TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-fpqv-x9hm-35j9
Summary: Potential XSS vulnerability in Kitodo.Presentation
Aliases: CVE-2020-16095
Severity: MODERATE
CWE: CWE-79
Published: 2020-07-31T17:39:22Z

### Impact
Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting (XSS). Only sites using the `ListView`, `Navigation` or `PageView` plugins are affected.

It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site Scripting, although there is currently no known way to exploit this in Kitodo.Presentation.

### Patches
An updated version of Kitodo.Presentation is available on [GitHub](https://github.com/kitodo/kitodo-presentation/releases/tag/v3.1.2), [Packagist](https://packagist.org/packages/kitodo/presentation#v3.1.2) and in the [TYPO3 Extension Repository](https://extensions.typo3.org/extension/dlf/). Users are advised to update as soon as possible.

The issue was also fixed in release 2.3.1 of the 2.x branch, although it is generally not recommended to run this branch since it depends on an outdated TYPO3 version.

### References
TYPO3 Security Advisory [TYPO3-EXT-SA-2020-015](https://typo3.org/security/advisory/typo3-ext-sa-2020-015)
jQuery Security Advisory [GHSA-gxr4-xjj5-5px2](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2)
Open Bug Bounty Report [OBB-1219978](https://www.openbugbounty.org/reports/1219978/)

### Contact
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/kitodo/kitodo-presentation/issues/new/choose)
* Email us at [security@kitodo.org](mailto:security@kitodo.org)
Vulnerability: GHSA-rxfq-3vpc-vv72
Summary: Files or Directories Accessible to External Parties in Adminer
Aliases: CVE-2021-43008
Severity: HIGH
CWE: CWE-552
Published: 2022-04-06T00:01:33Z

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
Vulnerability: GHSA-46c5-pfj8-fv65
Summary: Improperly checked metadata on tools/armour itemstacks received from the client
Severity: HIGH
CWE: CWE-704
Published: 2022-03-18T22:36:03Z

### Impact
Due to a workaround applied in 1.13, an attacker may send a negative damage/meta value in a tool or armour item's NBT, which `TypeConverter` then blindly uses as if it was valid without being checked.

When this invalid metadata value reaches `Durable->setDamage()`, an exception is thrown because the metadata is not within the expected range for damage values.

This can be reproduced with either a too-large damage value, or a negative one.

### Patches
c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1

### Workarounds
In theory this can be checked by plugins using a custom `TypeConverter`, but this is likely to be very cumbersome.

### For more information
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Vulnerability: GHSA-f2rp-j8hv-g5gx
Summary: Cross-site scripting in imgURL
Aliases: CVE-2021-38713
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-30T16:25:26Z

imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
Vulnerability: GHSA-3p32-j457-pg5x
Summary: Query Binding Exploitation
Aliases: CVE-2021-21263
Severity: HIGH
CWE: CWE-74
Published: 2021-01-19T19:36:51Z

### Description

Laravel versions <6.20.12, <7.30.3 & <8.22.1 contain a query binding exploitation.

If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

This vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com).

### References

- https://github.com/laravel/framework/pull/35865
Vulnerability: GHSA-q863-cchm-c6c6
Summary: SQL Injection in Fork CMS
Aliases: CVE-2022-0153
Severity: HIGH
CWE: CWE-89
Published: 2022-03-25T00:00:33Z

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module `FormBuilder`), the parameter `id[]` is vulnerable to SQL injection.
Vulnerability: GHSA-7q44-gfvq-6g93
Summary: SQL Injection in Subrion CMS 
Aliases: CVE-2020-18155
Severity: CRITICAL
CWE: CWE-89
Published: 2021-09-08T17:27:45Z

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
Vulnerability: GHSA-2wj9-434x-9hvp
Summary: Insecure Deserialization in Backend User Settings in TYPO3 CMS
Aliases: CVE-2020-11067
Severity: HIGH
CWE: CWE-502
Published: 2020-05-13T23:29:04Z

It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.

