TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-m2jh-fxw4-gphm
Summary: HTTP Host Header Injection
Aliases: CVE-2021-41114
Severity: MODERATE
CWE: CWE-20, CWE-644
Published: 2021-10-05T20:23:35Z

### Meta
* CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C` (3.5)

### Problem
It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP _Host_ header. TYPO3 uses the HTTP _Host_ header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment.

This vulnerability is the same as described in [TYPO3-CORE-SA-2014-001 (CVE-2014-3941)](https://typo3.org/security/advisory/typo3-core-sa-2014-001/). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting _$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']_ (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.

### Solution
Update your instance to TYPO3 version 11.5.0 which addresses the problem described.

### Credits
Thanks to TYPO3 framework merger Benjamin Franzke who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-015](https://typo3.org/security/advisory/typo3-core-sa-2021-015)
* [CVE-2014-3941](https://nvd.nist.gov/vuln/detail/CVE-2014-3941) reintroduced in TYPO3 v11.0.0
Vulnerability: GHSA-3374-7h99-xr85
Summary: Cross-site scripting in forkcms
Aliases: CVE-2020-23049
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-25T19:43:05Z

Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.
Vulnerability: GHSA-x68c-4gmm-5g43
Summary: kimai2 is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3985
Severity: HIGH
CWE: CWE-79
Published: 2021-12-03T20:40:38Z

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-88f9-7xxh-c688
Summary: Configuration leak
Aliases: CVE-2021-39174
Severity: HIGH
CWE: CWE-75
Published: 2021-08-30T16:11:43Z

### Impact

Authenticated users, regardless of their privileges (_User_ or _Admin_), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). 

### Patches

This issue was addressed by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file.

### Workarounds

Only allow trusted source IP addresses to access to the administration dashboard.

### References

Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-h7vq-5qgw-jwwq
Summary: CSV Injection Vulnerability
Aliases: CVE-2021-41824
Severity: HIGH
CWE: CWE-1236
Published: 2021-10-18T19:04:16Z

### Impact
In some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.

If you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.

### Patches
This has been patched in Craft 3.7.14.

### References
* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28
* https://twitter.com/craftcmsupdates/status/1442928690145366018

### For more information

If you have any questions or comments about this advisory, email us at support@craftcms.com

----------

Credits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli
Vulnerability: GHSA-cpq8-x35g-m439
Summary: Cross-site Scripting in yourls
Aliases: CVE-2021-3783
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-20T20:43:15Z

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in arbitrary path handling.
Vulnerability: GHSA-rrgw-3hg3-9x8c
Summary: XSS vulnerability in translations
Severity: MODERATE
Published: 2022-01-12T21:49:49Z

### Summary

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: 
 - Translation management UI.
 - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
 - Translations uploaded via Upload translation file on the All Languages grid

### Workarounds

There are no workarounds that address this vulnerability.
Vulnerability: GHSA-x2xg-6wcj-6xf9
Summary: SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
Aliases: CVE-2020-36474
Severity: CRITICAL
Published: 2021-08-25T14:49:48Z

SafeCurl before 0.9.2 has a DNS rebinding vulnerability.
Vulnerability: GHSA-w4pj-7p68-3vgv
Summary: Stored XSS in October
Aliases: CVE-2020-11083
Severity: LOW
CWE: CWE-79
Published: 2020-08-05T14:52:44Z

### Impact
A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field.

### Patches
Issue has been patched in Build 466 (v1.0.466) & RainLab.Blog v1.4.1 by restricting the ability to store JS in markdown to only users that have been explicitly granted the `backend.allow_unsafe_markdown` permission.

### Workarounds
Apply https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746 & https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 to your installation manually if unable to upgrade to Build 466 or v1.4.1 of RainLab.Blog (if using that plugin).

