TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-cq58-r77c-5jjw
Summary: Cross-site scripting (XSS) from image block content in the site frontend
Aliases: CVE-2021-41258
Severity: MODERATE
CWE: CWE-79, CWE-80
Published: 2021-11-16T17:04:41Z

### Impact

Kirby's [blocks field](https://getkirby.com/docs/reference/panel/fields/blocks) stores structured data for each block. This data is then used in [block snippets](https://getkirby.com/docs/reference/panel/fields/blocks#block-snippets) to convert the blocks to HTML for use in your templates. We recommend to [escape HTML special characters](https://getkirby.com/docs/guide/templates/escaping) against cross-site scripting (XSS) attacks.

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

The default snippet for the [image block](https://getkirby.com/docs/reference/panel/blocks/image) unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source, alt and link fields of the image block, which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site.

This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

You are *not* affected if you don't use the blocks field or specifically the image block in any of your blueprints. You are also protected if you use a custom [block snippet](https://getkirby.com/docs/reference/panel/fields/blocks#block-snippets) that either escapes the printed values or doesn't use them. The attack can only be performed by logged-in users and only surfaces in the site frontend (i.e. in your templates). The Panel itself is unaffected and will not execute JavaScript that was injected into the image block content.

### Patches

We have patched the vulnerability in [Kirby 3.5.8](https://github.com/getkirby/kirby/releases/tag/3.5.8) by escaping special HTML characters in the output from the default image block snippet. Please update to this or a [later version](https://github.com/getkirby/kirby/releases/) to fix the vulnerability.

### Credits

Thanks to Azrul Ikhwan Zulkifli (@azrultech) from BAE Systems AI Vulnerability Research Team for responsibly reporting the identified issue.
Vulnerability: GHSA-4j77-gg36-9864
Summary: Cross-Site Scripting in TYPO3 CMS Link Handling
Aliases: CVE-2020-11065
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-13T23:18:12Z

It has been discovered that link tags generated by `typolink` functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-003
Vulnerability: GHSA-qwmj-72mp-q3m2
Summary: Missing Authorization in TYPO3 extension
Aliases: CVE-2020-12700
Severity: MODERATE
CWE: CWE-862
Published: 2021-07-26T21:34:58Z

The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
Vulnerability: GHSA-5875-p652-2ppm
Summary: Exposure of Resource to Wrong Sphere in microweber
Aliases: CVE-2022-0762
Severity: MODERATE
CWE: CWE-668
Published: 2022-02-27T00:00:16Z

Exposure of Resource to Wrong Sphere in microweber prior to 1.3 allows users to add deleted products to a cart and buy it.
Vulnerability: GHSA-5x33-h32w-6vr2
Summary: Cross site-scripting (XSS) moodle
Aliases: CVE-2020-25628
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-29T20:43:15Z

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Vulnerability: GHSA-vgwr-773q-7j3c
Summary: Path Traversal within joomla/archive zip class
Aliases: CVE-2021-26028
Severity: MODERATE
CWE: CWE-22
Published: 2021-03-24T17:58:13Z

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.
Vulnerability: GHSA-mmjr-5q74-p3m4
Summary: Exposure of Resource to Wrong Sphere in Drupal Core
Aliases: CVE-2020-13670
Severity: HIGH
CWE: CWE-668
Published: 2022-02-12T00:00:47Z

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Vulnerability: GHSA-vvwv-h69m-wg6f
Summary: XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
Aliases: CVE-2019-12331
Severity: HIGH
CWE: CWE-611
Published: 2019-11-20T01:39:57Z

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.
Vulnerability: GHSA-56cx-wf47-hx7w
Summary:  Improper Restriction of Excessive Authentication Attempts
Aliases: CVE-2021-3663
Severity: MODERATE
CWE: CWE-307
Published: 2021-08-09T20:38:37Z

firefly-iii is vulnerable to Improper Restriction of Excessive Authentication Attempts
Vulnerability: GHSA-p4pj-9g59-4ppv
Summary: Remote Code Execution in SyliusResourceBundle
Aliases: CVE-2020-15143
Severity: HIGH
CWE: CWE-917, CWE-74
Published: 2020-08-19T21:04:25Z

### Impact

Request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: `<=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3`.

