TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-3v43-877x-qgmq
Summary: Moderate severity vulnerability that affects league/commonmark
Aliases: CVE-2019-10010
Severity: MODERATE
CWE: CWE-79
Published: 2019-09-17T22:47:47Z

## CVE-2019-10010

### Impact

In `league/commonmark` 0.18.2 and below, malicious users can insert double-encoded HTML entities into their Markdown like this:

```md
[XSS](javascript&amp;colon;alert%28&#039;XSS&#039;%29)
```

This library would (correctly) unescape the `&amp;` entity to `&` during the parsing step.  However, **the renderer step would fail to properly re-escape the resulting `&colon;` string**, thus producing the following malicious HTML output:

```html
<p><a href="javascript&colon;alert('XSS')">XSS</a></p>
```

Browsers would interpret `&colon;` as a `:` character and allow the JS to be executed when the link is clicked.

This vulnerability was present in the upstream library this project was forked from and therefore exists in all prior versions of `league/commonmark`.

### Solution

The new [0.18.3](https://github.com/thephpleague/commonmark/releases/tag/0.18.3) release mirrors [the fix made upstream](https://github.com/commonmark/commonmark.js/commit/c89b35c5fc99bdf1d2181f7f0c9fcb8a1abc27c8) - we no longer attempt to preserve entities when rendering HTML attributes like `href`, `src`, `title`, etc.

The `$preserveEntities` parameter of `Xml::escape()` is therefore no longer used internally, so it has been deprecated and marked for removal in the next major release (0.19.0).

### Credits

 - Mohit Fawaz for identifying the issue
 - Sebastiaan Knijnenburg and Ross Tuck for responsibly disclosing/relaying the issue
 - John MacFarlane for investigating it and implementing the upstream fix we mirrored here

### References

 - https://nvd.nist.gov/vuln/detail/CVE-2019-10010
 - https://github.com/thephpleague/commonmark/releases/tag/0.18.3
 - https://github.com/thephpleague/commonmark/issues/353
- https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2019-10010.yaml
Vulnerability: GHSA-p7v4-gm6j-cw9m
Summary: XSS in Mautic
Aliases: CVE-2021-3142
Severity: HIGH
CWE: CWE-79
Published: 2021-01-29T20:51:20Z

### Impact
This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed.

This vulnerability was reported by Dardan Prebreza at Bishop Fox.

### Patches
Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

### Workarounds
None

### References
https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4

### For more information
If you have any questions or comments about this advisory:
* Post in https://forum.mautic.org/c/support
* Email us at security@mautic.org
Vulnerability: GHSA-pjj4-jjgc-h3r8
Summary: Authenticated remote code execution
Severity: MODERATE
CWE: CWE-74
Published: 2021-03-12T23:09:24Z

### Impact
Authenticated remote code execution using plugin manager without ACL permissions.

### Patches
We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021
Vulnerability: GHSA-ppfm-rj6p-38q6
Summary: Improper Authorization in librenms
Aliases: CVE-2022-0587
Severity: HIGH
CWE: CWE-285
Published: 2022-02-16T00:01:53Z

Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-h58v-g3q6-q9fx
Summary: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu
Aliases: CVE-2021-41169
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-22T16:20:53Z

### Impact

_What kind of vulnerability is it? Who is impacted?_

It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form.
Only admin users are affected and only admin users can create tags.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

The problem is patched with Version 1.6.42.

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Create a custom request listener to avoid that this kind of tags are created.