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png">
Vulnerability: GHSA-7vmw-7x57-q6jw
Summary: Cross-site scripting
Aliases: CVE-2021-32713
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-08T18:00:00Z

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
Vulnerability: GHSA-m553-9wmx-533h
Summary: Cross-site scripting in Dolibarr
Aliases: CVE-2019-16197
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-08T20:05:31Z

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
Vulnerability: GHSA-2v2v-fx7r-f2fh
Summary: pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-4082
Severity: MODERATE
CWE: CWE-352
Published: 2021-12-16T14:28:10Z

pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-xgx2-332h-9x6q
Summary: SQL Injection in Yeswiki
Aliases: CVE-2021-43091
Severity: HIGH
CWE: CWE-89
Published: 2022-03-26T00:00:32Z

An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. The issue was fixed in Yeswiki version 4.1.0.
Vulnerability: GHSA-7w4p-72j7-v7c2
Summary: Phar object injection in PHPMailer
Aliases: CVE-2018-19296
Severity: HIGH
CWE: CWE-502, CWE-915
Published: 2020-03-05T22:08:55Z

PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.

### Impact
Object injection, possible remote code execution

### Patches
Fixed in 6.0.6 and 5.2.27

### Workarounds
Validate and sanitise user input before using.

### References
https://nvd.nist.gov/vuln/detail/CVE-2018-19296

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-h59f-p56g-g75v
Summary: SQL Injection in librenms
Aliases: CVE-2020-35700
Severity: HIGH
CWE: CWE-89
Published: 2021-05-06T18:53:02Z

A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint.
Vulnerability: GHSA-m8xh-cqc2-5q6f
Summary: Type Confusion in ImpressCMS
Aliases: CVE-2021-26600
Severity: CRITICAL
CWE: CWE-843
Published: 2022-03-29T00:01:16Z

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
Vulnerability: GHSA-5mwx-f6w6-7w5r
Summary: Cross-site Scripting in GeniXCMS
Aliases: CVE-2022-24563
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-04T00:00:19Z

In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.
Vulnerability: GHSA-g8r4-p96j-xfxc
Summary: Twig allowing dangerous PHP functions by default in getgrav/grav
Aliases: CVE-2021-29440
Severity: HIGH
CWE: CWE-94
Published: 2021-04-16T19:53:12Z

### Impact

Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. 
As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.

### Patches

The issue was addressed by preventing dangerous functions from being called in Twig templates. A configuration option has been added to manually allow arbitrary PHP functions (`system.twig.safe_functions`) and filters (`system.twig.safe_filters`). 

Futures major versions of Grav may disable this functionality by default. 

### Workarounds

Blocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation. 

### References

- https://portswigger.net/research/server-side-template-injection
- https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities

### For more information

If you have any questions or comments about this advisory, you can contact:
  - The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
  - The maintainers, by opening an issue on this repository.
Vulnerability: GHSA-67c7-5v9j-227r
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3983
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-03T20:43:06Z

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-j29g-g982-pwpv
Summary: Cross-site scripting (XSS)
Aliases: CVE-2020-17551
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-12T21:34:11Z

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
Vulnerability: GHSA-vx6j-pjrh-vgjh
Summary: PHP file inclusion in the Sulu admin panel
Aliases: CVE-2021-43836
Severity: HIGH
CWE: CWE-22
Published: 2021-12-15T22:54:20Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution.

* Compromised components: Arbitrary file read on the server, (Potential) Remote code execution
* Exploitation pre-requisite: User account on the backend

### Patches

_Has the problem been patched? What versions should users upgrade to?_

The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language. 

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Vulnerability: GHSA-rqgp-ccph-5w65
Summary: Cross-Site Request Forgery in firefly-iii
Aliases: CVE-2021-3901
Severity: LOW
CWE: CWE-352
Published: 2021-10-28T23:14:14Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-93pj-4p65-qmr9
Summary: Insufficient user authorization in Moodle
Aliases: CVE-2022-0334
Severity: MODERATE
CWE: CWE-668, CWE-863
Published: 2022-01-28T22:07:40Z

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Vulnerability: GHSA-55mm-5399-7r63
Summary: Reliance on Cookies without validation in OctoberCMS
Aliases: CVE-2020-15128
Severity: MODERATE
CWE: CWE-565, CWE-327
Published: 2020-08-05T14:52:54Z

### Impact
Previously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. 

Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. 