Update to TYPO3 versions 9.5.17 or 10.4.2 that fix the problem described.

### References
* https://typo3.org/security/advisory/typo3-core-sa-2020-005
Vulnerability: GHSA-qpgw-2c72-4c89
Summary: Mautic users able to download any files from server using filemanager
Aliases: CVE-2017-1000490
Severity: HIGH
CWE: CWE-22
Published: 2021-01-19T20:50:38Z

### Impact
Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

### Patches
Update to 2.12.0 or later.

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-px8v-hxxx-2rgh
Summary: Potential Code Injection in Sprout Forms
Aliases: CVE-2020-11056
Severity: CRITICAL
CWE: CWE-94, CWE-74
Published: 2020-05-08T21:00:02Z

### Impact

A potential Server-Side Template Injection vulnerability exists in Sprout Forms which could lead to the execution of Twig code.

### Patches

The problem is fixed in`barrelstrength/sprout-forms:v3.9.0` which upgrades to `barrelstrength/sprout-base-email:v1.2.7`

### Workarounds

Users unable to upgrade should update any Notification Emails to use the "Basic Notification (Sprout Email)" template and avoid using the "Basic Notification (Sprout Forms)" template or any custom templates that display Form Fields.

### References

- See the release notes in the [CHANGELOG](https://github.com/barrelstrength/craft-sprout-forms/blob/v3/CHANGELOG.md#390---2020-04-09-critical)
- Credits to Paweł Hałdrzyński, Daniel Kalinowski from [ISEC.PL](https://isec.pl/) for discovery and responsible disclosure

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Sprout Forms repo](https://github.com/barrelstrength/craft-sprout-forms/issues)
* Email us at [sprout@barrelstrengthdesign.com](mailto:sprout@barrelstrengthdesign.com)
Vulnerability: GHSA-h7mq-27r7-w972
Summary: Cross-site Scripting in GilaCMS
Aliases: CVE-2020-20696
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-30T17:13:02Z

A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field.
Vulnerability: GHSA-j878-43hm-8gr5
Summary: Unrestricted Upload of File with Dangerous Type in Microweber
Aliases: CVE-2022-0921
Severity: MODERATE
CWE: CWE-434
Published: 2022-03-12T00:00:30Z

In Microweber prior to 1.2.12, a malicious actor may abuse the Backup/Restore feature to achieve Remote Code Execution.
Vulnerability: GHSA-4mqv-gcr3-pff9
Summary: "Cross-site scripting in phpoffice/phpspreadsheet"
Aliases: CVE-2020-7776
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-06T18:53:37Z

"This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML."
Vulnerability: GHSA-jjvm-3mfq-7gc7
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0506
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T00:00:31Z

microweber version 1.2.10 and prior is vulnerable to cross-site scripting.
Vulnerability: GHSA-qx3w-4864-94ch
Summary: Cleartext storage of session identifier
Aliases: CVE-2021-21339
Severity: MODERATE
CWE: CWE-312
Published: 2021-03-23T01:53:42Z


### Problem
User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system.

### Solution
Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-006](https://typo3.org/security/advisory/typo3-core-sa-2021-006)
Vulnerability: GHSA-vpwq-6cp4-ffqc
Summary: Stored Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0945
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:49Z

ShowDoc prior to version 2.10.4 is vulnerable to stored cross-site scripting viva `axd` and `cshtml` file upload.
Vulnerability: GHSA-w3v3-cxq5-9vr4
Summary: Incorrect Default Permissions and Improper Access Control in snipe-it
Aliases: CVE-2022-0179
Severity: MODERATE
CWE: CWE-276, CWE-284
Published: 2022-01-21T23:58:07Z

snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions.
Vulnerability: GHSA-852q-xxj4-x2rx
Summary: SQL Injection in SimpleSAMLphp
Aliases: CVE-2019-15537
Severity: CRITICAL
CWE: CWE-89
Published: 2019-11-08T20:05:45Z

