TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4p3x-8qw9-24w9
Summary: Authenticated Stored XSS in shopware/shopware
Aliases: CVE-2021-41188
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-27T18:53:18Z

### Impact
Authenticated Stored XSS in Administration

### Patches
Use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### Workarounds
If you cannot use the security plugin, add the following config to your `.htaccess` file

```
<IfModule mod_headers.c>
    <FilesMatch "\.(?i:svg)$">
        Header set Content-Security-Policy "script-src 'none'"
    </FilesMatch>
</IfModule>
```

If you are using nginx as server config, you can add the following to your configuration:
```
server {
    # ...

    location ~* ^.+\.svg$ {
        add_header Content-Security-Policy "script-src 'none'";
    }
}
```

### References
https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021
Vulnerability: GHSA-7wv8-g97r-432h
Summary: Exposure of Sensitive Information to an Unauthorized Actor in microweber
Aliases: CVE-2022-0281
Severity: HIGH
CWE: CWE-200
Published: 2022-01-21T18:06:47Z

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-wrxc-mr2w-cjpv
Summary: Open Redirect in Grav
Aliases: CVE-2020-11529
Severity: MODERATE
CWE: CWE-601
Published: 2022-01-07T00:20:50Z

Common/Grav.php in Grav before 1.6.23 has an Open Redirect.
Vulnerability: GHSA-p885-prv3-m4xv
Summary: Cross-site Scripting in snipe-it
Aliases: CVE-2022-1380
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-17T00:00:32Z

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
Vulnerability: GHSA-8qv8-fq5w-p966
Summary: phpservermon is vulnerable to CRLF Injection
Aliases: CVE-2021-4097
Severity: MODERATE
CWE: CWE-93
Published: 2021-12-16T14:26:00Z

phpservermon is vulnerable to Improper Neutralization of CRLF Sequences.
Vulnerability: GHSA-7q44-r25x-wm4q
Summary: Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows
Aliases: CVE-2021-34551
Severity: HIGH
CWE: CWE-94, CWE-434
Published: 2021-06-22T15:17:51Z

PHPMailer 6.4.1 contains a possible remote code execution vulnerability through the `$lang_path` parameter of the `setLanguage()` method. If the `$lang_path` parameter is passed unfiltered from user input, it can be set to [a UNC path](https://docs.microsoft.com/en-us/dotnet/standard/io/file-path-formats#unc-paths), and if an attacker is also able to create a remote mount on the server that the UNC path points to, a script file under their control may be executed. 

### Impact
Arbitrary code may be run by a remote attacker under the web server or PHP process running on Window hosts.

### Patches
Mitigated in PHPMailer 6.5.0 by no longer treating translation files as PHP code, but by parsing their text content directly.
This approach avoids the possibility of executing unknown code while retaining backward compatibility. This isn't ideal, so the current translation format is deprecated and will be replaced in the next major release.

### Workarounds
Any of:
* Ensure that calling code does not pass unfiltered user-supplied data to the `$lang_path` parameter of the `setLanguage()` method.
* Block or filter the use of unknown UNC paths in this parameter (or altogether).
* Ensure that unauthorised users do not have the ability to read from unknown remote servers via UNC paths.
* Run on an OS that does not support UNC paths

### References
[CVE-2021-34551](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-34551).

Reported by [listensec.com](https://listensec.com) via Tidelift.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [PHPMailer](https://github.com/PHPMailer/PHPMailer)
* [Email the maintainers](mailto:phpmailer@synchromedia.co.uk)
Vulnerability: GHSA-fcr8-6q7r-m4wg
Summary: Bypass of fix for CVE-2020-26231, Twig sandbox escape
Aliases: CVE-2021-21264
Severity: MODERATE
CWE: CWE-862
Published: 2021-05-04T17:42:33Z

### Impact
A bypass of CVE-2020-26231 (fixed in 1.0.470/471 and 1.1.1) was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247:

An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 472 (v1.0.472) and v1.1.2.

