComputer: "The problem lies in the absence of a crucial access check on one of the plugin's files, "module.php", which is loaded on every request during the admin_init action, even for users that are not logged in, the researchers explain." This can be attacked via the network using standard web requests, resulting in remote code execution. This is fixed in version 3.6.3.
Vulnerability: GSD-2021-1001147
Summary: CWE-89 in Secure Remote Access (SRA) version 8.x, 9.0.0.9-26sv and earlier
Published: 2021-07-17T15:03:52.309482Z

SonicWall is aware of improper neutralization of a SQL Command leading to SQL Injection vulnerability, reported by CrowdStrike, impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware or an old version of firmware 9.x (9.0.0.9-26sv or earlier). In February 2021, SonicWall released SMA firmware 10.2.0.7 and 9.0.0.10 to fix a zero-day vulnerability, along with additional comprehensive code-strengthening. This strengthening proactively prevented this newly reported vulnerability in 9.0.0.10. Organizations that already upgraded to the 9.0.0.10 firmware are already protected against this newly reported issue and don’t need to take any action. Organizations with any 10.x version is not subject to this vulnerability as the vulnerable feature was deprecated in the 10.x release. Organizations running any firmware versions of 8.x or older than 9.0.0.10 or 10.2.0.7 should, per our earlier instructions, upgrade immediately. These older versions may potentially be exploited if not patched immediately. SMA 1000 Series products are not affected by this vulnerability.
Vulnerability: GSD-2022-1000283
Summary: Multiple vulnerabilities in NFT version All
Published: 2022-02-23T01:55:19.527375Z

A phishing attack was conducted against users of the Opensea.io NFT platform, resulting in 17 users losing approx. $1.7 Million USD in NFTs. This incident appears to include email phishing, a fake website, bad wallet UI that make it difficult for users to know exactly what is going on and use of the Wyvern 2.2 version Smart Contract which is being deprecated. Please note that this issue may be split into multiple GSD IDs at some point, e.g. for the bad wallet UI (you are selling something for 0 ETH which should generate a warning), lack of EIP-712 support in the Smart Contract which makes signing things more dangerous and so on.
Vulnerability: GSD-2022-1000077
Summary: CWE-749 in Dragos version all versions
Published: 2022-02-18T03:50:18.115366Z

In RigoBlock Dragos, all versions as of 2022-02-17 and later (until a major protocol update is accomplished) contain an exposed function (CWE-749), specifically setMultipleAllowances() which was not set to onlyOwner. The setMultipleAllowances() function can be to manipulate tokens with the contract.
Vulnerability: GHSA-qpmc-wprv-x746
Summary: Inline DTD allows XML bomb attack
Aliases: CVE-2019-15160
Severity: HIGH
CWE: CWE-611, CWE-776
Published: 2022-04-12T21:31:26Z

The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
Vulnerability: GHSA-5653-437f-5hmc
Summary: Denial of service
Aliases: CVE-2019-16764
Severity: MODERATE
CWE: CWE-400
Published: 2022-04-12T21:29:30Z

The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.
Vulnerability: GHSA-2xxx-fhc8-9qvq
Summary: Missing `is_nil` requirement
Severity: MODERATE
Published: 2022-04-12T19:42:45Z

Ecto will not raise on queries with non-explicit nil comparisons (ie if they aren't checked with `is_nil`).
Vulnerability: GHSA-5chx-gg25-v37m
Summary: Cross-site Scripting in xain
Aliases: CVE-2018-20302
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-12T21:17:38Z

XSS is possible via the use of the order query parameter. An example request
  would look like:
  ```
  http://host/ressources?order=%27><script>alert(1);</script>
  ```
Vulnerability: GHSA-w98m-2xqg-9cvj
Summary: Remote Code Execution in paginator
Aliases: CVE-2020-15150
Severity: CRITICAL
Published: 2022-04-12T19:36:39Z

There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function.

### Impact
There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This will potentially affect all current users of `Paginator` prior to version >= 1.0.0.