### Patches
Issue has been patched in Build 468 (v1.0.468).

>**NOTE**: If you are using the cookie session driver, all of your session data will be invalidated. All other session drivers should smoothly upgrade to the changes (although the backend authentication persist cookie will also be invalidated requiring users to login again once their current session expires).

### Workarounds
Apply https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c to your installation manually if unable to upgrade to Build 468.

### References
- https://blog.laravel.com/laravel-cookie-security-releases
- https://github.com/laravel/framework/compare/4c7d118181d6c7f1f883643702df807ced016c5e...a731824421f9ebc586728ea9c7cff231a249aaa9

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Low given that it is not directly exploitable within the core but requires other security vulnerabilities within the application to have an effect and the severity of its effect depends entirely on the severity of those other holes in the application's defences.

### Acknowledgements

Thanks to [Takashi Terada of Mitsui Bussan Secure Directions, Inc.](https://www.linkedin.com/in/takeshi-terada-b570a6100/) for finding the original issue in Laravel and @taylorotwell for sharing the report with the October CMS team.
Vulnerability: GHSA-6x98-fx9j-7c78
Summary: Disabled users able to log in with third party SSO plugin
Aliases: CVE-2017-1000489
Severity: MODERATE
CWE: CWE-287
Published: 2021-01-19T21:16:19Z

### Impact
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

### Patches
Upgrade to 2.12.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-wg8p-w946-c482
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0956
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:47Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability: GHSA-hj8g-cw8x-2c6m
Summary: Cross-site Scripting in Microweber
Aliases: CVE-2022-0719
Severity: HIGH
CWE: CWE-79
Published: 2022-02-24T00:00:53Z

Microweber prior to version 1.3 is vulnerable to reflected cross-site scripting.
Vulnerability: GHSA-xhh6-956q-4q69
Summary: Argument injection in a MimeTypeGuesser in Symfony
Aliases: CVE-2019-18888
Severity: HIGH
CWE: CWE-20, CWE-88
Published: 2019-12-02T18:08:19Z

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Vulnerability: GHSA-m5v7-pr32-mjx2
Summary: Critical severity vulnerability in Ignition
Aliases: CVE-2020-13909
Severity: CRITICAL
Published: 2021-10-12T16:29:13Z

The Ignition page before version 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env.

NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix.
Vulnerability: GHSA-cv7m-wc7g-7gfp
Summary: Cross-Site Request Forgery in MAGMI
Aliases: CVE-2020-5776
Severity: MODERATE
CWE: CWE-352
Published: 2021-05-06T18:54:41Z

All versions of MAGMI up to and including version 0.7.24 are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
Vulnerability: GHSA-c9hq-g4q8-w893
Summary: Privilage Escalation in moodle
Aliases: CVE-2020-25701
Severity: MODERATE
CWE: CWE-863
Published: 2021-03-29T20:42:55Z

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Vulnerability: GHSA-x2gw-85w6-fjjw
Summary: Cross-site scripting in demos/demo.mysqli.php in getID3
Aliases: CVE-2021-40926
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-04T20:13:55Z

Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
Vulnerability: GHSA-mjvc-j6rv-9xj8
Summary: Insertion of Sensitive Information Into Debugging Code in Microweber
Aliases: CVE-2022-0721
Severity: HIGH
CWE: CWE-215
Published: 2022-02-24T00:00:54Z