### Workarounds
Apply https://github.com/octobercms/october/commit/f63519ff1e8d375df30deba63156a2fc97aa9ee7 to your installation manually if unable to upgrade to Build 472 or v1.1.2.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">
Vulnerability: GHSA-xvvv-wj7j-r9jm
Summary: Cross-site Scripting in Netgen Tags Bundle
Aliases: CVE-2021-45895
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T22:04:19Z

Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.
Vulnerability: GHSA-w4f3-7f7c-x652
Summary: SQL Injection in tribalsystems/zenario 
Aliases: CVE-2021-26830
Severity: CRITICAL
CWE: CWE-89
Published: 2022-03-18T17:49:01Z

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
Vulnerability: GHSA-qhrx-hcm6-pmrw
Summary: Unsafe deserialization in SmtpTransport in CakePHP
Aliases: CVE-2019-11458
Severity: HIGH
CWE: CWE-502
Published: 2019-12-02T18:12:26Z

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
Vulnerability: GHSA-r7rh-g777-g5gx
Summary: SilverStripe GraphQL Server permission checker not inherited by query subclass.
Aliases: CVE-2021-28661
Severity: MODERATE
CWE: CWE-863
Published: 2021-10-12T18:49:23Z

Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
Vulnerability: GHSA-jrgf-vfw2-hj26
Summary: RCE via PHP Object injection via SOAP Requests
Aliases: CVE-2020-15244
Severity: HIGH
CWE: CWE-502, CWE-74
Published: 2020-10-30T17:06:06Z

### Impact
This vulnerability allows an admin user to generate soap credentials that can be used to trigger RCE via PHP Object Injection through product attributes and a product.

### Patches
The latest OpenMage Versions up from 19.4.7 and 20.0.3 have this Issue solved

### Credits
Credit to Luke Rodgers for reporting
Vulnerability: GHSA-54gp-qff8-946c
Summary: Insecure direct object reference of log files of the Import/Export feature
Aliases: CVE-2021-37709
Severity: MODERATE
CWE: CWE-639, CWE-532
Published: 2021-08-30T16:14:19Z

### Impact
Insecure direct object reference of log files of the Import/Export feature

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Vulnerability: GHSA-m49f-hcxp-6hm6
Summary: CSRF allowing an external page to trigger a user logout event
Aliases: CVE-2021-41176
Severity: LOW
CWE: CWE-352
Published: 2021-10-25T19:42:46Z

### Impact
A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.**

### Patches
None.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory please contact `Tactical Fish#8008` on Discord, or email `dane@pterodactyl.io`.
Vulnerability: GHSA-9jxw-cfrh-jxq6
Summary: New line injection during configuration edition
Aliases: CVE-2021-39172
Severity: HIGH
CWE: CWE-93
Published: 2021-08-30T16:11:24Z

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server.

### Patches

This issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of new lines characters in new configuration values.

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

- https://blog.sonarsource.com/cachet-code-execution-via-laravel-configuration-injection

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-589w-hccm-265x
Summary: Inline attribute values were not processed.
Aliases: CVE-2020-15263
Severity: HIGH
CWE: CWE-79
Published: 2020-10-19T20:17:47Z

### Impact
Inline attributes have not been processed escape.
If the data that came from users was not processed, then an XSS vulnerability is possible

### Patches
Fixed in 9.4.4
Vulnerability: GHSA-4f5x-q4jc-xfcf
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0262
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T23:31:35Z

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore.
Vulnerability: GHSA-hx77-5p88-f92r
Summary: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4131
Severity: HIGH
CWE: CWE-352
Published: 2022-01-05T20:33:55Z

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-q88g-qx42-xfrh
Summary: Path traversal in bolt/core
Aliases: CVE-2021-27367
Severity: HIGH
CWE: CWE-22
Published: 2021-02-18T20:51:56Z

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.
Vulnerability: GHSA-3xpw-vhmv-cw7h
Summary: Command injection in czproject/git-php
Aliases: CVE-2022-25866
Severity: HIGH
CWE: CWE-74
Published: 2022-04-26T00:00:35Z

The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Vulnerability: GHSA-7528-7jg5-6g62
Summary: Cross-site Scripting Vulnerability in CodeIgniter4
Aliases: CVE-2022-21715
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-27T15:09:00Z

### Impact
Cross-Site Scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4.
Attackers can do XSS attacks if you are using `API\ResponseTrait`.