### Patches
The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.

### Credits

Thank you to Peter Stöckli.
Vulnerability: GHSA-2q6v-32mr-8p8x
Summary: Null Byte Injection in Plug.Static
Aliases: CVE-2017-1000052
Severity: HIGH
CWE: CWE-74
Published: 2022-04-12T21:20:20Z

Plug.Static is used for serving static assets, and is vulnerable to null
  byte injection. If file upload functionality is provided, this can allow
  users to bypass filetype restrictions.
  We recommend all applications that provide file upload functionality and
  serve those uploaded files locally with Plug.Static to upgrade immediately
  or include the fix below. If uploaded files are rather stored and served
  from S3 or any other cloud storage, you are not affected.
Vulnerability: GHSA-5v4m-c73v-c7gq
Summary: Arbitrary Code Execution in Cookie Serialization
Aliases: CVE-2017-1000053
Severity: HIGH
CWE: CWE-502
Published: 2022-04-12T21:23:43Z

The default serialization used by Plug session may result in code execution
  in certain situations. Keep in mind, however, the session cookie is signed
  and this attack can only be exploited if the attacker has access to your
  secret key as well as your signing/encryption salts. We recommend users to
  change their secret key base and salts if they suspect they have been leaked,
  regardless of this vulnerability.
Vulnerability: GHSA-j3gg-r6gp-95q2
Summary: XSS in HEEx class attributes
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-12T20:22:57Z

The `class` attribute was not protected against XSS attacks when using HEEx.
Vulnerability: GHSA-v2wf-c3j6-wpvw
Summary: Session fixation
Aliases: CVE-2020-5205
Severity: MODERATE
CWE: CWE-384
Published: 2022-04-12T21:27:49Z

### Impact

The use of `Plug.Session` in `Pow.Plug.Session` is susceptible to session fixation attacks if a persistent session store is used for `Plug.Session`, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.

### Workarounds

Call `Plug.Conn.configure_session(conn, renew: true)` periodically and after privilege change. A custom authorization plug can be written where the `create/3` method should return the `conn` only after `Plug.Conn.configure_session/2` have been called on it.

### References
https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f  
https://www.owasp.org/index.php/Session_fixation
Vulnerability: GHSA-cmfh-8f8r-fj96
Summary: Arbitrary URL Redirect
Aliases: CVE-2017-1000163
Severity: MODERATE
CWE: CWE-601
Published: 2022-04-12T21:16:09Z

The Phoenix team designed Phoenix.Controller.redirect/2 to protect against
  redirects allowing user input to redirect to an external URL where your
  application code otherwise assumes a local path redirect. This is why the
  :to option is used for “local” URL redirects and why you must pass the
  :external option to intentionally allow external URLs to be redirected to.
  It has been disclosed that carefully crafted user input may be treated by some
  browsers as an external URL. An attacker can use this vulnerability to aid in
  social engineering attacks. The most common use would be to create highly
  believable phishing attacks.
  For example, the following user input would pass local URL validation,
  but be treated by Chrome and Firefox as external URLs:
  http://localhost:4000/?redirect=/\nexample.com
  Not all browsers are affected, but latest Chrome and Firefox will issue a get
  request for example.com and successfully redirect externally
Vulnerability: GHSA-9h73-w7ch-rh73
Summary: Header Injection
Aliases: CVE-2018-1000883
Severity: MODERATE
CWE: CWE-20
Published: 2022-04-12T21:26:27Z

Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to have been fixed in >= 1.3.5 or ~> 1.2.5 or ~> 1.1.9 or ~> 1.0.6.
Vulnerability: GHSA-mrq8-53r4-3j5m
Summary: Permissive parameters and privilege escalation
Aliases: CVE-2018-20301
Severity: MODERATE
CWE: CWE-20
Published: 2022-02-10T22:35:39Z

An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users can automatically confirm their accounts by sending the confirmed_at parameter with their registration request.
Vulnerability: GHSA-rh5w-82wh-jhr8
Summary: XSS vulnerability on asset view
Aliases: CVE-2021-27912
Severity: HIGH
CWE: CWE-79
Published: 2021-09-01T18:40:31Z

### Impact
Mautic versions before 3.3.4 / 4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. 

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-qpxw-6473-ppww
Summary: Session Fixation in Subrion CMS
Aliases: CVE-2020-12467
Severity: MODERATE
CWE: CWE-384
Published: 2021-06-22T15:23:04Z

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
Vulnerability: GHSA-3pcr-4982-548m
Summary: Exposure of .env if project root is configured as web root in shopware/production
Severity: MODERATE
CWE: CWE-552
Published: 2021-04-13T15:13:37Z

### Impact

The .env and other sensitive files can be leaked if the project root and not `/public` is configured as the web root.