Microweber prior to 1.3 may expose sensitive information about a server and a user when running the server in debug mode.
Vulnerability: GHSA-32m2-9f76-4gv8
Summary: Business Logic Errors in SilverStripe Framework
Aliases: CVE-2022-0227
Severity: MODERATE
Published: 2022-02-06T00:01:01Z

SilverStripe Framework prior to version 4.10.1 is vulnerable to business logic errors.
Vulnerability: GHSA-jvg4-9rc2-wvcr
Summary: Generation of fake documents via public GET-call
Severity: LOW
CWE: CWE-862
Published: 2021-02-10T02:32:07Z

### Impact
Generation of fake documents via public GET-call

### Patches
We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
Vulnerability: GHSA-8wf2-3ggj-78q9
Summary: Improper Authentication in phpmyadmin
Aliases: CVE-2022-23807
Severity: MODERATE
CWE: CWE-287
Published: 2022-01-28T22:44:40Z

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
Vulnerability: GHSA-4xww-6h7v-29jg
Summary: User enumeration in livehelperchat
Aliases: CVE-2022-0083
Severity: MODERATE
CWE: CWE-209
Published: 2022-01-21T23:37:07Z

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information. There is an observable discrepancy between errors generated for users that exist and those that do not.
Vulnerability: GHSA-xgpf-p52j-pf7m
Summary: XSS in CreateQueuedJobTask
Aliases: CVE-2021-27938
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-24T17:42:02Z

A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.
Vulnerability: GHSA-69wp-xwm7-69wm
Summary: Exposure of Resource to Wrong Sphere in ThinkPHP Framework
Aliases: CVE-2022-25481
Severity: HIGH
CWE: CWE-668
Published: 2022-03-22T00:00:43Z

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php.
Vulnerability: GHSA-728c-42pc-fwxg
Summary: Unrestricted Upload of File with Dangerous Type in Crater
Aliases: CVE-2022-0242
Severity: HIGH
CWE: CWE-434
Published: 2022-01-21T23:54:50Z

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
Vulnerability: GHSA-57gr-jvqr-3hwm
Summary: Incorrect access control in typo3_forum
Aliases: CVE-2020-15513
Severity: MODERATE
CWE: CWE-863
Published: 2020-07-29T18:07:38Z

The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.
Vulnerability: GHSA-gf2c-93hm-r9j5
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3963
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-23T18:16:43Z

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates.
Vulnerability: GHSA-6gc6-m364-85ww
Summary: Log injection in SimpleSAMLphp
Aliases: CVE-2020-5225
Severity: LOW
CWE: CWE-532
Published: 2020-01-24T21:26:13Z

### Background

SimpleSAMLphp has a logging functionality that allows system administrators to keep track of the activity, errors, and statistics. Additionally, it allows users to report errors, shall they happen. An error report contains a report identifier, which is logged once submitted.

### Description

The `www/erroreport.php` script, which receives error reports and sends them via email to the system administrator, didn't properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID.

When configured to use the `file` logging handler, SimpleSAMLphp will output all its logs by appending each log line to a given file. Since the `reportID` parameter received in a request sent to `www/errorreport.php` was not properly sanitized, it was possible to inject newline characters into it, effectively allowing a malicious user to inject new log lines with arbitrary content.

### Affected versions

SimpleSAMLphp versions up to **1.18.3**.

### Impact

An attacker may use this issue to inject logs messages into a SimpleSAMLphp log file, trying to trick or confuse system administrators. However, the attack surface is considered small, as the attack will only work with the `file` logging handler, which opens the log file in _append-only_ mode. This means an attacker cannot edit or remove existing log messages, and even if non-ascii characters are written to the log, the file will always be readable with a simple text editor.

### Resolution

Upgrade the SimpleSAMLphp installation to version **1.18.4**.

### Credit

This vulnerability was discovered and reported by Frederic Vleminckx on January 23, 2020.
Vulnerability: GHSA-h76r-vgf3-j6w5
Summary: Auth bypass and account takeover in October CMS
Aliases: CVE-2021-29487
Severity: HIGH
CWE: CWE-287
Published: 2021-08-30T16:13:50Z

### Impact

An attacker can exploit this vulnerability to bypass authentication using a specially crafted persist cookie.