### Patches
Upgrade to v4.1.8 or later.

### Workarounds
Do one of the following:
1. Do not use `API\ResponseTrait` nor `ResourceController`
2. Disable Auto Route and [Use Defined Routes Only](https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only)

### References
- [Cross Site Scripting (XSS) Software Attack | OWASP Foundation](https://owasp.org/www-community/attacks/xss/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-v6vg-pxvv-g5cq
Summary: Improper Privilege Management in Snipe-IT
Aliases: CVE-2022-0579
Severity: MODERATE
CWE: CWE-269
Published: 2022-02-15T00:02:45Z

Snipe-IT prior to 5.3.9 is vulnerable to improper privilege management. A user who does not have access to the supplier module may view supplier content.
Vulnerability: GHSA-f7hx-fqxw-rvvj
Summary: Insufficient output escaping of attachment names in PHPMailer
Aliases: CVE-2020-13625
Severity: HIGH
CWE: CWE-116
Published: 2020-05-27T16:37:02Z

### Impact
CWE-116: Incorrect output escaping.

An attachment added like this (note the double quote within the attachment name, which is entirely valid):

    $mail->addAttachment('/tmp/attachment.tmp', 'filename.html";.jpg');

Will result in a message containing these headers:

    Content-Type: application/octet-stream; name="filename.html";.jpg"
    Content-Disposition: attachment; filename="filename.html";.jpg"

The attachment will be named `filename.html`, and the trailing `";.jpg"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this.

Note that the MIME type itself is obtained automatically from the *source filename* (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the *name* given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods.

### Patches
Patched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this:

    Content-Type: application/octet-stream; name="filename.html\";.jpg"
    Content-Disposition: attachment; filename="filename.html\";.jpg"

### Workarounds
Reject or filter names and filenames containing double quote (`"`) characters before passing them to attachment functions such as `addAttachment()`.

### References
[CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625).
[PHPMailer 6.1.6 release](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PHPMailer repo](https://github.com/PHPMailer/PHPMailer/issues)
Vulnerability: GHSA-jjcx-999m-35hc
Summary: Improper Input Validation in Firefly III
Aliases: CVE-2019-14671
Severity: LOW
CWE: CWE-20
Published: 2021-09-08T17:27:07Z

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
Vulnerability: GHSA-f99r-jjgr-f373
Summary: SQL injection in ImpressCMS
Aliases: CVE-2022-26986
Severity: HIGH
CWE: CWE-89
Published: 2022-04-06T00:01:30Z

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.
Vulnerability: GHSA-xwv6-v7qx-f5jc
Summary: Code injection in ezsystems/ezpublish-kernel
Aliases: CVE-2022-25337
Severity: CRITICAL
CWE: CWE-74
Published: 2022-02-19T00:01:25Z

When image files are uploaded, they are made accessible under a name similar to the original file name. There are two issues with this. Both require access to uploading images in order to exploit them, this limits the impact. The first issue is that certain injection attacks can be possible, since not all possible attack vectors are removed from the original file name.

The second issue is that direct access to the images is not access controlled. This is by design, for performance reasons, and documented as such. But it does mean that images not meant to be publicly accessible can be accessed, provided that the image path and filename is correctly deduced and/or guessed, through dictionary attacks and similar.
Vulnerability: GHSA-rp42-c45j-g46x
Summary: yetiforcecrm is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4107
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-16T14:12:23Z

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-9c5c-5j4h-8q2c
Summary: bookstack is vulnerable to Improper Access Control.
Aliases: CVE-2021-4119
Severity: MODERATE
CWE: CWE-284
Published: 2021-12-16T19:40:26Z

bookstack prior to version 21.11.3 is vulnerable to Improper Access Control.
Vulnerability: GHSA-284f-f2hw-j2gx
Summary: Server-Side Request Forgery vulnerability in concrete5
Aliases: CVE-2021-22958
Severity: HIGH
CWE: CWE-918
Published: 2021-10-12T18:41:59Z