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [sulu/sulu repository](https://github.com/sulu/sulu/issues)
* Email us at [security@sulu.io](mailto:security@sulu.io)
Vulnerability: GHSA-6whf-q6p5-84wg
Summary: Improper Access Control in Webauthn Framework
Aliases: CVE-2021-38299
Severity: CRITICAL
CWE: CWE-863
Published: 2021-09-29T17:16:07Z

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
Vulnerability: GHSA-4h44-w6fm-548g
Summary: Potential Remote Code Execution in TYPO3 with mediace extension
Aliases: CVE-2020-15086
Severity: HIGH
CWE: CWE-502, CWE-325, CWE-20, CWE-200
Published: 2020-07-29T16:15:12Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1)
> * CWE-325, CWE-20, CWE-200, CWE-502

### Problem
It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below.

* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007), [CVE-2020-15099](https://nvd.nist.gov/vuln/detail/CVE-2020-15099): Potential Privilege Escalation
  + the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network)
  + `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5, high)
* [TYPO3-CORE-SA-2016-013](https://typo3.org/security/advisory/typo3-core-sa-2016-013), [CVE-2016-5091](https://nvd.nist.gov/vuln/detail/CVE-2016-5091): Insecure Deserialization & Remote Code Execution
  + an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation
  + `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1, critical)

The overall severity of this vulnerability is critical (9.1) based on mentioned attack chains and the fact it does not require any privileges.

### Solution
In case the extension is not used and required at all, it is suggested to uninstall and remove it from the system completely. Otherwise, an updated version 7.6.5 is available from the TYPO3 extension manager, Packagist and the TYPO3 extension repository:

* https://extensions.typo3.org/extension/download/mediace/7.6.5/zip/
* https://packagist.org/packages/friendsoftypo3/mediace#7.6.5

As a precautionary measure it is advised to change `encryptionKey` and database credentials in `typo3conf/LocalConfiguration.php`.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-EXT-SA-2020-014](https://typo3.org/security/advisory/typo3-ext-sa-2020-014)
Vulnerability: GHSA-2p89-ppc2-mrq4
Summary: Cross site scripting in getgrav/grav
Aliases: CVE-2022-0743
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-02T00:00:22Z

User input is not properly sanitized leading to cross site scrpting (xss) in grav.
Vulnerability: GHSA-pqg8-crx9-g8m4
Summary: Backend Same-Site Request Forgery in TYPO3 CMS
Aliases: CVE-2020-11069
Severity: HIGH
CWE: CWE-346, CWE-352
Published: 2020-05-13T23:40:09Z

> ### Meta
> * CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
> * CWE-352
> * CWE-346

### Problem
It has been discovered that backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session.

In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it’s actually a same-origin request forgery.

Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location.

The attacked victim requires an active and valid backend or install tool user sessions at the time of the attack to be successful.

### Solution
Update to TYPO3 versions 9.5.17 or 10.4.2 that mitigates the problem described.

### Additional Considerations

The deployment of additional mitigation techniques is suggested as described below.

#### Sudo Mode Extension

This TYPO3 extension intercepts modifications to security relevant database tables, e.g. those storing user accounts or storages of the file abstraction layer. Modifications need to confirmed by again by the acting user with providing their password again - this technique is known as "sudo mode". This way unintended actions happening in the background can be mitigated.

* https://github.com/FriendsOfTYPO3/sudo-mode
* https://extensions.typo3.org/extension/sudo_mode

#### Content Security Policy

[Content Security Policies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) tell (modern) browsers how resources served a particular site are handled - it also it possible to disallow script executions for specific locations. In a TYPO3 context it is suggested to disallow direct script execution at least for locations `/fileadmin/` and `/uploads/`.

```
# in fileadmin/.htaccess
<IfModule mod_headers.c>
	Header add Content-Security-Policy "default-src 'self'; script-src 'none';"
</IfModule>
```

### Credits
Thanks to Matteo Bonaker who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-006
Vulnerability: GHSA-cj8p-53v9-2c26
Summary: Cross-site Scripting in Bolt
Aliases: CVE-2019-15485
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-08T15:28:11Z

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.
Vulnerability: GHSA-vxhx-gmhm-623c
Summary: Improper Access Control in moodle
Aliases: CVE-2020-25698
Severity: HIGH
CWE: CWE-284
Published: 2021-03-29T20:42:46Z

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Vulnerability: GHSA-rp34-85x3-3764
Summary: Cross-site Scripting in librenms
Aliases: CVE-2022-0576
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-15T00:02:47Z

Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
Vulnerability: GHSA-5hfj-r725-wpc4
Summary: Arbitrary code execution in october/system
Aliases: CVE-2021-32650
Severity: HIGH
CWE: CWE-74
Published: 2022-01-14T21:08:26Z

### Impact

Assuming an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents PHP execution in the CMS templates.