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
Vulnerability: GHSA-gg6x-xx78-448c
Summary: Reflected XSS when importing CSV in OctoberCMS
Aliases: CVE-2020-5298
Severity: MODERATE
CWE: CWE-87
Published: 2020-06-03T21:58:32Z

### Impact
A user with the ability to use the import functionality of the `ImportExportController` behavior could be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/cd0b6a791f995d86071a024464c1702efc50f46c to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png">
Vulnerability: GHSA-878x-85hc-gc4g
Summary: SQL Injection in LibreNMS
Aliases: CVE-2019-12465
Severity: HIGH
CWE: CWE-89
Published: 2019-10-11T18:43:29Z

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajax_rulesuggest.php?debug=1&term= request.
Vulnerability: GHSA-f7wm-x4gw-6m23
Summary: Insert tag injection in forms
Aliases: CVE-2020-25768
Severity: MODERATE
CWE: CWE-74, CWE-20
Published: 2020-09-24T16:23:54Z

### Impact

It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

### Patches

Update to Contao 4.4.52, 4.9.6 or 4.10.1.

### Workarounds

Disable the front end login form and do not use form fields with array keys such as `fieldname[]`.

### References

https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-5fxf-x22x-5q38
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0929
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-13T00:00:54Z

XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-mj6m-246h-9w56
Summary: Improper regex in htaccess file
Aliases: CVE-2022-25769
Severity: MODERATE
Published: 2022-03-01T22:05:34Z

### Impact
the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

### Patches
Please upgrade to 3.3.5 or 4.2.0 

### Workarounds
No

### References

- Release post: https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic
- Internally tracked under MST-32

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-vxrc-68xx-x48g
Summary: Sandbox Information Disclosure
Aliases: CVE-2019-9942
Severity: LOW
Published: 2022-03-26T00:25:25Z

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
Vulnerability: GHSA-v73w-r9xg-7cr9
Summary: Use of insecure jQuery version in OctoberCMS
Severity: MODERATE
Published: 2020-06-05T19:37:49Z

### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

### Patches
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.

### Workarounds
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.

### References
- https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
- https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory:
* Email us at [octobercms@luketowers.ca](mailto:octobercms@luketowers.ca) & [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Moderate by the @jquery team.

### Acknowledgements

Thanks to @mrgswift for reporting the issue to the October CMS team.
Vulnerability: GHSA-m2wv-m5pf-284r
Summary: Cross-site Scripting in teampass
Aliases: CVE-2022-26980
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-29T00:01:09Z

Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. Someone must open a link for the Teampass Password Manager index page containing malicious payload.
Vulnerability: GHSA-gx7g-wjxg-jwwj
Summary: Cross-Site Request Forgery in YOURLS
Aliases: CVE-2022-0088
Severity: LOW
CWE: CWE-352
Published: 2022-04-04T00:00:55Z

YOURLS versions 1.8.2 and prior are vulnerable to Cross-Site Request Forgery.
Vulnerability: GHSA-9hgc-wpc5-v8p9
Summary: An attacker can execute malicious javascript in Live Helper Chat
Aliases: CVE-2022-1530
Severity: LOW
CWE: CWE-79
Published: 2022-04-30T00:00:37Z

Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious javascript on application.
Vulnerability: GHSA-2p89-5f22-8qvf
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-32711
Severity: CRITICAL
CWE: CWE-200
Published: 2021-09-08T18:00:32Z

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information. https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351 ### Workarounds For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659 ### For more information https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
Vulnerability: GHSA-ph98-v78f-jqrm
Summary: SQL injection in jackalope/jackalope-doctrine-dbal
Aliases: CVE-2021-43822
Severity: HIGH
CWE: CWE-89
Published: 2021-12-14T21:08:13Z

### Impact

Users can provoke SQL injections if they can specify a node name or query.