### Example

```yaml
foo:
    path: /foo/{id}
    defaults:
        _sylius:
            repository:
                method: findSome
                arguments:
                    entity: "expr:service('repository').find($id)"
```

In this case, `$id` can be prepared in a way that calls other services. 

If you visit `/foo/"~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"`, it will result in a following expression `expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"")`, which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

### Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

### Workarounds

The fix requires adding `addslashes` in `ParametersParser::parseRequestValueExpression` to sanitize user input before evaluating it using the expression language.

```php
- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
```

### Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-wv23-pfj7-2mjj
Summary: Authenticated file write leads to remote code execution in october/system
Aliases: CVE-2021-32649
Severity: HIGH
CWE: CWE-74
Published: 2022-01-14T21:08:23Z

### Impact

Assuming an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup.

### Patches

Issue has been patched in Build 473 and v1.1.6

### Workarounds

Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade.

### References

Credits to:
• David Miller

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-mcx4-f5f5-4859
Summary: Prevent cache poisoning via a Response Content-Type header in Symfony
Aliases: CVE-2020-5255
Severity: LOW
CWE: CWE-435
Published: 2020-03-30T20:09:16Z

Description
-----------

When a `Response` does not contain a `Content-Type` header, Symfony falls back to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can lead to a corrupted cache where the cached format is not the right one.

Resolution
----------

Symfony does not use the `Accept` header anymore to guess the `Content-Type`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6) for the 4.4 branch.

Credits
-------

I would like to thank Xavier Lacot from JoliCode for reporting & Yonel Ceruto and Tobias Schultze for fixing the issue.
Vulnerability: GHSA-prg5-hg25-8grq
Summary: Ability to switch channels via GET parameter enabled in production environments
Aliases: CVE-2020-5218
Severity: LOW
CWE: CWE-444
Published: 2020-01-31T18:00:58Z

### Impact

This vulnerability gives the ability to switch channels via the `_channel_code` GET parameter in production environments. This was meant to be enabled only when `%kernel.debug%` is set to true. 

However, if no `sylius_channel.debug` is set explicitly in the configuration, the default value which is `%kernel.debug%` will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false.

### Patches

Patch has been provided for Sylius 1.3.x and newer - **1.3.16, 1.4.12, 1.5.9, 1.6.5**. Versions older than 1.3 are not covered by our security support anymore.

### Workarounds

Unsupported versions could be patched by adding the following configuration to run in production:

```yaml
sylius_channel:
    debug: false
```
Vulnerability: GHSA-43f8-p5w3-5m25
Summary: SSRF by connecting to privileged ports
Aliases: CVE-2018-7667
Severity: MODERATE
CWE: CWE-918
Published: 2021-02-11T21:20:40Z

### Impact
All users are affected.

### Patches
* Unsuccessfully patched by 0fae40fb, included in version [4.4.0](https://github.com/vrana/adminer/releases/tag/v4.4.0).
* Patched by 35bfaa75, included in version [4.7.8](https://github.com/vrana/adminer/releases/tag/v4.7.8).

### Workarounds
Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).

### References
* http://hyp3rlinx.altervista.org/advisories/ADMINER-UNAUTHENTICATED-SERVER-SIDE-REQUEST-FORGERY.txt
* https://sourceforge.net/p/adminer/bugs-and-features/769/
* https://gusralph.info/adminer-ssrf-bypass-cve-2018-7667/ (CVE-2020-28654)

### For more information
If you have any questions or comments about this advisory:
* Comment at 35bfaa75.
Vulnerability: GHSA-9fcc-7g44-mxrj
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0942
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via uploading files with files in `.xsd`, `.asa`, and `.aspx` formats.
Vulnerability: GHSA-g8jx-66p8-vcm2
Summary: SQL injection in pimcore/pimcore
Aliases: CVE-2021-23405
Severity: HIGH
CWE: CWE-89
Published: 2021-07-13T17:42:31Z