### Patches

Issue has been patched in Build 473 and v1.1.6

### Workarounds

Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade.

### References

Credits to:
• Sushi Yushi

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-qpv2-jxc7-3638
Summary: Exposure of Sensitive Information in snipe/snipe-it
Aliases: CVE-2022-0569
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-15T00:02:47Z

Snipe-IT prior to v5.3.10 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.
Vulnerability: GHSA-r992-xph6-h7x2
Summary: Open redirect in microweber
Aliases: CVE-2022-0560
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-12T00:00:48Z

microweber prior to 1.2.11 is vulnerable to open redirect.
Vulnerability: GHSA-v92m-hhhw-vv9v
Summary: Code injection in codiad
Aliases: CVE-2019-19208
Severity: CRITICAL
CWE: CWE-94
Published: 2021-09-01T18:27:12Z

Codiad Web IDE through 2.8.4 allows PHP Code injection.
Vulnerability: GHSA-vm37-j55j-8655
Summary: OS Command Injection in Microweber
Aliases: CVE-2022-0557
Severity: HIGH
CWE: CWE-78
Published: 2022-02-12T00:00:49Z

Microweber is a content management system with drag and drop. Prior to version 1.2.11, Microweber is vulnerable to OS Command Injection.
Vulnerability: GHSA-83vp-6jqg-6cmr
Summary: Incorrect Authentication in shopware
Aliases: CVE-2022-24748
Severity: MODERATE
CWE: CWE-287
Published: 2022-03-10T18:02:14Z

### Impact
Modify Customers, create Orders without App Permission

## Patches
We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-32wr-8wxm-852c
Summary: Deserialization of Untrusted Data in NukeViet
Aliases: CVE-2019-7725
Severity: CRITICAL
CWE: CWE-502
Published: 2021-06-22T15:24:59Z

includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serialization format when JSON can be used to eliminate the risk).
Vulnerability: GHSA-rgp5-m2pq-3fmg
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0690
Severity: HIGH
CWE: CWE-79
Published: 2022-02-20T00:00:31Z

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-q9p4-qfc8-fvpp
Summary: SQL Injection in medoo
Aliases: CVE-2019-10762
Severity: CRITICAL
CWE: CWE-89
Published: 2021-10-12T16:32:38Z

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
Vulnerability: GHSA-vj9x-w7ch-f46p
Summary: pimcore is vulnerable to SQL Injection
Aliases: CVE-2022-0258
Severity: HIGH
CWE: CWE-89
Published: 2022-01-21T23:50:08Z

pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Vulnerability: GHSA-xjp4-6w75-qrj7
Summary: Remote CLI Command Execution Vulnerability in CodeIgniter4
Aliases: CVE-2022-24711
Severity: CRITICAL
CWE: CWE-94, CWE-20
Published: 2022-03-01T21:44:13Z

### Impact
This vulnerability allows attackers to execute CLI routes via HTTP request.

### Patches
Upgrade to v4.1.9 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-g8rg-7rpr-cwr2
Summary: Information Disclosure in TYPO3 extension sf_event_mgt
Aliases: CVE-2020-25026
Severity: MODERATE
CWE: CWE-863
Published: 2020-09-02T18:03:26Z

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. 

Another missing access check in the backend module allows an authenticated backend user to send emails to event participants for events which the user does not have access to, resulting in Broken Access Control.