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.
Vulnerability: GHSA-pm77-c4q7-3fwj
Summary: Improper Certificate Validation in Heartland & Global Payments PHP SDK
Aliases: CVE-2019-20455
Severity: MODERATE
CWE: CWE-295
Published: 2021-10-12T16:31:12Z

Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations.
Vulnerability: GHSA-cvmr-6428-87w9
Summary: Cross-Site Scripting in Grav
Severity: MODERATE
CWE: CWE-79
Published: 2020-12-10T23:13:08Z

### Impact
Privileged users (with the ability to edit pages) have a mechanism to perform remote code execution via XSS. At a minimum, the vulnerability represents a bypass of security controls put in place to mitigate this form of attack.

The remote code execution can be performed because XSS would allow an attacker to execute functionality on behalf of a stolen administrative account - the facility to install custom plugins would then allow said attacker to install a plugin containing a web shell and thus garner access to the underlying system.

### References
https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
https://cwe.mitre.org/data/definitions/79.html

### For more information
Please contact contact@pentest.co.uk
Vulnerability: GHSA-wfm4-pq59-wg6r
Summary: Reset Password / Login vulnerability in Sulu
Aliases: CVE-2020-15132
Severity: MODERATE
CWE: CWE-209
Published: 2020-08-05T21:27:44Z

### Impact

_What kind of vulnerability is it? Who is impacted?_

This vulnerability consists of a few related issues:

#### Forget password leaks information if the user exists

When the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist:

```json
{
    "code": 0,
    "message": "Entity with the type \u0022Sulu\\Bundle\\SecurityBundle\\Entity\\User\u0022 and the id \u0022asdf\u0022 not found."
}
```

This enables attackers to retrieve valid usernames.

#### Forgot password leaks user email if user exists

The response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful:

```json
{"email":"admin@localhost.local"}
```

This information should not be exposed, as it can be used to gather email addresses.

#### Response time of login gives hint if the username exists

If the username the user enters in the login screen does not exists, the request responds much faster than if the username exists. This again allows attackers to retrieve valid usernames.

#### Reset Token for Forgot Password feature is not hashed

The reset token in the user database table is not hashed. That means that somebody could try to request a new password using the Forgot Password feature, and look that up in the database, if the attacker somehow got access to the database. Hashing the reset token would fix that problem.

### Patches

This problem was fixed in Release 1.6.34, 2.0.10 and 2.1.1.

### Workarounds

Override the files manually in your project and change them accordingly.
Vulnerability: GHSA-7x22-pmw5-66mq
Summary: Cross-site Scripting in showdoc
Aliases: CVE-2021-4172
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-01T00:44:14Z

Stored XSS via upload attachment with format .svg in File Library.
Vulnerability: GHSA-3fvf-2gp4-89wq
Summary: Possibility for Denial of Service by overwriting PHP files with language exports
Severity: MODERATE
Published: 2022-03-18T23:17:15Z

### Impact
Laravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.

### Patches
Version 0.6.2 fixes this issue.

### Workarounds
Only allow trusted admins to publish/edit translations.

### References
https://github.com/barryvdh/laravel-translation-manager/pull/417

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/barryvdh/laravel-translation-manager
* Email me (see Github profile)

### Credits
Found and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)
Vulnerability: GHSA-pgwj-prpq-jpc2
Summary: Check service IDs are valid
Aliases: CVE-2019-10910
Severity: CRITICAL
CWE: CWE-89
Published: 2019-11-18T17:27:31Z

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Vulnerability: GHSA-w5r2-gvgf-mpm8
Summary: Improper Encoding or Escaping of Output and Injection in LibreNMS
Aliases: CVE-2019-12463
Severity: HIGH
CWE: CWE-74, CWE-116
Published: 2019-10-11T18:43:13Z