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.
Vulnerability: GHSA-m434-m5pv-p35w
Summary: Insufficient user authorization in Moodle
Aliases: CVE-2022-0333
Severity: LOW
CWE: CWE-863
Published: 2022-01-28T22:08:02Z

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Vulnerability: GHSA-q9cp-mc96-m4w2
Summary: XML External Entity in Dashboard Widget
Aliases: CVE-2020-26229
Severity: LOW
CWE: CWE-611
Published: 2020-11-23T21:18:44Z

### Problem
It has been discovered that RSS widgets are susceptible to XML external entity processing.
This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions.

At least with _libxml2_ version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed.

### Solution
Update to TYPO3 version 10.4.10 that fixes the problem described.
Vulnerability: GHSA-jm6p-wfjg-xm7x
Summary: bookstack is vulnerable to Improper Access Control
Aliases: CVE-2021-4026
Severity: MODERATE
CWE: CWE-668, CWE-284
Published: 2021-12-01T18:26:48Z

bookstack is vulnerable to Improper Access Control.
Vulnerability: GHSA-5cmw-fhq9-8fhh
Summary: Type Confusion in LiveHelperChat
Aliases: CVE-2022-1176
Severity: HIGH
CWE: CWE-843
Published: 2022-04-01T00:00:40Z

Live Helper Chat provides live support for your website. Loose comparison causes IDOR on multiple endpoints in LiveHelperChat prior to 3.96. There is a fix released in versions 3.96 and 3.97. Currently, there is no known workaround.
Vulnerability: GHSA-j6jg-w79c-7p8v
Summary: File Upload Restriction Bypass leading to Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0951
Severity: MODERATE
CWE: CWE-79, CWE-434
Published: 2022-03-16T00:00:48Z

ShowDoc prior to 2.10.4 is vulnerable to a file upload restriction bypass leading to stored cross-site scripting.
Vulnerability: GHSA-8xx9-rxrj-2m2w
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2021-4139
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-05T20:35:12Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-94vp-rmqv-5875
Summary: Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
Aliases: CVE-2020-15247
Severity: MODERATE
CWE: CWE-862
Published: 2020-11-23T19:48:27Z

### Impact
An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 469 (v1.0.469) and v1.1.0.

### Workarounds
Apply https://github.com/octobercms/october/compare/106daa2930de4cebb18732732d47d4056f01dd5b...7cb148c1677373ac30ccfd3069d18098e403e1ca to your installation manually if unable to upgrade to Build 469.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">
Vulnerability: GHSA-8mq9-fqv8-59wf
Summary: Cross-Site Scripting in Page Preview
Aliases: CVE-2021-32667
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-22T19:34:43Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.0)

### Problem
Failing to properly encode _Page TSconfig_ settings, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to TYPO3 core merger Oliver Bartsch who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-009](https://typo3.org/security/advisory/typo3-core-sa-2021-009)
Vulnerability: GHSA-8jq6-w5cg-wm45
Summary: Exploitable inventory component chaining in PocketMine-MP
Severity: HIGH
CWE: CWE-400
Published: 2020-11-11T21:38:18Z

### Impact
Specially crafted `InventoryTransactionPacket`s sent by malicious clients were able to exploit the behaviour of `InventoryTransaction->findResultItem()` and cause it to take an abnormally long time to execute (causing an apparent server freeze).

The affected code is intended to compact conflicting `InventoryActions` which are in the same `InventoryTransaction` by flattening them into a single action. When multiple pathways to a result existed, the complexity of this flattening became exponential.

The problem was fixed by bailing when ambiguities are detected.

**At the time of writing, this exploit is being used in the wild by attackers to deny service to servers.**

### Patches
Upgrade to 3.15.4 or newer.

### Workarounds
No practical workarounds are possible, short of backporting the fix or implementing checks in a plugin listening to `DataPacketReceiveEvent`.