External reference: [https://typo3.org/security/advisory/typo3-ext-sa-2020-017](https://typo3.org/security/advisory/typo3-ext-sa-2020-017)
Vulnerability: GHSA-5mj6-3cmq-fh34
Summary: showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
Aliases: CVE-2022-0079
Severity: MODERATE
CWE: CWE-209
Published: 2022-01-06T22:22:46Z

showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
Vulnerability: GHSA-g5rr-p69h-7v3g
Summary: Insufficient type validation in pocketmine/pocketmine-mp
Severity: HIGH
CWE: CWE-1287, CWE-20
Published: 2022-04-22T20:57:12Z

When an inventory interaction is performed (e.g. moving an item around an inventory), the client sends a serialized version of the itemstack to the server, which the server then deserializes and compares against its own copy. If the copies don't match, the transaction is invalid. This involves deserializing item NBT from the client, which allows for bogus data to be provided. Usually, this is harmless, but in this particular case, it could result in crashes on certain types of bad data (e.g. incorrect ListTag type provided for the `CanDestroy` tag). This is fixed in 4.2.9 by commit 5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2. It's non-trivial to workaround this, but can be done by handling `InventoryTransactionPacket` and `PlayerAuthInputPacket` to scrub inbound transaction data of bogus NBT that would cause these crashes.
Vulnerability: GHSA-h9q8-5gv2-v6mg
Summary: Potential Session Hijacking
Severity: LOW
CWE: CWE-613
Published: 2021-03-12T23:09:08Z

### Impact
Potential session hijacking of store customers.

### Patches
We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-03-2021
Vulnerability: GHSA-33wf-4crm-2322
Summary: Improper Access Control in librenms
Aliases: CVE-2022-0580
Severity: HIGH
CWE: CWE-284
Published: 2022-02-16T00:01:58Z

Improper Access Control in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-wph3-44rj-92pr
Summary: Multiple vulnerabilities leading to RCE
Aliases: CVE-2021-32682
Severity: CRITICAL
CWE: CWE-918, CWE-22, CWE-78
Published: 2021-06-16T17:04:29Z

### Impact

We recently fixed several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with the minimal configuration. 

### Patches

The issues were addressed in our last release, 2.1.59. 

### Workarounds

If you can't update to 2.1.59, make sure your connector is not exposed without authentication.

### Reference

Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
    - The original reporters, by sending an email to vulnerability.research@sonarsource.com;
    - The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-636j-7x7r-gvw2
Summary: Old sessions not blocked by login enable function in Snipe-IT
Aliases: CVE-2022-1155
Severity: HIGH
CWE: CWE-613
Published: 2022-03-31T00:00:22Z

Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using the KillAllSessions console command, clearing the contents of the storage/framework/sessions directory, or changing the cookie name, but all of those options logout ALL users, which could be kind of annoying. This issue is fixed in versions 6.0.0-RC-6 and 5.4.2.
Vulnerability: GHSA-5pv8-ppvj-4h68
Summary: Prevent user enumeration using Guard or the new Authenticator-based Security
Aliases: CVE-2021-21424
Severity: MODERATE
CWE: CWE-200
Published: 2021-05-13T20:23:02Z

Description
-----------

The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.

Resolution
----------

We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011) for branch 3.4.

Credits
-------

I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Vulnerability: GHSA-4v37-24gm-h554
Summary: Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
Aliases: CVE-2022-24712
Severity: MODERATE
CWE: CWE-352
Published: 2022-03-01T21:47:28Z

### Impact
This vulnerability might allow remote attackers to bypass the CodeIgniter4 CSRF protection mechanism. 

### Patches
Upgrade to v4.1.9 or later.

### Workarounds
These are workarounds for this vulnerability, but **you will still need to code as these after upgrading to v4.1.9**.
Otherwise, the CSRF protection may be bypassed.

#### When Auto-Routing is Enabled
1. Check the request method in the controller method before processing.

E.g.:
```php
        if (strtolower($this->request->getMethod()) !== 'post') {
            return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
        }
```

#### When Auto-Routing is Disabled
Do one of the following:
1. Do not use `$routes->add()`, and [use HTTP verbs in routes](https://codeigniter4.github.io/userguide/incoming/routing.html#using-http-verbs-in-routes).
2. Check the request method in the controller method before processing.