### Patches

Upgrade to version 1.7.4

If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`.

### Workarounds

Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.

If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected. 

### References

No further references.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [jackalope/jackalope-doctrine-dbal repo](https://github.com/jackalope/jackalope-doctrine-dbal/issues)
Vulnerability: GHSA-qvc5-cfrr-384v
Summary: RCE in Third Party Library in Shopware
Severity: LOW
Published: 2020-09-23T17:20:28Z

### Impact
RCE in Third Party Library

### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. 

For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020
Vulnerability: GHSA-fjh3-g8gq-9q92
Summary: Cross-Site Scripting in Content Preview
Aliases: CVE-2021-21340
Severity: LOW
CWE: CWE-79
Published: 2021-03-23T01:53:47Z

> ### Meta
> * CVSS: `AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0)
> * CWE-79
> * Status: **DRAFT**

### Problem
It has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-007](https://typo3.org/security/advisory/typo3-core-sa-2021-007)
Vulnerability: GHSA-wf5p-f5xr-c4jj
Summary: SQL Injection in rosariosis
Aliases: CVE-2021-44427
Severity: CRITICAL
CWE: CWE-89
Published: 2021-12-02T17:48:53Z

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
Vulnerability: GHSA-fjqg-w8g6-hhq8
Summary: Improper Authentication and Improper Access Control in Dolibarr
Aliases: CVE-2021-25956
Severity: HIGH
CWE: CWE-287, CWE-284
Published: 2021-09-02T17:16:28Z

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
Vulnerability: GHSA-w4hp-pcp8-qhf3
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0387
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T23:06:32Z

Stored XSS is found in Settings>Live help configuration>Departments->Departments groups->edit When a user creates a new webhook under the NAME field and puts a payload {{constructor.constructor('alert(1)')()}}, the input gets stored, at user edit groupname , the payload gets executed.
Vulnerability: GHSA-rgg3-3wh7-w935
Summary: Unrestricted Upload of File with Dangerous Type in Zenario CMS
Aliases: CVE-2021-42171
Severity: CRITICAL
CWE: CWE-434
Published: 2022-03-15T00:00:58Z

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
Vulnerability: GHSA-xm9f-vxmx-4m58
Summary: Data Flow Sanitation Issue Fix 
Aliases: CVE-2021-32759
Severity: HIGH
CWE: CWE-20
Published: 2021-08-30T17:20:41Z

### Impact
Due to missing sanitation in data flow it was possible for admin users to upload arbitrary executable files to the server.
Vulnerability: GHSA-vwfx-hh3w-fj99
Summary: Potential XSS injection in the newsletter conditions field
Aliases: CVE-2021-21418
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-06T17:24:14Z

### Impact
An employee can inject javascript in the newsletter condition field that will then be executed on the front office

### Patches
The issue has been fixed in 2.6.1
Vulnerability: GHSA-5vr6-hm68-5j9p
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-44279
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-03T20:49:16Z

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
Vulnerability: GHSA-4f26-v6fr-9hmp
Summary: Improper Input Validation in Centreon Web
Aliases: CVE-2019-16405
Severity: HIGH
CWE: CWE-20
Published: 2021-07-28T17:52:45Z

Centreon Web 19.04.4 allows Remote Code Execution by an administrator who can modify Macro Expression location settings.
Vulnerability: GHSA-jv6v-fvvx-4932
Summary: Arbitrary File Deletion vulnerability in OctoberCMS
Aliases: CVE-2020-5296
Severity: MODERATE
CWE: CWE-73
Published: 2020-06-03T21:58:21Z

### Impact
An attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1241" alt="Screen Shot 2020-03-31 at 12 16 53 PM" src="https://user-images.githubusercontent.com/7253840/78060872-89354d00-7349-11ea-8c2b-5881b0a50736.png">
Vulnerability: GHSA-v3mr-gp7j-pw5w
Summary: Possible SQL injection in tablelookupwizard Contao Extension
Severity: HIGH
CWE: CWE-89
Published: 2022-02-10T22:33:46Z