### References
c368ebb5e74632bc622534b37cd1447b97281e20

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-c65v-p733-9796
Summary: Cross-site Scripting in snipe/snipe-it
Aliases: CVE-2021-3961
Severity: HIGH
CWE: CWE-79
Published: 2021-11-23T18:17:33Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-6r58-4xgr-gm6m
Summary: Priviledge escalation through cache pollution
Aliases: CVE-2019-12617
Severity: MODERATE
Published: 2019-11-12T23:01:59Z

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
Vulnerability: GHSA-rpxh-vg2x-526v
Summary: List of order ids, number, items total and token value exposed for unauthorized uses via new API
Aliases: CVE-2021-32720
Severity: MODERATE
CWE: CWE-200
Published: 2021-06-29T03:12:04Z

### Impact

Part of the details (order ID, order number, items total, and token value) of all placed orders were exposed to unauthorized users. If exploited properly, a few additional information like the number of items in the cart and the date of the shipping may be fetched as well. This data seems to not be crucial nor is personal data, however, could be used for sociotechnical attacks or may expose a few details about shop condition to the third parties. The data possible to aggregate are the number of processed orders or their value in the moment of time. 

### Patches

The problem has been patched at Sylius 1.9.5 and 1.10.0

### Workarounds
There are a few ways to fix this without updating the code. 

The first possible solution is to hide the problematic endpoints behind the firewall from not logged in users. In order to achieve it one has to add the configuration in `config/packages/security.yaml`:
```yaml
    access_control:
        # ... 
        - { path: "%sylius.security.new_api_shop_regex%/orders", role: IS_AUTHENTICATED_ANONYMOUSLY, methods: [POST] }
        - { path: "%sylius.security.new_api_shop_regex%/orders", role: ROLE_USER, methods: [GET] }
```
This would put only the order list under the firewall and allow only authorized users to access it. Once a user is authorized, it will have access to theirs orders only.

The second possible solution is to decorate the `\Sylius\Bundle\ApiBundle\Doctrine\QueryCollectionExtension\OrdersByLoggedInUserExtension` and throw `Symfony\Component\Security\Core\Exception\AccessDeniedException` if the class is executed for unauthorized user.
Vulnerability: GHSA-f8pv-x7h8-687v
Summary: Cross-site scripting in feehicms
Aliases: CVE-2020-19709
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-30T16:22:25Z

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.
Vulnerability: GHSA-cv25-3gmg-c6m8
Summary: Injection in UserFrosting
Aliases: CVE-2021-25994
Severity: HIGH
CWE: CWE-74
Published: 2022-01-06T22:22:32Z

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Vulnerability: GHSA-674v-3g2w-84gx
Summary: Sandbox bypass in fenom
Aliases: CVE-2021-46433
Severity: CRITICAL
Published: 2022-03-29T00:01:15Z

In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
Vulnerability: GHSA-r6mv-ppjc-4hgr
Summary: PHP file inclusion via insert tags
Aliases: CVE-2021-37626
Severity: MODERATE
CWE: CWE-94
Published: 2021-08-23T19:41:04Z

### Impact

It is possible for untrusted users to load arbitrary PHP files via insert tags.

Installations are only affected if there are untrusted back end users.

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7.

### Workarounds

Disable the login for untrusted back end users.

### References

https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-xm6j-x342-gwq9
Summary: Unpublished files are exposed publicly
Aliases: CVE-2019-16409
Severity: MODERATE
CWE: CWE-200
Published: 2019-11-12T23:01:05Z

In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
Vulnerability: GHSA-rpw6-9xfx-jvcx
Summary: Directory Traversal in Archive_Tar
Aliases: CVE-2020-36193
Severity: HIGH
CWE: CWE-22
Published: 2021-04-22T16:20:36Z