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, disclosing file content, denial of service, or writing arbitrary files. NOTE, relative to CVE-2019-10665, this requires authentication and the pathnames differ.
Vulnerability: GHSA-gxcm-36qw-j29v
Summary: SQL Injection in tribalsystems/zenario
Aliases: CVE-2021-27672
Severity: MODERATE
CWE: CWE-89
Published: 2021-06-08T20:12:02Z

SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.
Vulnerability: GHSA-24p5-x9f9-vvpx
Summary: Cross-site Scripting in baserCMS
Aliases: CVE-2021-20681
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T20:10:27Z

Improper neutralization of JavaScript input in the page editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Vulnerability: GHSA-mrwr-2945-fr22
Summary: Cross-site scripting in PageKit
Aliases: CVE-2021-32245
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-22T15:17:28Z

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malicious scripts. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/exp.svg" that will point to http://localhost/pagekit/storage/exp.svg. When a user comes along to click that link, it will trigger a XSS attack.
Vulnerability: GHSA-g795-4hxx-qqwm
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0893
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

Pimcore prior to 10.4.0 is vulnerable to stored cross-site scripting.
Vulnerability: GHSA-4jwx-78vx-gm6g
Summary: Cross-Site Request Forgery in kimai2
Aliases: CVE-2021-4033
Severity: MODERATE
CWE: CWE-352
Published: 2021-12-10T20:34:01Z

CSRF in saving invoices / modifying status of invoices (pending and cancel only)
Vulnerability: GHSA-3x94-fv5h-5q2c
Summary: Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
Aliases: CVE-2020-15099
Severity: HIGH
CWE: CWE-20, CWE-200
Published: 2020-07-29T16:15:32Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5)
> * CWE-20, CWE-200

### Problem
In case an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal _encryptionKey_ was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch _typo3conf/LocalConfiguration.php_ which again contains the _encryptionKey_ as well as credentials of the database management system being used.

In case a database server is directly accessible either via internet or in a shared hosting network, this allows to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions.

### Solution
Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007)
Vulnerability: GHSA-34jq-548x-m2x9
Summary: Improper Resource Shutdown or Release in TYPO3 extension
Aliases: CVE-2021-38623
Severity: HIGH
CWE: CWE-404
Published: 2021-08-30T17:22:57Z

Wrong usage of the TYPO3 FAL API results in copies of processed files being saved to the /var/transient/ folder of a TYPO3 website on every frontend request. This  can result in Denial of Service, since the webspace may be filled up with image files simply by crafting a large amount of requests to the website.
Vulnerability: GHSA-vpw5-grxx-v396
Summary: CSRF token exposure in TYPO3 extension
Aliases: CVE-2021-36793
Severity: HIGH
CWE: CWE-668
Published: 2021-09-02T17:16:56Z

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting  in the frontend output.
Vulnerability: GHSA-fmfv-x8mp-5767
Summary: Improper input validation in Drupal core
Aliases: CVE-2022-25271
Severity: HIGH
CWE: CWE-20
Published: 2022-02-18T00:00:37Z

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.
Vulnerability: GHSA-f8x6-m9f5-ffp8
Summary: Unrestricted Upload of File with Dangerous Type in unisharp/laravel-filemanager
Aliases: CVE-2021-23814
Severity: MODERATE
CWE: CWE-434
Published: 2022-01-06T21:08:34Z

This affects the package unisharp/laravel-filemanager from 0.0.0. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload window - Upload an image file, then capture the request - Edit the request contents with a malicious file (webshell) - Enter the path of file uploaded on URL - Remote Code Execution **Note: Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in the [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).
Vulnerability: GHSA-vxhc-c4qm-647p
Summary: Improper Access Control in Dolibarr
Aliases: CVE-2021-25954
Severity: MODERATE
CWE: CWE-863, CWE-284
Published: 2021-08-11T15:18:11Z

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.
Vulnerability: GHSA-mh9j-v6mq-pfch
Summary: Path manipulation in matyhtf/framework
Aliases: CVE-2021-43676
Severity: CRITICAL
CWE: CWE-22
Published: 2021-12-04T00:00:53Z

matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. The issue was fixed in version 3.0.6.
Vulnerability: GHSA-j8jp-9x42-4pj5
Summary: Unrestricted Upload of File with Dangerous Type in MODX Revolution
Aliases: CVE-2022-26149
Severity: HIGH
CWE: CWE-434
Published: 2022-02-27T00:00:14Z

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
Vulnerability: GHSA-66hf-2p6w-jqfw
Summary: XSS in laravel/framework
Aliases: CVE-2021-43808
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-08T19:57:36Z

A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine.