- To exploit this vulnerability, an attacker must obtain a Laravel’s secret key for cookie encryption and signing.
- Due to the logic of how this mechanism works, a targeted user account must be logged in while
the attacker is exploiting the vulnerability.
- Authorization via persist cookie not shown in access logs.

### Patches

- Issue has been patched in Build 472 and v1.1.5
- [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648)

### Workarounds

Apply https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 and https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 to your installation manually if you are unable to upgrade.

[**Update 2022-01-20**] [Shortened patch instructions](https://github.com/daftspunk/CVE-2021-32648) can be found here.

### Recommendations

We recommend the following steps to make sure your server stays secure:

- Keep server OS and system software up to date.
- Keep October CMS software up to date.
- Use a multi-factor authentication plugin.
- Change the [default backend URL](https://github.com/octobercms/october/blob/1.1/config/cms.php#L39) or block public access to the backend area.
- Include the [Roave/SecurityAdvisories](https://github.com/Roave/SecurityAdvisories) Composer package to ensure that your application doesn't have installed dependencies with known security vulnerabilities.

### References

Bugs found as part of Solar Security CMS Research. Credits to:
• Andrey Basarygin
• Andrey Guzei
• Mikhail Khramenkov
• Alexander Sidukov
• Maxim Teplykh

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Vulnerability: GHSA-xcrg-29h7-h4cj
Summary: XXE in PHPSpreadsheet due to encoding issue
Aliases: CVE-2018-19277
Severity: HIGH
CWE: CWE-91
Published: 2019-11-20T01:38:52Z

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file
Vulnerability: GHSA-x7cr-6qr6-2hh6
Summary: Missing input validation can lead to command execution in composer
Aliases: CVE-2022-24828
Severity: HIGH
CWE: CWE-94, CWE-20
Published: 2022-04-22T20:15:38Z

The Composer method `VcsDriver::getFileContent()` with user-controlled `$file` or `$identifier` arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.

This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json `readme` field as a vector for injecting parameters into the `$file` argument for the Mercurial driver or via the `$identifier` argument for the Git and Mercurial drivers.

Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.

To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.
Vulnerability: GHSA-xp82-jmw8-mjxp
Summary: Unrestricted Upload of File with Dangerous Type in ShowDoc
Aliases: CVE-2022-1034
Severity: HIGH
CWE: CWE-434
Published: 2022-03-23T00:00:23Z

There is a Unrestricted Upload of File vulnerability in ShowDoc prior to version 2.10.4.
Vulnerability: GHSA-cq6h-w3mc-57f4
Summary: Information exposure via query strings in URL
Severity: LOW
CWE: CWE-200
Published: 2020-12-21T18:01:16Z

### Impact

Information exposure via query strings in URL

### Patches
We recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020

### Credits
We would like to thank <a rel="noopener" href="https://www.vater-it.de/">Oliver Herrmann</a> for reporting this issue.
Vulnerability: GHSA-8vp7-j5cj-vvm2
Summary: Ability to expose data in Sylius by using an unintended serialisation group
Aliases: CVE-2020-5220
Severity: MODERATE
CWE: CWE-444
Published: 2020-01-31T18:00:43Z

### Impact

ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API.

Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: `<1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2`.

### Patches

The patch is provided for ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

After it is applied, It allows to choose only the groups that are defined in `serialization_groups` or `allowed_serialization_groups` route definition. Any group not defined in those will not be used.

This behaviour might be a BC break for those using custom groups via the HTTP header, please adjust `allowed_serialization_groups` accordingly.