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

:exclamation: Note: There was an [initial fix](https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916) for this vulnerability made in version `1.4.12`. That fix introduced a bug which was [fixed in 1.4.13](https://github.com/pear/Archive_Tar/pull/36). Therefore we have set the first-patched-version to `1.4.13` which the earliest working version that avoids this vulnerability.
Vulnerability: GHSA-j545-frh3-r9gq
Summary: SQL Injection in dolibarr
Aliases: CVE-2022-0224
Severity: HIGH
CWE: CWE-89
Published: 2022-01-21T23:56:39Z

dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Vulnerability: GHSA-6gr8-c3m5-mvrg
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32717
Severity: HIGH
CWE: CWE-200
Published: 2021-09-08T18:00:47Z

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`. When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html. Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities.
Vulnerability: GHSA-79jw-2f46-wv22
Summary: Authenticated remote code execution in October CMS
Aliases: CVE-2022-21705
Severity: HIGH
CWE: CWE-74
Published: 2022-02-23T21:08:44Z

### Impact

An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass  `cms.safe_mode` / `cms.enableSafeMode` in order to execute arbitrary code.

- This issue only affects admin panels that rely on safe mode and restricted permissions.
- To exploit this vulnerability, an attacker must first have access to the backend area.

### Patches

The issue has been patched in Build 474 (v1.0.474) and v1.1.10.

### Workarounds

Apply https://github.com/octobercms/library/commit/c393c5ce9ca2c5acc3ed6c9bb0dab5ffd61965fe to your installation manually if unable to upgrade to Build 474 or v1.1.10.

### References

Credits to:
- David Miller

### For more information

If you have any questions or comments about this advisory:
- Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-cg8j-8w52-735v
Summary: Missing warning can lead to unauthenticated admin access in SilverStripe
Aliases: CVE-2019-12204
Severity: CRITICAL
Published: 2019-11-12T23:01:25Z

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Vulnerability: GHSA-2r3v-q9x3-7g46
Summary: Link injection in SimpleSAMLphp
Severity: LOW
CWE: CWE-74
Published: 2020-01-24T21:27:16Z

### Background
Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.

### Description
The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:

- `www/logout.php`
- `modules/core/www/no_cookie.php`

The issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the `link_href` and `retryURL` HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the `trusted.url.domains` configuration option.

### Affected versions
All SimpleSAMLphp versions prior to 1.14.4.

### Impact
A remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.

### Resolution
Upgrade to the latest version.

### Credit
This security issue was discovered and reported by John Page (hyp3rlinx).
Vulnerability: GHSA-6jhm-4vmx-mr76
Summary: SQL injection in Moodle
Aliases: CVE-2022-0332
Severity: CRITICAL
CWE: CWE-89
Published: 2022-01-28T22:08:14Z

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
Vulnerability: GHSA-4x2f-54wr-4hjg
Summary: Potential Zip Slip Vulnerability in baserCMS
Aliases: CVE-2021-41279
Severity: HIGH
CWE: CWE-22
Published: 2021-12-01T18:29:32Z

There is a OS Command Injection Vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

Target
baserCMS 4.5.3 and earlier versions

Vulnerability
OS Command Injection Vulnerability.

Countermeasures
Update to the latest version of baserCMS

Credits
Daniele Scanu @SoterItSecurity
Vulnerability: GHSA-p62j-hrxm-xcxf
Summary: Book page text, count, and author/title length is not limited in PocketMine-MP
Severity: MODERATE
Published: 2022-01-06T23:53:35Z

### Impact
Players can fill book pages with as many characters as they like; the server does not check this.
In addition, the maximum of 50 pages is also not enforced, meaning that players can create "book bombs".

This causes a variety of problems:
- Oversized NBT on the wire costing excess bandwidth for server and client
- Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific)
- Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)

This does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.

### Patches
The bug has been fixed in 3.26.5 and 4.0.5.

### Workarounds
Ban writable books, or use a plugin to cancel `PlayerEditBookEvent` to cancel the event if `strlen(text) > 1024 || mb_strlen(text) > 256`.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-x28w-hvwc-mp75
Summary: Static Code Injection in Microweber
Aliases: CVE-2022-0895
Severity: HIGH
CWE: CWE-94, CWE-96
Published: 2022-03-11T00:02:35Z

Microweber is a new generation CMS with drag and drop. Prior to version 1.3, Microweber is vulnerable to static code injection.
Vulnerability: GHSA-2frx-j9hj-6c65
Summary: User enumeration in authentication mechanisms
Severity: LOW
CWE: CWE-200
Published: 2021-05-17T20:52:21Z

Description
-----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. 