### Impact
The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.

### Patches
The issue has been patched in `tablelookupwizard` version 3.3.5 and version 4.0.0.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/terminal42/contao-tablelookupwizard
* Email us at [info@terminal42.ch](mailto:info@terminal42.ch)
Vulnerability: GHSA-h77r-rp97-7rv4
Summary: Privilage Escalation in moodle
Aliases: CVE-2020-25699
Severity: HIGH
CWE: CWE-863, CWE-269
Published: 2021-03-29T20:43:01Z

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Vulnerability: GHSA-hxj6-v58r-cqv3
Summary: Cross Site Scripting in Subrion CMS
Aliases: CVE-2020-22392
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-01T18:31:45Z

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.
Vulnerability: GHSA-5x4f-7xgq-r42x
Summary: Object state limitation has no effect
Severity: CRITICAL
CWE: CWE-281
Published: 2022-04-29T15:39:18Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Vulnerability: GHSA-4x5h-cr29-fhp6
Summary: Local file disclosure in PHPMailer
Aliases: CVE-2017-5223
Severity: MODERATE
CWE: CWE-200
Published: 2020-03-05T22:09:10Z

An issue was discovered in PHPMailer before 5.2.22. PHPMailer&#39;s `msgHTML` method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to `/`, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.

### Impact
Arbitrary local files can be attached to email messages.

### Patches
Fixed in 5.2.22

### Workarounds
Validate input before using user-supplied file paths.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-5223

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
Vulnerability: GHSA-hhr9-7xvh-8xgc
Summary: Server side request forgery in LiveHelperChat
Aliases: CVE-2022-1213
Severity: HIGH
CWE: CWE-918
Published: 2022-04-06T00:01:32Z

SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
Vulnerability: GHSA-9652-78hp-w58c
Summary: Stored cross-site scripting in PressBooks
Aliases: CVE-2021-3271
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-29T20:07:39Z

PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS.
Vulnerability: GHSA-6qcc-whgp-pjj2
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0832
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
Vulnerability: GHSA-8wp2-vxpg-xcvp
Summary: Cross site scripting in facturascripts
Aliases: CVE-2022-1457
Severity: CRITICAL
CWE: CWE-79
Published: 2022-04-26T00:00:43Z

facturasripts is an open source ERP software. Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Vulnerability: GHSA-8qvx-f5gf-g43v
Summary: Logic error in dolibarr
Aliases: CVE-2022-0174
Severity: MODERATE
CWE: CWE-20
Published: 2022-01-12T22:54:50Z

The application does not check the input of price number lead to Business Logic error through negative price amount.
Vulnerability: GHSA-4h9c-v5vg-5m6m
Summary: Access to restricted PHP code by dynamic static class access in smarty
Aliases: CVE-2021-21408
Severity: HIGH
CWE: CWE-20
Published: 2022-01-12T22:43:42Z

### Impact
Template authors could run restricted static php methods.

### Patches
Please upgrade to 3.1.40 or higher.

### References
See the [documentation on Smarty security features](https://www.smarty.net/docs/en/advanced.features.tpl#advanced.features.security) on the static_classes access filter.

### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Vulnerability: GHSA-c7v4-m269-4995
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Moodle
Aliases: CVE-2020-25703
Severity: MODERATE
CWE: CWE-200
Published: 2021-10-21T17:49:08Z

The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
Vulnerability: GHSA-ghww-cv4v-hmxx
Summary: Cross-Site Request Forgery microweber
Aliases: CVE-2022-0638
Severity: MODERATE
CWE: CWE-352
Published: 2022-02-18T00:00:34Z

microweber prior to version 1.2.11 is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-f3rf-v9qm-9c89
Summary: Cross-site Scripting in the femanager TYPO3 extension
Aliases: CVE-2021-36787
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-01T18:36:51Z

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.

Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
Vulnerability: GHSA-h2fj-77wh-fh5w
Summary: Cross-site Scripting in livehelperchat
Aliases: CVE-2022-0612
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-17T00:00:36Z

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Vulnerability: GHSA-vf23-f26f-mjj9
Summary: Moderate severity vulnerability that affects yourls/yourls
Aliases: CVE-2019-14537
Severity: CRITICAL
CWE: CWE-843
Published: 2019-09-23T18:32:02Z

## Type juggling vulnerability in the API

### Impact
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass.

### Patches
https://github.com/YOURLS/YOURLS/releases/tag/1.7.4
https://github.com/YOURLS/YOURLS/pull/2542

### References
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537
* https://github.com/Wocanilo/CVE-2019-14537

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [YOURLS repository](https://github.com/YOURLS/YOURLS)
Vulnerability: GHSA-4pww-fqgh-36hj
Summary: Unrestricted Upload of File with Dangerous Type in Croogo
Aliases: CVE-2021-44673
Severity: HIGH
CWE: CWE-434
Published: 2022-03-11T00:02:02Z

A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2 via admin/file-manager/attachments, which lets a malicious user upload a web shell script.
Vulnerability: GHSA-c5gj-w4hx-gvmx
Summary: Business Logic Errors in microweber
Aliases: CVE-2022-0688
Severity: LOW
Published: 2022-02-21T00:00:21Z

Microweber prior to 1.2.11 can suffer from insecure direct object reference(s). A malicious actor can remove items from a victim's cart.
Vulnerability: GHSA-3qr6-qrqm-8v86
Summary: Integer Overflow or Wraparound in Microweber
Aliases: CVE-2022-1036
Severity: HIGH
CWE: CWE-190
Published: 2022-03-23T00:00:23Z

In Microweber prior to 1.2.12, a user can create an account with a password thousands of characters in length, leading to memory corruption/integer overflow. Version 1.2.2 sets maximum password length at 500 characters.
Vulnerability: GHSA-wqq8-mqj9-697f
Summary: PrestaShop autoupgrade module ZIP archives were vulnerable from CVE-2017-9841
Severity: HIGH
Published: 2020-01-08T03:10:30Z

### Impact

We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

This vulnerability impacts
- phpunit before 4.8.28 and 5.x before 5.6.3 as reported in [CVE-2017-9841](https://nvd.nist.gov/vuln/detail/CVE-2017-9841)
- phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after disclosure was provided to phpunit maintainers)

You can read PrestaShop official statement about this vulnerability [here](https://build.prestashop.com/news/critical-security-vulnerability-in-prestashop-modules/).

### Patches

In the [security patch](https://github.com/PrestaShop/autoupgrade/releases/tag/v4.10.1), we look for the unwanted vendor/phpunit folder and remove it if we find it. This allows users to fix the security issue when upgrading.

### Workarounds
Users can also simply remove the unwanted vendor/phpunit folder.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-9841

### For more information
If you have any questions or comments about this advisory, email us at security@prestashop.com
Vulnerability: GHSA-28w5-j8xj-2xwc
Summary: Cross-site Scripting in the yoast_seo TYPO3 extension
Aliases: CVE-2021-36788
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-01T18:36:44Z

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
Vulnerability: GHSA-f2vv-h5x4-57gr
Summary: Leak of information via Store-API
Severity: CRITICAL
CWE: CWE-202
Published: 2021-02-10T02:32:21Z

### Impact
Leak of information via Store-API

### Patches
We recommend to update to the current version 6.3.5.1. You can get the update to 6.3.5.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

The vulnerability could only be fixed by changing the API system, which involves a non-backward-compatible change. Only consumers of the Store-API should be affected by this change. Please check your plugins if you have it in use. Detailed technical information can be found in the upgrade information.