### Workarounds

Service `sylius.resource_controller.request_configuration_factory` can be overridden with an implementation copied from `\Sylius\Bundle\ResourceBundle\Controller\RequestConfigurationFactory` where the part that handles custom serialisation groups is deleted.
Vulnerability: GHSA-24m3-w8g9-jwpq
Summary: Information disclosure of source code in SimpleSAMLphp
Aliases: CVE-2020-5301
Severity: LOW
CWE: CWE-178, CWE-200
Published: 2020-04-22T20:59:44Z

### Background

The module controller in `SimpleSAML\Module` that processes requests for pages
hosted by modules, has code to identify paths ending with `.php` and process
those as PHP code. If no other suitable way of handling the given path exists it
presents the file to the browser.

### Description

The check to identify paths ending with `.php` does not account for uppercase
letters. If someone requests a path ending with e.g. `.PHP` and the server is
serving the code from a case-insensitive file system, such as on Windows, the
processing of the PHP code does not occur, and the source code is instead
presented to the browser.

### Affected versions

SimpleSAMLphp versions **1.18.5 and older**.

### Impact

An attacker may use this issue to gain access to the source code in third-party
modules that is meant to be private, or even sensitive. However, the attack
surface is considered small, as the attack will only work when SimpleSAMLphp
serves such content from a file system that is not case-sensitive, such as on
Windows.

### Resolution

Upgrade the SimpleSAMLphp installation to version **1.18.6**.

### Credit

This vulnerability was discovered and reported by Sławek Naczyński.
Vulnerability: GHSA-xc47-3rch-cv57
Summary: Improper Access Control in snipe-it
Aliases: CVE-2022-0178
Severity: MODERATE
CWE: CWE-284
Published: 2022-01-26T20:24:23Z

Users with no system permissions are able to see and create personal access tokens
Vulnerability: GHSA-7733-hjv6-4h47
Summary: Cross-Site Scripting in ternary conditional operator
Aliases: CVE-2020-15241
Severity: MODERATE
CWE: CWE-79, CWE-601
Published: 2020-10-08T19:55:53Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0)
> * CWE-79

---

:information_source: &nbsp;This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020

---

### Problem
It has been discovered that the Fluid Engine (package `typo3fluid/fluid`) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.

```
{showFullName ? fullName : defaultValue}
```

### Solution
Update to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this `typo3fluid/fluid` package that fix the problem described.

Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) releases:
* TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.5)
* TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1)

### Credits
Thanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.

### References
* [TYPO3-CORE-SA-2019-013](https://typo3.org/security/advisory/typo3-core-sa-2019-013)
Vulnerability: GHSA-q2cv-94xm-qvg4
Summary: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3921
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-15T23:18:00Z

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-m9fq-c9hp-59g7
Summary: Cross-site Scripting in yourls
Aliases: CVE-2021-3785
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-20T20:42:52Z

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in edit dialog.
Vulnerability: GHSA-3qrq-r688-vvh4
Summary: Multiple valid tokens for password reset in Shopware
Aliases: CVE-2022-24892
Severity: MODERATE
CWE: CWE-640
Published: 2022-04-28T21:02:17Z

### Impact
Multiple tokens for password reset could be requested. All tokens could be used to change the password.
This makes it possible for an attacker to take over the victims account if s/he gains access to the victims email account and finds unused password reset token in the emails within the time frame of two hours.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Vulnerability: GHSA-xw7v-qrhc-jjg2
Summary: Access Control vulnerability in Dolibarr
Aliases: CVE-2021-37517
Severity: HIGH
CWE: CWE-863
Published: 2022-04-01T00:00:41Z

An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.1, in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
Vulnerability: GHSA-m6ch-gg5f-wxx3
Summary: HTTP Proxy header vulnerability
Aliases: CVE-2016-5385
Severity: HIGH
Published: 2022-04-07T13:59:22Z

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Vulnerability: GHSA-rc5r-697f-28x6
Summary: XSS injection in the Grid component of Sylius
Aliases: CVE-2019-12186
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-15T21:07:59Z