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

You should always use `/public` as the web root.

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Vulnerability: GHSA-2ccx-2gf3-8xvv
Summary: .dev domains and some reverse proxy setups were treated as local in Kirby
Aliases: CVE-2020-26253
Severity: MODERATE
CWE: CWE-346
Published: 2021-01-14T19:15:19Z

### Impact

#### About our registration block

In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. 

In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk.

To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. 

#### The issue

As noted by [Jukka Rautanen](https://github.com/jukra), this installation block implementation in Kirby versions before 3.3.6 still assumed that .dev domains are local domains, which is no longer true. In the meantime, those domains became publicly available. This means that our installation block is no longer working as expected if you use a .dev domain for your Kirby site.

In fixing this issue, we've also found out that the local installation check may also fail if your site is behind a reverse proxy. 

#### Am I affected?

You are only affected if:

1. you use a .dev domain or your site is behind a reverse proxy &
2. you have not yet registered your first Panel account on the public server & 
3. someone finds your site and tries to login at `yourdomain.dev/panel` before you register your first account.

You are not affected if you have already created one or multiple Panel accounts (no matter if on a .dev domain or behind a reverse proxy).

### Patches

The problem has been patched in [Kirby 2.5.14](https://github.com/getkirby-v2/panel/releases/tag/2.5.14) and [Kirby 3.3.6](https://github.com/getkirby/kirby/releases/tag/3.3.6). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

**Note:** Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

### Workarounds

Kirby 2 sites on older releases can also be patched by applying the [changes from this commit](https://github.com/getkirby-v2/panel/commit/7f9ac1876bacb89fd8f142f5e561a02ebb725baa).
Vulnerability: GHSA-vvmr-8829-6whx
Summary: CSRF token missing in Symfony
Aliases: CVE-2022-23601
Severity: HIGH
CWE: CWE-352
Published: 2022-02-01T00:46:57Z

Description
-----------

The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user.
When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled.

In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks.

Resolution
----------

Symfony restored the default configuration to enable the CSRF protection by default.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50) for branch 5.3.

Credits
-------

We would like to thank Catalin Dan and David Lochner for reporting the issue and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-g3p2-hfqr-9m25
Summary: Improper file handling in concrete5/core
Aliases: CVE-2021-22968
Severity: MODERATE
CWE: CWE-98
Published: 2021-11-23T17:54:26Z

A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below. The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration. To fix this, a check for allowed file extensions was added before downloading files to a tmp directory
Vulnerability: GHSA-26rr-v2j2-25fh
Summary: Layout XML Arbitrary Code Fix 
Aliases: CVE-2021-32758
Severity: HIGH
CWE: CWE-91
Published: 2021-08-30T17:20:52Z

### Impact
Layout XML enabled admin users to execute arbitrary commands via block methods.
Vulnerability: GHSA-8c76-mxv5-w4g8
Summary: Stored Cross-site Scripting in Microweber
Aliases: CVE-2022-0954
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:48Z

Microweber 1.2.11 and prior contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods.
Vulnerability: GHSA-h86j-6h6m-qjqw
Summary: Cross-Site Request Forgery in remdex/livehelperchat
Aliases: CVE-2021-4049
Severity: LOW
CWE: CWE-352
Published: 2021-12-10T20:26:34Z

An attacker is able to log out a user if a logged-in user visits the attacker's website. While this cannot harm a user's account, it can be a great annoyance and is a valid CSRF.
Vulnerability: GHSA-5mv2-rx3q-4w2v
Summary: Code injection in Twig
Aliases: CVE-2022-23614
Severity: HIGH
CWE: CWE-74
Published: 2022-02-10T22:21:48Z

# Description

When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.

# Resolution

We now disallow calling non Closure in the `sort` filter like we already did for some other filters.

# Credits

We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.
Vulnerability: GHSA-cpxc-67rc-c775
Summary: Cross Site Scripting in baserCMS
Aliases: CVE-2020-15154
Severity: LOW
CWE: CWE-79
Published: 2020-08-28T20:48:12Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS).