E.g.:
```php
        if (strtolower($this->request->getMethod()) !== 'post') {
            return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
        }
```

### References
- [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html#cross-site-request-forgery-csrf)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-pfj7-w373-gqch
Summary: Cross-Site Request Forgery in firefly-iii
Aliases: CVE-2021-3900
Severity: MODERATE
CWE: CWE-352
Published: 2021-10-28T23:14:21Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-x92h-wmg2-6hp7
Summary: Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
Aliases: CVE-2019-10913
Severity: CRITICAL
CWE: CWE-79, CWE-89
Published: 2019-12-02T18:10:24Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
Vulnerability: GHSA-34fr-fhqr-7235
Summary: Information Disclosure in User Authentication
Aliases: CVE-2021-32767
Severity: MODERATE
CWE: CWE-532
Published: 2021-07-26T21:16:28Z

> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
It has been discovered that user credentials have been logged as plaintext when explicitly using log level debug, which is not the _default_ configuration.

### Solution
Update to TYPO3 versions 7.6.52 ELTS, 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to Ingo Schmitt who reported this issue, and to TYPO3 core & security team member Benni Mack who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-012](https://typo3.org/security/advisory/typo3-core-sa-2021-012)
Vulnerability: GHSA-8gv3-3j7f-wg94
Summary: Potential Remote Code Execution vulnerability
Aliases: CVE-2020-15227
Severity: HIGH
CWE: CWE-94, CWE-74
Published: 2020-10-02T16:22:19Z

Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. 

Reported by Cyku Hong from DEVCORE (https://devco.re)

### Impact
Code injection, possible remote code execution.

### Patches
Fixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13
Vulnerability: GHSA-65mj-7c86-79jf
Summary: Authentication Bypass in ADOdb/ADOdb
Aliases: CVE-2021-3850
Severity: CRITICAL
CWE: CWE-287, CWE-305
Published: 2022-01-27T15:23:19Z

### Impact

An attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes.

Depending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server's IP address, etc.

### Patches

The vulnerability is fixed in ADOdb versions 5.20.21 (952de6c4273d9b1e91c2b838044f8c2111150c29) and 5.21.4 or later (b4d5ce70034c5aac3a1d51d317d93c037a0938d2).

The simplest patch is to delete line 29 in `drivers/adodb-postgres64.inc.php`:

```php
diff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php
index d04b7f67..729d7141 100644
--- a/drivers/adodb-postgres64.inc.php
+++ b/drivers/adodb-postgres64.inc.php
@@ -26,7 +26,6 @@ function adodb_addslashes($s)
 {
    $len = strlen($s);
    if ($len == 0) return "''";
-   if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted
 
    return "'".addslashes($s)."'";
 }
```

### Workarounds

Ensure the parameters passed to *ADOConnection::connect()* or related functions (_nConnect()_, _pConnect()_) are not surrounded by single quotes.

### Credits

Thanks to **Emmet Leahy** (@meme-lord) of Sorcery Ltd for reporting this vulnerability, and to the [huntr](https://huntr.dev/) team for their support.

### References

- Original issue report https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c/
- ADOdb reference issue #793 

### For more information

If you have any questions or comments about this advisory:
* Add a note in issue #793
* Contact the maintainers on [Gitter](https://gitter.im/adodb/adodb)
Vulnerability: GHSA-cfcv-q4qq-2ph4
Summary: CKEditor 4 vulnerabilities in versions <4.16.1
Severity: MODERATE
Published: 2021-08-23T19:42:05Z

Details see: 

https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 )
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-7889-rm5j-hpgg  ( CVE-2021-32809 )

Patch: 
https://github.com/pimcore/pimcore/pull/10032
Vulnerability: GHSA-x5jp-9fmm-m9pf
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3683
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-15T23:13:52Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-x7p5-p2c9-phvg
Summary: Unexpected database bindings
Severity: HIGH
CWE: CWE-74
Published: 2021-02-02T15:47:08Z

This is a follow-up to the previous security advisory (GHSA-3p32-j457-pg5x) which addresses a few additional edge cases.