Resolution
----------

We now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available [here](https://github.com/lexik/LexikJWTAuthenticationBundle/commit/a175d6dab968d93e96a3e4f80c495435f71d5eb7) for branch 2.10.x and 2.x.

Credits
-------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Vulnerability: GHSA-vc5r-xfc4-4x22
Summary: Cross-site Scripting in Pimcore Datahub
Aliases: CVE-2022-0955
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-25T00:00:33Z

Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user's cookie being stolen.
Vulnerability: GHSA-vpmw-77vm-4mjg
Summary: Cross-site Scripting in Cipi
Aliases: CVE-2022-26332
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-02T00:00:21Z

Cipi 3.1.15 allows Add Server stored cross-site scripting via the /api/servers name field.
Vulnerability: GHSA-xpxm-pf7g-2534
Summary: Cross-site scripting in media2click
Aliases: CVE-2021-31778
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T20:11:52Z

The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
Vulnerability: GHSA-mrq4-7ch7-2465
Summary: Server Side Twig Template Injection
Aliases: CVE-2022-21686
Severity: CRITICAL
CWE: CWE-94
Published: 2022-01-27T18:32:47Z

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.
Vulnerability: GHSA-rw98-5846-pqhx
Summary: Open redirect in microweber
Aliases: CVE-2022-0597
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-16T00:01:45Z

Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-qm58-cvvm-c5qr
Summary: Unsafe upload filtering leading to remote code execution
Aliases: CVE-2021-23394
Severity: HIGH
CWE: CWE-434
Published: 2021-06-15T15:51:02Z

### Impact

Before elFinder 2.1.58, the upload filter did not disallow the upload of `.phar` files. As several Linux distributions are now shipping Apache configured in a way it will process these files as PHP scripts, attackers could gain arbitrary code execution on the server hosting the PHP connector (even in minimal configuration).

### Patches

The issue has been addressed with https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1, associating `.phar` files to the right MIME type. Unless explicitly allowed in the configuration, such files cannot be uploaded anymore. This patch is part of the last release of elFinder, 2.1.58.

### Workarounds

If you can't update to 2.1.58, make sure your connector is not exposed without authentication.

### Important tips

Server-side scripts can often be created as text files. Currently, elFinder has an appropriate MIME type set for file extensions that are generally runnable on a web server.

However, the server has various settings. In some cases, the executable file may be judged as "text/plain". Therefore, elFinder installers should understand the extensions that can be executed on the web server where elFinder is installed, and check if there are any missing items in the elFinder settings.

The elFinder PHP connector has an option "additionalMimeMap" that specifies the MIME type for each extension. See [#3295(comment)](https://github.com/Studio-42/elFinder/issues/3295#issuecomment-853042139) for more information.

### References

- https://snyk.io/vuln/composer:studio-42%2Felfinder
- https://github.com/Studio-42/elFinder/issues/3295
- Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to  support [at] snyk.io or vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-qvrv-2x7x-78x2
Summary: Reflected XSS in SilverStripe
Aliases: CVE-2019-19325
Severity: MODERATE
CWE: CWE-78
Published: 2020-02-24T17:33:31Z

SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user&amp;#39;s credentials or other sensitive user input.
Vulnerability: GHSA-29gp-2c3m-3j6m
Summary: Sandbox Escape by math function in smarty
Aliases: CVE-2021-29454
Severity: HIGH
CWE: CWE-74
Published: 2022-01-12T22:43:00Z

### Impact
Template authors could run arbitrary PHP code by crafting a malicious math string.
If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.