* Impact: XSS via Arbitrary script execution.
* Attack vector is: Administrator must be logged in.
* Components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js
* Tested baserCMS Version : 4.3.6 (Latest)
* Affected baserCMS Version : 4.0.0 ~ 4.3.6
* Patches : https://basercms.net/security/20200827

Found by Aquilao Null
Vulnerability: GHSA-769f-539v-f5jg
Summary: PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841
Severity: HIGH
Published: 2020-01-08T03:10:44Z

### Impact

We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).

### Patches

In the [security patch](https://github.com/PrestaShop/gamification/releases/tag/v2.3.2), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com
Vulnerability: GHSA-6m26-25q2-cq46
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0763
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-27T00:00:15Z

Microweber Cross-site Scripting (XSS) - Stored XSS vulnerability on admin page up to version 1.3.
Vulnerability: GHSA-wppj-3pjr-9w79
Summary: crater is vulnerable to Unrestricted Upload of File with Dangerous Type
Aliases: CVE-2021-4080
Severity: HIGH
CWE: CWE-434
Published: 2022-01-21T23:55:11Z

crater is vulnerable to Unrestricted Upload of File with Dangerous Type
Vulnerability: GHSA-553q-hpvp-q8pc
Summary: Server-Side Request Forgery in snipe/snipe-it
Aliases: CVE-2021-4075
Severity: HIGH
CWE: CWE-918
Published: 2021-12-10T20:22:15Z

Admin users on the external network can perform blind POST-based SSRF (issue requests on behalf of the server into the internal network) via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network which can be escalated to higher-impact.
Vulnerability: GHSA-gjq4-69wj-p6pr
Summary: Path traversal in pimcore
Aliases: CVE-2022-0665
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-23T00:00:59Z

The application doesn't perform a check/filter against the value of "importFile" parameter at endpoint "/admin/translation/import". After the API is executed, PHP unlink function will proceed to delete the file.
Vulnerability: GHSA-r7c9-c69m-rph8
Summary: Code Injection in PHPUnit
Aliases: CVE-2017-9841
Severity: CRITICAL
CWE: CWE-94
Published: 2022-03-26T00:19:30Z

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `<?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Vulnerability: GHSA-h9ph-jcgh-gf69
Summary: Cross-site Scripting in Limesurvey
Aliases: CVE-2021-42112
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-12T16:40:28Z

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
Vulnerability: GHSA-4mvc-qc5w-v5qr
Summary: Information disclosure in the Contao back end
Aliases: CVE-2019-19712
Severity: MODERATE
CWE: CWE-276
Published: 2019-12-17T22:53:34Z

### Impact

Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

### Patches

Update to Contao 4.4.46 or 4.8.6.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-frxp-xxx8-hrg6
Summary: Missing Authorization in DayByDay CRM
Aliases: CVE-2022-22108
Severity: MODERATE
CWE: CWE-862
Published: 2022-01-08T00:31:52Z

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
Vulnerability: GHSA-f7q6-xxph-mfm8
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0251
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-27T00:01:26Z

Pimcore prior to version 10.2.10 contains a cross-site scripting vulnerability.
Vulnerability: GHSA-m3xv-x3ph-mq22
Summary: Server-side Template Injection in nystudio107/craft-seomatic
Aliases: CVE-2021-44618
Severity: HIGH
CWE: CWE-94
Published: 2022-03-12T00:00:34Z

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header.
Vulnerability: GHSA-954j-f27r-cj52
Summary: Cleartext storage of session identifier
Aliases: CVE-2020-26228
Severity: HIGH
CWE: CWE-312
Published: 2020-11-23T21:18:36Z

User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system.

### Solution
Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Helmut Hummel who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader as well as TYPO3 contributor Markus Klein who fixed the issue.
Vulnerability: GHSA-2xwq-h7r9-6w27
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3957
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-23T17:59:40Z

Cross site request forgery vulnerability is present in delete functionality of doctor feature. This vulnerability is capable of deleting system logs
Vulnerability: GHSA-cvh5-p6r6-g2qc
Summary: Exposed phpinfo() leadked via documentation files
Aliases: CVE-2021-37704
Severity: MODERATE
CWE: CWE-668, CWE-200
Published: 2021-08-30T16:13:40Z

### Impact
The `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc).

### Patches
Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5.
Older versions such as v5, v4 are not longer supported and will **NOT** be patched.