Given the following two Blade templates:

resources/views/parent.blade.php:

```html
@section('content')
<input value="{{ $value }}">
@show
```

resources/views/child.blade.php:

```html
@extends('parent')

@section('content')
<input value="{{ $value }}">
@endsection
```

And a route like the following:

```php
Route::get('/example', function() {
    $value = '//localhost/###parent-placeholder-040f06fd774092478d450774f5ba30c5da78acc8## onclick=location.assign(this.value);//';

    return view('child', ['value' => $value]);
});
```

The broken HTML element may be clicked and the user is taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed.

This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Vulnerability: GHSA-x2jp-hh65-4xvf
Summary: Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle
Aliases: CVE-2021-20280
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-29T20:42:15Z

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Vulnerability: GHSA-7ggw-h8pp-r95r
Summary: Session ID not invalidated after logout
Aliases: CVE-2021-3311
Severity: LOW
CWE: CWE-613
Published: 2021-02-10T02:32:35Z

### Impact
When logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.

### Patches
Issue has been patched in Build 472 (v1.0.472) and v1.1.2.

### Workarounds
Apply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.

### References
- Reported by Anisio (Brazilian Information Security Analyst)
- http://cve.circl.lu/cve/CVE-2021-3311

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="699" alt="Screen Shot 2021-02-07 at 11 50 35 PM" src="https://user-images.githubusercontent.com/7253840/107180881-51eaf000-699f-11eb-8828-333128faf2a6.png">
Vulnerability: GHSA-2rh5-jvgx-pgw3
Summary: Any storage file can be downloaded from p.sh if full server path is known
Severity: HIGH
CWE: CWE-200
Published: 2021-09-14T20:25:13Z

The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.
Vulnerability: GHSA-vrf2-xghr-j52v
Summary: Private files publicly accessible with Cloud Storage providers
Severity: HIGH
CWE: CWE-200
Published: 2021-06-28T18:20:42Z

### Impact

Private files publicly accessible with Cloud Storage providers when the hashed URL is known

### Patches

We recommend first changing your configuration to set the correct visibility according to the documentation. The visibility must be at the same level as `type`.

When the Storage is saved on Amazon AWS we recommending disabling public access to the bucket containing the private files: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

Otherwise, update to Shopware 6.4.1.1 or install or update the Security plugin (https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659) and run the command `./bin/console s3:set-visibility` to correct your cloud file visibilities
Vulnerability: GHSA-f99g-pg48-wrfc
Summary: twill is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3932
Severity: MODERATE
CWE: CWE-268, CWE-352
Published: 2021-11-15T23:19:26Z

twill is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-9g3v-j3cr-6fc6
Summary: Cross-site Scripting in snipe-it
Aliases: CVE-2021-3879
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-21T17:48:26Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-v9w8-hq92-v39m
Summary: Cross-site Scripting (XSS) in baserCMS
Aliases: CVE-2021-20683
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T20:10:45Z

Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
Vulnerability: GHSA-9vxv-wpv4-f52p
Summary: Information leakage in Error Handler
Severity: MODERATE
CWE: CWE-209
Published: 2021-05-21T14:29:33Z

### Impact
Information leakage in Error Handler

### Patches
We recommend updating to the current version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2021
Vulnerability: GHSA-44m4-9cjp-j587
Summary: IBX-1392: Image filenames sanitization
Severity: HIGH
Published: 2022-01-21T23:24:14Z

ezsystems/ezpublish-kernel versions 7.5.* before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files.
Vulnerability: GHSA-c7vg-w8q8-c3wf
Summary: Session Fixation
Aliases: CVE-2021-32710
Severity: MODERATE
CWE: CWE-384
Published: 2021-09-08T18:00:20Z