### Patches
Please upgrade to 4.0.2 or 3.1.42 or higher.

### References
See [documentation on Math function](https://www.smarty.net/docs/en/language.function.math.tpl).

### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Vulnerability: GHSA-fqx8-v33p-4qcc
Summary: Cross-site Scripting in enshrined/svg-sanitize
Aliases: CVE-2022-23638
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-14T22:54:18Z

### Impact
SVG sanitizer library before version `0.15.0` did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML (fetched as `text/html`) was susceptible to cross-site scripting. Plain SVG files (fetched as `image/svg+xml`) were not affected.

### Patches
This issue is fixed in `0.15.0` and higher.

### Workarounds
There is currently no workaround available without upgrading.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Github](https://github.com/darylldoyle/svg-sanitizer/issues)
* Email us at [daryll@enshrined.co.uk](mailto:daryll@enshrined.co.uk)
Vulnerability: GHSA-rwgm-f83r-v3qj
Summary: Improper Certificate Validation in WP-CLI framework
Aliases: CVE-2021-29504
Severity: CRITICAL
CWE: CWE-295
Published: 2021-05-19T23:03:11Z

### Impact
An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself.

### Patches
The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request.

The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages.

https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change.

Subsequent PRs on the command repositories have added an `--insecure` flag to the appropriate commands on the following repositories to counter the breaking change:

* https://github.com/wp-cli/config-command/pull/128
* https://github.com/wp-cli/core-command/pull/186
* https://github.com/wp-cli/extension-command/pull/287
* https://github.com/wp-cli/checksum-command/pull/86
* https://github.com/wp-cli/package-command/pull/138

### Workarounds
There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0.

The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.

### References
* [CWE: Improper Certificate Validation](https://cwe.mitre.org/data/definitions/295.html)

### For more information
If you have any questions or comments about this advisory:
* Join the `#cli` channel in the [WordPress.org Slack](https://make.wordpress.org/chat/) to ask questions or provide feedback.
Vulnerability: GHSA-5qjq-69w6-fg57
Summary: XSS vulnerability with translator
Aliases: CVE-2021-32671
Severity: CRITICAL
CWE: CWE-79
Published: 2021-06-07T21:48:17Z

Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or documented.

This allowed for any user to type malicious HTML markup within certain user input fields and have this execute on client browsers. The example which led to the discovery of this vulnerability was in the forum search box. Entering faux-malicious HTML markup, such as <script>alert('test')</script> resulted in an alert box appearing on the forum. This attack could also be modified to perform AJAX requests on behalf of a user, possibly deleting discussions, modifying their settings or profile, or even modifying settings on the Admin panel if the attack was targetted towards a privileged user.

### Impact

All Flarum communities that run flarum v1.0.0 or v1.0.1 are impacted.

### Patches

The vulnerability has been fixed and published as flarum/core v1.0.2. All communities running Flarum v1.0 have to upgrade as soon as possible to v1.0.2 using:

```
composer update --prefer-dist --no-dev -a -W
```

You can then confirm you run the latest version using:

```
composer show flarum/core
```

### Workarounds

__None.__

### For more information

For any questions or comments on this vulnerability please visit https://discuss.flarum.org/d/27558.

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing security@flarum.org, and we will address it promptly.
Vulnerability: GHSA-gc45-j3m5-8qfq
Summary: Server-Side Request Forgery in Feehi CMS
Aliases: CVE-2021-30108
Severity: CRITICAL
CWE: CWE-918
Published: 2021-06-08T20:12:32Z

Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Referer header to any url, the server can make a request to it.
Vulnerability: GHSA-46rx-6jg9-4fh8
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-43324
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-08T17:59:15Z

LibreNMS through 21.10.2 allows XSS via a widget title.
Vulnerability: GHSA-2r6j-862c-m2v2
Summary: Unrestricted File Upload in Form Framework
Aliases: CVE-2021-21355
Severity: HIGH
CWE: CWE-434, CWE-552
Published: 2021-03-23T01:53:52Z


### Problem
Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_.

TYPO3 Extbase extensions, which implement a file upload and do not implement a custom _TypeConverter_ to transform uploaded files into _FileReference_ domain model objects are affected by the vulnerability as well, since the _UploadedFileReferenceConverter_ of _ext:form_ handles the file upload and will accept files of any mime-type which are persisted to the default location.