### Workarounds
Protect the `/vendor` directory from public access.

### References
The first issue revealing this vulnerability is located here: https://github.com/flextype/flextype/issues/567
V6 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/815
V7 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/814
V8 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/813

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues)
* Email us at [security@geolim4.com](mailto:security@geolim4.com)
Vulnerability: GHSA-2q95-593f-g7h7
Summary: OS Command Injection in Centreon
Aliases: CVE-2020-22345
Severity: HIGH
CWE: CWE-78
Published: 2021-09-02T17:16:06Z

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.
Vulnerability: GHSA-54qq-9chj-rxhv
Summary: Cross-site Scripting in LiveHelperChat
Aliases: CVE-2022-0395
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-29T00:00:33Z

LiveHelperChat prior to version 3.93 contains a cross-site scripting vulnerability.
Vulnerability: GHSA-jjp3-m93h-5jm4
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0928
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-12T00:00:34Z

Microweber drag and drop website builder and CMS with e-commerce. Cross-site Scripting (XSS) discovered in microweber prior to 1.2.12. There is currently no known workaround, users are recommended to update to version 1.2.12.
Vulnerability: GHSA-9wrv-g75h-8ccc
Summary: Improper Access Control in Shopware
Aliases: CVE-2022-24872
Severity: HIGH
CWE: CWE-732
Published: 2022-04-22T21:04:27Z

Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 1.500 community extensions. Permissions set to sales channel context by admin-api are still useable within normal user session. We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-c6fg-99pr-25m9
Summary: Uncapped length of skin data fields submitted by players
Severity: HIGH
Published: 2022-01-06T23:53:58Z

### Impact
Some skin data fields (e.g. skinID, geometryName) are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave.

This is problematic due to the 32767 byte limit on `TAG_String`s. If any of these fields exceeds 32767 bytes, an exception will be thrown during data saving, which will cause the server to crash.

Other fields (such as skinGeometryData) are also uncapped, but those have a much larger 2 GB length limit, so this is not a concern for those, particularly considering the decompressed packet size limit of 2 MB.

### Patches
PM3: 958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb
PM4: 6492cac5c10f9fa8443ceddd2191a7b65b73f601

### Workarounds
A plugin may check player skins during `PlayerLoginEvent` and `PlayerSkinChangeEvent` and ensure that the offending fields are not larger than 32767 bytes.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-4r8q-gv9j-3xx6
Summary: Open Redirect
Aliases: CVE-2021-32645
Severity: MODERATE
CWE: CWE-601
Published: 2022-03-18T17:55:07Z

### Impact
In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL.
This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`)

### Patches
Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to.

### Workarounds
There is a simple way to work around the security issue
- Set the `force_https` to every tenant to `false`

### References
https://nvd.nist.gov/vuln/detail/CVE-2018-11784

### For more information
If you have any questions or comments about this advisory:
* Contact us in Discord: https://tenancy.dev/chat
Vulnerability: GHSA-j29f-m23h-3p8p
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0911
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-17T00:00:48Z

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Vulnerability: GHSA-pwwm-pwx2-2hw7
Summary: Generation of Error Message Containing Sensitive Information in Snipe-IT
Aliases: CVE-2022-0622
Severity: MODERATE
CWE: CWE-209
Published: 2022-02-18T00:00:37Z

Snipe-IT prior to version 5.3.11 is vulnerable to Generation of Error Message Containing Sensitive Information.
Vulnerability: GHSA-j4mv-2rv7-v2j9
Summary: Improper Privilege Management in Concrete CMS 
Aliases: CVE-2021-22966
Severity: MODERATE
CWE: CWE-269
Published: 2021-11-23T18:18:07Z

Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below. If a group is granted "view" permissions on the bulkupdate page, then users in that group can escalate to being an administrator with a specially crafted curl. Fixed by adding a check for group permissions before allowing a group to be moved.
Vulnerability: GHSA-q67f-3jq4-mww2
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0831
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
Vulnerability: GHSA-g996-q5r8-w7g2
Summary: Escape validation messages in the PHP templating engine
Aliases: CVE-2019-10909
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-12T23:00:53Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
Vulnerability: GHSA-frqg-7g38-6gcf
Summary: Improper escaping of command arguments on Windows leading to command injection
Aliases: CVE-2021-41116
Severity: HIGH
CWE: CWE-77
Published: 2021-10-05T20:23:18Z

### Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. 