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-5w74-jx7m-x6hv
Summary: XSS vulnerability in theme config file in Mautic
Aliases: CVE-2018-8071
Severity: LOW
CWE: CWE-79
Published: 2021-01-19T21:16:17Z

### Impact
Mautic before v2.13.0 has stored XSS via a theme config file.

### Patches
Update to 2.13.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-rggc-4g3r-j7ff
Summary: Remote Code Execution in Contao Managed Edition
Aliases: CVE-2022-26265
Severity: CRITICAL
CWE: CWE-77
Published: 2022-03-20T00:00:30Z

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
Vulnerability: GHSA-484f-743f-6jx2
Summary: Object injection in cookie driver in phpfastcache
Aliases: CVE-2019-16774
Severity: HIGH
CWE: CWE-94
Published: 2019-12-12T22:50:20Z

## Object injection in cookie driver

### Impact
An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).

### Patches
The issue has been addressed by enforcing JSON conversion when deserializing

### Workarounds
If you can't fix it, use another driver such as "Files" (Filesystem)

### References
Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues)
* Email us at [security@geolim4.com](mailto:security@geolim4.com)
Vulnerability: GHSA-jfvf-rfmq-qwf8
Summary: Croos-site scripting in Croogo
Aliases: CVE-2019-20789
Severity: LOW
CWE: CWE-79
Published: 2021-06-22T15:23:21Z

Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
Vulnerability: GHSA-cg3h-rc9q-g8v9
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0509
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T00:00:30Z

pimcore version 10.3.0 and prior is vulnerable to cross-site scripting.
Vulnerability: GHSA-5fh3-25xr-g85h
Summary: snipe-it is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4018
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-03T20:40:50Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-6346-5r4h-ff5x
Summary: Microweber vulnerable to cross-site scripting (XSS)
Aliases: CVE-2022-1555
Severity: HIGH
CWE: CWE-79
Published: 2022-05-05T00:00:26Z

Microweber is a drag and drop website builder and a powerful next generation CMS. Microweber versions 1.2.15 and prior are vulnerable to cross-site scripting. This could lead to injection of arbitrary JaveScript code, defacement of a page, or stealing cookies. A patch is available on the `master` branch of Microweber's GitHub repository.
Vulnerability: GHSA-vp4x-94ff-2cmv
Summary: Cross-site scripting in forkcms
Aliases: CVE-2020-23263
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T22:29:03Z

Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
Vulnerability: GHSA-pqcf-v8v5-jmcg
Summary: Zip slip in Microweber
Aliases: CVE-2020-28337
Severity: HIGH
CWE: CWE-22
Published: 2022-02-10T22:23:18Z

A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Vulnerability: GHSA-vcwc-6mr9-8m7c
Summary: Cross-site Scripting in phpmyadmin
Aliases: CVE-2022-23808
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T22:36:28Z

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
Vulnerability: GHSA-g6vq-wc8w-4g69
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4015
Severity: MODERATE
CWE: CWE-352
Published: 2021-12-06T17:19:18Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-62fx-3v4f-mwxm
Summary: Bypass of sitemp access restrictions
Aliases: CVE-2019-8133
Severity: MODERATE
Published: 2019-11-12T22:59:40Z

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to generate sitemaps can bypass configuration that restricts directory access. The bypass allows overwrite of a subset of configuration files which can lead to denial of service.
Vulnerability: GHSA-hqm2-gwqf-r5g5
Summary: SQL injection in TYPO3 extension
Aliases: CVE-2021-38302
Severity: CRITICAL
CWE: CWE-89
Published: 2021-09-02T17:17:06Z

It has been discovered that the extension is susceptible to SQL Injection when processing bounced emails.
Vulnerability: GHSA-77mr-wc79-m8j3
Summary: A validation function with the same name as a built-in validator can be called
Aliases: CVE-2021-3603
Severity: LOW
CWE: CWE-74
Published: 2021-06-22T15:18:02Z

If a function is defined that has the same name as the default built-in email address validation scheme (`php`), it will be called in default configuration as when no validation scheme is provided, the default scheme's callable `php` was being called. If an attacker is able to inject such a function into the application (a much bigger issue), it will be called whenever an email address is validated, such as when calling `validateAddress()`.