If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.
Vulnerability: GHSA-52qp-jpq7-6c54
Summary: Insecure Deserialization of untrusted data in rmccue/requests
Aliases: CVE-2021-29476
Severity: CRITICAL
CWE: CWE-502
Published: 2021-04-29T21:52:30Z

### Impact
Unserialization of untrusted data.

### Patches
The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.

### References
Publications about the vulnerability:
* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
* https://github.com/ambionics/phpggc/issues/52
* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/
* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
* https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf
* https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f

Originally fixed in WordPress 5.5.2:
* https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
* https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/

Related Security Advisories:
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032
* https://nvd.nist.gov/vuln/detail/CVE-2020-28032

Notification to the Requests repo including a fix in:
* https://github.com/rmccue/Requests/pull/421 and
* https://github.com/rmccue/Requests/pull/422

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Request](https://github.com/WordPress/Requests/)
Vulnerability: GHSA-m7h5-fjjq-559f
Summary: SQL Injection in topthink/thinkphp
Aliases: CVE-2020-20120
Severity: CRITICAL
CWE: CWE-89
Published: 2021-09-30T17:11:11Z

ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.
Vulnerability: GHSA-hr3h-x6gq-rqcp
Summary: Cross site scripting via HTML attributes in the back end
Aliases: CVE-2021-35955
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-25T14:45:01Z

### Impact

It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview (back end) and on the website (front end).

Installations are only affected if there are untrusted back end users who have the rights to modify HTML fields (e.g. TinyMCE).

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7

### Workarounds

Disable all fields that allow HTML for untrusted back end users or disable the login for these users.

### References

https://contao.org/en/security-advisories/cross-site-scripting-via-html-attributes-in-the-back-end.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

### Credits

Thanks to Mikhail Khramenkov and Moritz Vondano for reporting this security issue.
Vulnerability: GHSA-57hg-26h7-9qgv
Summary: pimcore is vulnerable to Cross-site Scripting
Aliases: CVE-2022-0256
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T23:48:07Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-vx8q-j7h9-vf6q
Summary: Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin
Aliases: CVE-2022-0813
Severity: HIGH
CWE: CWE-200
Published: 2022-03-11T00:02:24Z

PhpMyAdmin before 5.1.3 allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
Vulnerability: GHSA-h2rj-8wgg-mm43
Summary: Cross-site Scripting in craftcms
Aliases: CVE-2021-32470
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-18T17:53:37Z

Craft CMS before 3.6.13 has an XSS vulnerability.
Vulnerability: GHSA-cg3q-59w7-rvc2
Summary: Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
Aliases: CVE-2021-3818
Severity: MODERATE
CWE: CWE-565
Published: 2021-09-29T17:12:51Z

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability in one application to cause a compromise in another.
Vulnerability: GHSA-427q-jp8v-ww95
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3976
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-23T18:16:50Z

CSRF related to duplicate action. (the duplication occurs first before redirecting to edit form). This vulnerability is capable of tricking admin users to duplicate teams.
Vulnerability: GHSA-gr23-g276-xc73
Summary: Cross Site Request Forgery in concrete5/concrete5 
Aliases: CVE-2021-22954
Severity: HIGH
CWE: CWE-352
Published: 2022-02-11T00:00:58Z

A cross-site request forgery vulnerability exists in Concrete CMS <v9 that could allow an attacker to make requests on behalf of other users.
Vulnerability: GHSA-wq3r-jwrq-xg6w
Summary: Canceling of orders not related to the logged-in user
Severity: MODERATE
Published: 2021-06-28T16:57:23Z

### Impact
Canceling of orders not related to the logged-in user

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-v384-jqmq-fc74
Summary: XSS in Dolibarr ERP & CRM
Aliases: CVE-2020-7996
Severity: MODERATE
CWE: CWE-79
Published: 2020-01-28T22:26:16Z

htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
Vulnerability: GHSA-j739-gw6q-f4c7
Summary: HTML Injection in Froxlor
Aliases: CVE-2020-29653
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-14T00:00:19Z