### Patches
1.10.23 and 2.1.9 fix the issue

### Workarounds
None
Vulnerability: GHSA-ghhm-xrwp-75m9
Summary: bookstack is vulnerable to Improper Access Control
Aliases: CVE-2021-4194
Severity: MODERATE
CWE: CWE-668, CWE-284
Published: 2022-01-08T00:34:12Z

bookstack is vulnerable to Improper Access Control
Vulnerability: GHSA-vf7h-6246-hm43
Summary: The disqualify lead action may be executed without CSRF token check
Aliases: CVE-2021-39198
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-19T20:18:54Z

### Summary
The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack.

### Workarounds
There are no workarounds that address this vulnerability.
Vulnerability: GHSA-w8qp-hmh5-4v9v
Summary: Object state limitation has no effect
Severity: CRITICAL
CWE: CWE-281
Published: 2022-04-29T16:22:58Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Vulnerability: GHSA-7rg4-266c-jqw6
Summary: Predictable CSRF tokens in centreon/centreon
Aliases: CVE-2021-28055
Severity: MODERATE
CWE: CWE-330, CWE-352
Published: 2021-06-08T20:12:56Z

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.
Vulnerability: GHSA-w2f4-hxpm-mq98
Summary: bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Aliases: CVE-2021-3915
Severity: HIGH
CWE: CWE-434
Published: 2021-11-15T23:17:37Z

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type.
Vulnerability: GHSA-748f-wv76-x9hg
Summary: Arbitrary file upload in Fork CMS
Aliases: CVE-2021-28931
Severity: HIGH
CWE: CWE-434
Published: 2021-09-08T17:26:26Z

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.
Vulnerability: GHSA-h676-pjr4-hgqx
Summary: Path Traversal in S-Cart
Aliases: CVE-2021-44111
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-12T00:00:42Z

A Directory Traversal vulnerability exists in S-Cart 6.7 via download in sc-admin/backup.
Vulnerability: GHSA-jgjc-332c-8cmc
Summary: SQL injection in phpMyAdmin
Aliases: CVE-2019-18622
Severity: CRITICAL
CWE: CWE-89
Published: 2020-01-16T21:56:15Z

An issue was discovered in phpMyAdmin before 4.9.2. A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.
Vulnerability: GHSA-qq74-vgcf-54c3
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0946
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:01:00Z

ShowDoc is vulnerable to stored cross-site scripting via viva cshtm file upload in in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-9328-7pcw-vw69
Summary: Cross-Site Request Forgery in Moodle
Aliases: CVE-2020-1692
Severity: MODERATE
CWE: CWE-352
Published: 2022-01-06T18:34:53Z

Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.
Vulnerability: GHSA-2xw8-j43j-5vxp
Summary: elgg is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4072
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T21:35:42Z

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-jpwx-ffjq-wr4w
Summary: Content object state fetch functions open to SQL injection
Severity: HIGH
CWE: CWE-89
Published: 2021-09-07T22:54:23Z

### Impact
This Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible.

### Patches
The fix is distributed via Composer, see "Patched versions".
Vulnerability: GHSA-6jmh-9gqm-5xrx
Summary: Cross-Site Request Forgery (CSRF) in livehelperchat
Aliases: CVE-2022-0226
Severity: MODERATE
CWE: CWE-352
Published: 2022-01-26T20:21:03Z

A CSRF issue is found in the audit configuration under settings. It was found that no CSRF token validation is getting done on the server-side. If we remove the CSRF token and keep the CSRF token field empty, the action is getting performed.
Vulnerability: GHSA-7g7r-gr46-q4p5
Summary: Cross-Site Request Forgery in yetiforce
Aliases: CVE-2022-0269
Severity: HIGH
CWE: CWE-352
Published: 2022-01-27T16:21:33Z