### Impact
Low impact – exploitation requires that an attacker can already inject code into an application, but it provides a trigger pathway.

### Patches
This is patched in PHPMailer 6.5.0 by denying the use of simple strings as validator function names, which is a very minor BC break.

### Workarounds
Inject your own email validator function.

### References
Reported by [Vikrant Singh Chauhan](mailto:vi@hackberry.xyz) via [huntr.dev](https://www.huntr.dev/).
[CVE-2021-3603](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3603)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
* [Email us](mailto:phpmailer@synchromedia.co.uk).
Vulnerability: GHSA-q4qv-fmwc-qxpx
Summary: SQL Injection in NukeViet
Aliases: CVE-2019-7726
Severity: CRITICAL
CWE: CWE-89
Published: 2021-06-22T15:24:55Z

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).
Vulnerability: GHSA-9cc3-5w85-pxvx
Summary: Cross Site Request Forgery in intelliants/subrion
Aliases: CVE-2020-18326
Severity: HIGH
CWE: CWE-352
Published: 2022-03-05T00:00:45Z

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user.
Vulnerability: GHSA-jvx5-rm6q-gx7p
Summary: Lack of access control on upoaded files
Aliases: CVE-2019-12245
Severity: MODERATE
CWE: CWE-732
Published: 2019-11-12T23:01:50Z

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Vulnerability: GHSA-89ch-hqf9-rgp3
Summary: Using JS libraries with known security vulnerabilities
Aliases: CVE-2019-8121
Severity: HIGH
Published: 2019-11-12T22:59:28Z

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.
Vulnerability: GHSA-r5hc-wm3g-hjw6
Summary: Server-Side Request Forgery (SSRF) in rudloff/alltube
Aliases: CVE-2022-0768
Severity: CRITICAL
CWE: CWE-918
Published: 2022-03-01T22:01:30Z

### Impact
Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname.

### Patches
3.0.2 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

Part of the fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/148a171b240e7ceb076b9e198bef412de14ac55d/patches/youtube-dl-redirect.diff) to youtube-dl to prevent it from following HTTP redirects. If you are using the version of youtube-dl bundled with 3.0.2, it is already patched.
However, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.

### References
* https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d
* https://github.com/Rudloff/alltube/commit/1b099bb9836a3ce7c427a41722a7ab5a3d1c1b2d
* https://huntr.dev/bounties/9b14cc46-ec08-4940-83cc-9f986b2a5903/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0768
* https://github.com/ytdl-org/youtube-dl/issues/30691
Vulnerability: GHSA-45hc-r4fj-qj89
Summary: SQL injection in pagekit/pagekit
Aliases: CVE-2021-44135
Severity: CRITICAL
CWE: CWE-89
Published: 2022-04-02T00:00:15Z

Pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. The configAction in SettingsController allow user to set the order of comments listing. The allowed options are ASC and DESC. That config then get concatenated directly to the SQL query. Due to the fact that there wasnt any sanitizion before saving that config, it can lead to the SQL Injection vulnerability.
Vulnerability: GHSA-254q-rqmw-vx45
Summary: Exposure of Sensitive Information to an Unauthorized Actor in librenms
Aliases: CVE-2022-0588
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-16T00:01:52Z

Exposure of Sensitive Information to an Unauthorized Actor in Packagist librenms/librenms prior to 22.2.0.
Vulnerability: GHSA-j85f-xw9x-ffwp
Summary: yetiforcecrm is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4121
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-17T20:00:12Z

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-29v9-2fpx-j5g9
Summary: CSV Injection vulnerability with exported contact lists in Mautic
Aliases: CVE-2018-8092
Severity: MODERATE
CWE: CWE-1236
Published: 2021-01-19T21:16:29Z

### Impact
Mautic versions before 2.13.0 had a vulnerability that allowed a CSV injection with exported contact lists - https://www.owasp.org/index.php/CSV_Injection.

### Patches
Update to 2.13.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)