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.
Vulnerability: GHSA-hjhp-hwfj-hwf3
Summary: Cross Site Request Forgery in firefly-iii 
Aliases: CVE-2021-4005
Severity: MODERATE
CWE: CWE-352
Published: 2021-12-10T20:20:08Z

firefly-iii is vulnerable to a Cross-Site Request Forgery (CSRF) attack which can disable two factor authentication for the target user.
Vulnerability: GHSA-hq3v-rg6f-6hx4
Summary: Use of Insufficiently Random Values in yiisoft/yii2-dev
Aliases: CVE-2021-3689
Severity: HIGH
CWE: CWE-330
Published: 2021-09-01T18:35:34Z

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Vulnerability: GHSA-8w3x-r6x7-c5r5
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2021-4084
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-16T14:28:27Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-pgcp-m69h-p2gr
Summary: Cross-site Scripting (XSS) in moodle
Aliases: CVE-2020-25702
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-29T20:43:08Z

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.
Vulnerability: GHSA-h58v-c6rf-g9f7
Summary: Cross site scripting in the system log
Aliases: CVE-2021-35210
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-01T17:00:04Z

### Impact

It is possible to inject code into the `tl_log` table that will be executed in the browser when the system log is called in the back end.

### Patches

Update to Contao 4.9.16 or 4.11.5.

### Workarounds

Disable the system log module in the back end for all users (especially admin users).

### References

https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-gmrf-99gw-vvwj
Summary: /user/sessions endpoint allows detecting valid accounts
Severity: HIGH
CWE: CWE-203
Published: 2021-03-11T17:42:08Z

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
Vulnerability: GHSA-6268-v434-45m5
Summary: Cross-site Scripting in Grav
Aliases: CVE-2019-16126
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-08T20:06:08Z

Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
Vulnerability: GHSA-r6cm-wg48-rh2r
Summary: Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
Aliases: CVE-2022-0482
Severity: CRITICAL
CWE: CWE-863, CWE-359
Published: 2022-03-10T00:00:40Z

The software is a booking management system that has a public form to place bookings, and a private area for the calendar and management of services, users, settings, etc. There is a backend API that allows data manipulation, including listing the appointments for a specific time range. This happens on this endpoint: /index.php/backend_api/ajax_get_calendar_events Unfortunately, there is no authentication / permissions-check on that endpoint, the only required parameters in a POST request are "startDate", "endDate" and "csrfToken". Because the csrfToken can be obtained by any unauthenticated user just visiting the public form (and is valid for the backend as well), any attacker can query the backend API and obtain all sorts of private information about the appointment, in JSON format.
Vulnerability: GHSA-m884-279h-32v2
Summary: Exceptions displayed in non-debug configurations in Symfony
Aliases: CVE-2020-5274
Severity: MODERATE
CWE: CWE-209
Published: 2020-03-30T20:09:31Z

Description
-----------

When `ErrorHandler` renders an exception HTML page, it uses un-escaped properties from the related Exception class to render the stacktrace. The security issue comes from the fact that the stacktraces were also displayed in non-`debug` environments.

Resolution
----------

The `ErrorHandler` class now escapes all properties coming from the related Exception, and the stacktrace is not displayed anymore in non-`debug` environments.

The patches for this issue are available [here](https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad) and [here](https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db) for branch 4.4.

Credits
-------

I would like to thank Luka Sikic for reporting & Yonel Ceruto and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-x5r2-hj5c-8jx6
Summary: SSRF in adminer
Aliases: CVE-2021-21311
Severity: HIGH
CWE: CWE-918
Published: 2021-02-11T20:42:59Z

### Impact
Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected.

### Patches
Patched by ccd2374b, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).

### Workarounds
* Use a single driver version (e.g. `adminer-mysql.php`).
* Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).