Grid component of Sylius omits HTML input sanitisation while rendering object implementing __toString() method through the string field type.
Vulnerability: GHSA-6vfw-74wr-3chh
Summary: Cross-site Scripting in Crater Invoice
Aliases: CVE-2022-0372
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T00:03:42Z

Crater invoice prior to version 6.0.0 has a cross-site scripting vulnerability.
Vulnerability: GHSA-pr9q-v585-qv2w
Summary: Improper Privilege Management in Open Web Analytics
Aliases: CVE-2022-24637
Severity: CRITICAL
CWE: CWE-269
Published: 2022-03-19T00:01:00Z

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Vulnerability: GHSA-v94v-pxqp-5qgj
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0950
Severity: MODERATE
CWE: CWE-79, CWE-434
Published: 2022-03-16T00:00:48Z

The upload feature of ShowDoc prior to version 2.10.4 allows files with the extension `.*html`, which leads to stored cross-site scripting.
Vulnerability: GHSA-jmgg-wx67-7qfv
Summary: Command Injection in Centreon
Aliases: CVE-2020-13252
Severity: HIGH
CWE: CWE-78
Published: 2021-06-22T15:23:33Z

Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
Vulnerability: GHSA-j8cx-j9j2-f29w
Summary: Insecure Storage of Sensitive Information in Microweber
Aliases: CVE-2022-0724
Severity: HIGH
CWE: CWE-922
Published: 2022-02-24T00:00:53Z

Microweber prior to version 1.3 does not strip images of EXIF data, exposing information about users' locations, device hardware, and device software.
Vulnerability: GHSA-q7rv-6hp3-vh96
Summary: Improper Input Validation in guzzlehttp/psr7
Aliases: CVE-2022-24775
Severity: HIGH
CWE: CWE-20
Published: 2022-03-25T19:26:33Z

### Impact
In proper header parsing. An attacker could sneak in a new line character and pass untrusted values. 

### Patches
The issue is patched in 1.8.4 and 2.1.1

### Workarounds
There are no known workarounds.
Vulnerability: GHSA-pvgf-mrr4-cw7r
Summary: Cross-Site Request Forgery in ForkCMS
Aliases: CVE-2020-23960
Severity: HIGH
CWE: CWE-352
Published: 2021-05-06T18:53:09Z

Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to (1) approve the mass of the user's comments, (2) restoring a deleted user, (3) installing or running modules, (4) resetting the analytics, (5) pinging the mailmotor api, (6) uploading things to the media library, (7) exporting locale.
Vulnerability: GHSA-hq5m-mqmx-fw6m
Summary: Privilege escalation via form generator
Aliases: CVE-2021-37627
Severity: HIGH
CWE: CWE-269
Published: 2021-08-23T19:41:22Z

### Impact

It is possible for untrusted users to gain administrator rights with the form generator.

Installations are only affected if there are untrusted back end users with access to the form generator.

### Patches

Update to Contao 4.4.56, 4.9.18 or 4.11.7.

### Workarounds

Disable the form generator or disable the login for untrusted back end users.

### References

https://contao.org/en/security-advisories/privilege-escalation-with-the-form-generator.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-36fm-v9wv-56jf
Summary: Cross-site Scripting in OpenCart
Aliases: CVE-2020-10596
Severity: LOW
CWE: CWE-79
Published: 2021-05-06T18:54:04Z

OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.
Vulnerability: GHSA-wjfq-88q2-r34j
Summary: Unhandled exception when decoding form response JSON
Severity: HIGH
Published: 2022-01-21T23:02:14Z

### Impact
When handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.

An `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.