Versions of yetiforce 6.3.0 and prior are subject to privilege escalation via a cross site request forgery bug. This allows an attacker to create a new admin account even with SameSite: Strict enabled. This vulnerability can be exploited by any user on the system including guest users.
Vulnerability: GHSA-4r3m-j6x5-48m3
Summary: Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings
Aliases: CVE-2020-15155
Severity: LOW
CWE: CWE-79
Published: 2020-08-28T21:20:42Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.
Vulnerability: GHSA-qr95-4mq5-r3fh
Summary: Phar unserialization vulnerability in phpMussel
Aliases: CVE-2020-4043
Severity: HIGH
CWE: CWE-502
Published: 2020-06-10T19:40:30Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Anyone using >= v1.0.0 < v1.6.0.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes. Upgrading to at least >= v1.6.0 will resolve the problem (though upgrading to v2, which is the current major version, would be preferable, seeing as v1 is kind of old now and will most likely be marked as EoL when v3 is released in the near future).

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Yes. In the package's configuration, disable archive checking by setting `check_archives` to `false` (thus avoiding execution of the affected parts of the codebase entirely).

### References
_Are there any links users can visit to find out more?_

Yes. The vulnerability is documented at [SECURITY.md](https://github.com/phpMussel/phpMussel/security/policy) and also at [#167](https://github.com/phpMussel/phpMussel/issues/167).

### For more information
If you have any questions or comments about this advisory:
* Comment at the issue linked to this advisory, or..
* Contact [the package author](https://github.com/Maikuolan) ([082e6bc1046fab95](https://peegeepee.com/046FAB95)).
Vulnerability: GHSA-qf2g-q4mc-w7rr
Summary: Cross-site Scripting in Fork CMS
Aliases: CVE-2022-0145
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-25T00:00:34Z

Fork CMS prior to 5.11.1 is vulnerable to stored cross-site scripting. When uploading a new module, the description of the module can contain JavaScript code. The JavaScript code may be executed after uploading the new module and looking at the `Details` page.
Vulnerability: GHSA-43jj-2rwc-2m3f
Summary: Broken access control on files
Aliases: CVE-2019-14273
Severity: MODERATE
CWE: CWE-552
Published: 2020-07-15T17:38:04Z

In SilverStripe assets 4.0, there is broken access control on files.
Vulnerability: GHSA-jf9v-q8vh-3fmc
Summary: Cross-site scripting in ICEcoder
Aliases: CVE-2021-32106
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-09T17:11:11Z

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
Vulnerability: GHSA-p8q8-jfcv-g2h2
Summary: Directory Traversal in Archive_Tar
Aliases: CVE-2021-32610
Severity: HIGH
CWE: CWE-59
Published: 2021-08-09T20:40:06Z

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
Vulnerability: GHSA-9w7h-3wwh-6m5q
Summary: Cross-site Scripting in Microweber
Aliases: CVE-2022-1439
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-23T00:03:02Z

Microweber prior to 1.2.15 is vulnerable to reflected cross-site scripting on demo.microweber.org/demo/module/. This allows the execution of arbitrary JavaScript as the attacked user.
Vulnerability: GHSA-gcvv-gq92-x94r
Summary: Authenticated server-side request forgery in file upload via URL.
Aliases: CVE-2021-37711
Severity: HIGH
CWE: CWE-918
Published: 2021-08-23T19:42:49Z

### Impact
Authenticated server-side request forgery in file upload via URL.

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-c383-q5vf-hx55
Summary: Integer Overflow or Wraparound in Microweber
Aliases: CVE-2022-0913
Severity: HIGH
CWE: CWE-190
Published: 2022-03-12T00:00:36Z

Microweber prior to 1.2.12 is vulnerable to Integer Overflow or Wraparound.
Vulnerability: GHSA-6gv9-7q4g-pmvm
Summary: Persistent XSS in customer module in Shopware
Severity: LOW
CWE: CWE-79
Published: 2020-11-13T15:47:36Z

### Impact
Persistent XSS in customer  module

### Patches

We recommend updating to the current version 5.6.9. You can get the update to 5.6.9 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-11-2020
Vulnerability: GHSA-3q55-66g3-p8xq
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0926
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-fwh7-v4gf-xv7w
Summary: yetiforcecrm is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4116
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-16T21:00:45Z

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').