In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information.

No authentication is required to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

Type converter _UploadedFileReferenceConverter_ is not registered globally anymore and just handles uploaded files within the scope of the Form Framework. Guessable storage location has changed from _/fileadmin/user_upload/form\_\<random-hash\>/_ to _/fileadmin/form_uploads/<random-40-bit>_. Allowed mime-types must match expected file extensions (e.g. _application/pdf_ must be _.pdf_, and cannot be _.html_).

Extbase extensions, who rely on the global availability of the _UploadedFileReferenceConverter_ must now implement a custom _TypeConverter_ to handle file uploads or explicitly implement the ext:form _UploadedFileReferenceConverter_ with appropriate setting for accepted mime-types.

### Credits
Thanks to Sebastian Michaelsen, Marc Lindemann, Oliver Eglseder, Markus Volkmer, Jakob Kunzmann, Johannes Regner, Richie Lee who reported this issue, and to TYPO3 core & security team members Oliver Hader & Benni Mack, as well as TYPO3 contributor Ralf Zimmermann who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-002](https://typo3.org/security/advisory/typo3-core-sa-2021-002)
Vulnerability: GHSA-vhgr-gfx3-fg37
Summary: Unrestricted Upload of File with Dangerous Type in WPanel 4
Aliases: CVE-2021-34257
Severity: HIGH
CWE: CWE-434
Published: 2022-04-01T00:00:41Z

Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
Vulnerability: GHSA-4rmr-c2jx-vx27
Summary: Remote code injection in mustache/mustache
Aliases: CVE-2022-0323
Severity: HIGH
CWE: CWE-1336
Published: 2022-01-27T14:51:00Z

In Mustache.php v2.0.0 through v2.14.0, Sections tag can lead to arbitrary php code execution even if strict_callables is true when section value is controllable.
Vulnerability: GHSA-5q58-x5h2-v5rx
Summary: Authenticated Privilege Escalation
Severity: LOW
CWE: CWE-863
Published: 2020-12-21T18:01:08Z

### Impact
Authenticated Privilege Escalation

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020
Vulnerability: GHSA-657m-v5vm-f6rw
Summary: Cross-Site-Request-Forgery in Backend
Aliases: CVE-2021-41113
Severity: MODERATE
CWE: CWE-352, CWE-309
Published: 2021-10-05T20:23:47Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2)

### Problem
It has been discovered that the new TYPO3 v11 feature that allows users to create and share [deep links in the backend user interface](https://typo3.org/article/typo3-version-112-escape-the-orbit#c12178) is vulnerable to cross-site-request-forgery.

The impact is the same as described in [TYPO3-CORE-SA-2020-006 (CVE-2020-11069)](https://typo3.org/security/advisory/typo3-core-sa-2020-006). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system.

To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time.

The following [Same-Site cookie settings](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/8.7.x/Feature-90351-ConfigureTYPO3-shippedCookiesWithSameSiteFlag.html) in _$GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite]_ are required for an attack to be successful:

* _SameSite=_***strict***: malicious evil.**example.org** invoking TYPO3 application at good.**example.org**
* _SameSite=_***lax*** or ***none***: malicious **evil.com** invoking TYPO3 application at **example.org**

### Solution
Update your instance to TYPO3 version 11.5.0 which addresses the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 core & security team members Benni Mack and Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-014](https://typo3.org/security/advisory/typo3-core-sa-2021-014)
* [CVE-2020-11069](https://nvd.nist.gov/vuln/detail/CVE-2020-11069) reintroduced in TYPO3 v11.2.0
Vulnerability: GHSA-w4rc-rx25-8m86
Summary: Improper Input Validation in Symfony
Aliases: CVE-2019-11325
Severity: CRITICAL
CWE: CWE-116
Published: 2020-02-12T18:44:16Z

An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.