### Patches
56fe71d939c38fe14e18a31a673a9331bcc0e4ca

### Workarounds
A plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.

Note that this requires copying the body of the function to a plugin, since the function is currently private.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-q3j3-w37x-hq2q
Summary: Webcache Poisoning in symfony/http-kernel
Aliases: CVE-2021-41267
Severity: MODERATE
CWE: CWE-444
Published: 2021-11-24T20:04:25Z

Description
-----------

When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the `X-Forwarded-*` HTTP headers. HTTP headers that are not part of the "trusted_headers" allowed list are ignored and protect you from "Cache poisoning" attacks. 

In Symfony 5.2, we've added support for the `X-Forwarded-Prefix` header, but this header was accessible in sub-requests, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` HTTP header, leading to a web cache poisoning issue.

Resolution
----------

Symfony now ensures that the `X-Forwarded-Prefix` HTTP header is not forwarded to sub-requests when it is not trusted.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487) for branch 5.3.

Credits
-------

We would like to thank Soner Sayakci for reporting the issue and Jérémy Derussé for fixing the issue.
Vulnerability: GHSA-wjx8-cgrm-hh8p
Summary: Unrestricted file uploads in Contao
Aliases: CVE-2019-19745
Severity: HIGH
CWE: CWE-434
Published: 2019-12-17T22:53:10Z

### Impact

A back end user with access to the form generator can upload arbitrary files and execute them on the server.

### Patches

Update to Contao 4.4.46 or 4.8.6.

### Workarounds

Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.

### References

https://contao.org/en/security-advisories/unrestricted-file-uploads.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-r5mf-q76q-f2xq
Summary: Cross-site scripting in Centreon
Aliases: CVE-2021-27676
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T20:13:05Z

Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.
Vulnerability: GHSA-6mh3-j5r5-2379
Summary: Cross-Site Scripting in Query Generator & Query View
Aliases: CVE-2021-32668
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-22T19:36:58Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5)

### Problem
Failing to properly encode error messages, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.41 ELTS, 9.5.28, 10.4.18, 11.3.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 security team member Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-010](https://typo3.org/security/advisory/typo3-core-sa-2021-010)
Vulnerability: GHSA-cx2r-mf6x-55rx
Summary: Stored XSS with custom URLs in PrestaShop module ps_linklist
Aliases: CVE-2020-5273
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-12T16:01:36Z

### Impact
Stored XSS when using custom URLs.

### Patches
The problem is fixed in 3.1.0

### References
[Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)
Vulnerability: GHSA-pm3v-qxf6-fgxv
Summary: Cross-site Scripting in pimcore
Aliases: CVE-2022-0285
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T18:08:43Z

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
Vulnerability: GHSA-8vq6-5f66-hp3r
Summary: Logic error in dolibarr/dolibarr
Aliases: CVE-2022-0746
Severity: MODERATE
Published: 2022-02-26T00:00:44Z

In dolibarr/dolibarr prior to 16.0 any low privileged users could update their login name which should only be updated by admin.
Vulnerability: GHSA-wwgf-3xp7-cxj4
Summary: Potentially sensitive data exposure in Symfony Web Socket Bundle
Severity: MODERATE
CWE: CWE-200
Published: 2020-07-07T16:33:45Z

### Impact
Inside `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` does not succeed.  The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\Bundle\WebSocketBundle\Topic\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface` rejects the connection, or an Exception is unhandled.  This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.

### Patches
In 1.10.4, 2.6.1, and 3.3.0, `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` fails.

### Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0

Note, the 1.x branch is considered end of support as of July 1, 2020.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)
Vulnerability: GHSA-3756-hwhv-qw58
Summary: Cross site scripting in francoisjacquet/rosariosis
Aliases: CVE-2021-44566
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-25T00:01:08Z

A Cross Site Scripting vulnerability exists RosarioSIS before 4.3 via the SanitizeMarkDown function in ProgramFunctions/MarkDownHTML.fnc.php.
Vulnerability: GHSA-243q-g9j3-qf6r
Summary: non-admin users can create integration role with administrator role
Severity: MODERATE
Published: 2021-06-28T18:21:01Z

### Impact
non-admin users can create integration role with administrator role

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659