### References
https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf

### For more information
If you have any questions or comments about this advisory:
* Comment at ccd2374b.
Vulnerability: GHSA-533p-cp2g-99wp
Summary: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3931
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-15T23:19:09Z

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-6rmq-x2hv-vxpp
Summary: Vulnerable third party libraries in certain configurations of Symfony
Aliases: CVE-2019-6338
Severity: HIGH
CWE: CWE-502
Published: 2019-12-02T18:11:25Z

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details
Vulnerability: GHSA-xg6r-5gx4-qxjm
Summary: invoiceninja is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3977
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T21:58:34Z

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-7xj5-fwqr-5378
Summary: Cross-site Scripting in craftcms/cms
Aliases: CVE-2022-28378
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-04T00:00:54Z

Craft CMS before 3.7.29 allows cross-site scripting.
Vulnerability: GHSA-mw75-qvfr-hpmr
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0938
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:01:01Z

ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-3p9j-442x-hjp7
Summary: Business Logic Errors in microweber
Aliases: CVE-2022-0689
Severity: MODERATE
Published: 2022-02-20T00:00:31Z

microweber prior to 1.2.11 allows multiple uses of a single-use coupon.
Vulnerability: GHSA-pp2h-95hm-hv9r
Summary: Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
Aliases: CVE-2021-37702
Severity: MODERATE
CWE: CWE-1236
Published: 2021-08-30T16:13:13Z

### Impact
Data Object CSV import allows formular injection. 

### Patches
Problem is patched in 10.1.1

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/9992.patch

### References
https://cwe.mitre.org/data/definitions/1236.html
Vulnerability: GHSA-3q5x-7mxp-rp6j
Summary: Remote code execution via vulnerable Symphony dependecy injection
Aliases: CVE-2019-8135
Severity: CRITICAL
CWE: CWE-74
Published: 2019-11-12T22:59:32Z

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.
Vulnerability: GHSA-gj26-g5qf-jrh7
Summary: Cross-site Scripting in librenms
Aliases: CVE-2022-0589
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-16T00:01:51Z

Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
Vulnerability: GHSA-82xf-8h9p-c6qj
Summary: Cross-Site Request Forgery in forkcms
Aliases: CVE-2020-23264
Severity: HIGH
CWE: CWE-352
Published: 2021-06-22T15:23:45Z

Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
Vulnerability: GHSA-4vpc-5jx4-cfqg
Summary: User enumeration leak using switch user functionality in Symfony
Aliases: CVE-2019-18886
Severity: MODERATE
CWE: CWE-203, CWE-200
Published: 2019-12-02T18:09:21Z

An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.
Vulnerability: GHSA-vf4w-fg7r-5v94
Summary: Improper Certificate Validation in phpseclib
Aliases: CVE-2021-30130
Severity: HIGH
CWE: CWE-295, CWE-347
Published: 2021-04-07T20:56:55Z

phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.
Vulnerability: GHSA-5fxv-xx5p-g2fv
Summary: Integer Overflow in microweber
Aliases: CVE-2022-0968
Severity: HIGH
CWE: CWE-190
Published: 2022-03-16T00:00:46Z

Microweber is a new generation CMS with drag and drop. The microweber application allows large characters to insert in the input field "first & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The first name & last name input should be limited to 50 characters or max 100 characters
Vulnerability: GHSA-96v6-hrwg-p378
Summary: Weak Password Requirements in Daybyday CRM
Aliases: CVE-2022-22110
Severity: HIGH
CWE: CWE-521
Published: 2022-01-08T00:31:51Z

In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort.
Vulnerability: GHSA-gprh-7767-cw39
Summary: Code Injection in Bolt CMS
Aliases: CVE-2021-40219
Severity: HIGH
CWE: CWE-94
Published: 2022-04-12T00:00:34Z

Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.
Vulnerability: GHSA-8hcm-jj4x-4gmr
Summary: Cross-site scripting in tribalsystems/zenario
Aliases: CVE-2021-27673
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T20:11:40Z

Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.
Vulnerability: GHSA-2cqg-q7jm-j35c
Summary: snipe-it is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3938
Severity: LOW
CWE: CWE-79
Published: 2021-11-15T23:19:42Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').