https://github.com/shopware/platform/blob/v6.3.5.1/UPGRADE-6.3.md#6351

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-02-2021
Vulnerability: GHSA-jr37-66pj-36v7
Summary: Cross-site Scripting in DayByDay CRM
Aliases: CVE-2022-22109
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-08T00:32:00Z

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks.
Vulnerability: GHSA-fc38-mxwr-pfhx
Summary: Cross-Site Scripting via SVG media files
Aliases: CVE-2021-37710
Severity: HIGH
CWE: CWE-79
Published: 2021-08-23T19:43:00Z

### Impact
Cross-Site Scripting via SVG media files

### Patches
We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Vulnerability: GHSA-r89v-cgv7-3jhx
Summary: Bypass of fix for CVE-2020-15247, Twig sandbox escape
Aliases: CVE-2020-26231
Severity: LOW
CWE: CWE-862
Published: 2020-11-23T20:54:18Z

### Impact
A bypass of CVE-2020-15247 (fixed in 1.0.469 and 1.1.0) was discovered that has the same impact as CVE-2020-15247:

An authenticated backend user with the `cms.manage_pages`, `cms.manage_layouts`, or `cms.manage_partials` permissions who would **normally** not be permitted to provide PHP code to be executed by the CMS due to `cms.enableSafeMode` being enabled is able to write specific Twig code to escape the Twig sandbox and execute arbitrary PHP.

This is not a problem for anyone that trusts their users with those permissions to normally write & manage PHP within the CMS by not having `cms.enableSafeMode` enabled, but would be a problem for anyone relying on `cms.enableSafeMode` to ensure that users with those permissions in production do not have access to write & execute arbitrary PHP.

### Patches
Issue has been patched in Build 470 (v1.0.470) and v1.1.1.

### Workarounds
Apply https://github.com/octobercms/october/commit/d34fb8ab51108495a9a651b841202d935f4e12f7 to your installation manually if unable to upgrade to Build 470 or v1.1.1.

### References
Reported by [ka1n4t](https://github.com/ka1n4t)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-10-10 at 1 21 13 PM" src="https://user-images.githubusercontent.com/7253840/95663316-7de28b80-0afb-11eb-999d-a6526cf78709.png">
Vulnerability: GHSA-2xmm-g482-4439
Summary: DQL injection through sorting parameters blocked
Aliases: CVE-2022-24752
Severity: CRITICAL
CWE: CWE-89
Published: 2022-03-15T19:09:16Z

### Impact
Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

### Patches
The issue is fixed in version 1.10.1 and in 1.11-rc.1

### Workarounds

You have to overwrite your `Sylius\Component\Grid\Sorting\Sorter.php` class:

```php
<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}
```
and register it in your container: 

```yaml
# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)
* Email us at [security@sylius.com](mailto:security@sylius.com)
Vulnerability: GHSA-rxch-gp62-574w
Summary: snipe-it is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4108
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-16T14:13:27Z

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Vulnerability: GHSA-7v3x-h7r2-34jv
Summary: Insufficient Session Expiration in Pterodactyl API
Severity: MODERATE
CWE: CWE-613
Published: 2022-01-21T18:43:05Z

### Impact
A vulnerability exists in Pterodactyl Panel `<= 1.6.6` that could allow a malicious attacker that compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to remain logged in as the user the key belonged to.

It is important to note that **a malicious user must first compromise an existing API key for a user to exploit this issue**. It cannot be exploited by chance, and requires a coordinated attack against an individual account using a known API key.

### Patches
This issue has been addressed in the `v1.7.0` release of Pterodactyl Panel.

### Workarounds
Those not wishing to upgrade may apply the change below:

```diff
diff --git a/app/Http/Middleware/Api/AuthenticateKey.php b/app/Http/Middleware/Api/AuthenticateKey.php
index eb25dac6..857bfab2 100644
--- a/app/Http/Middleware/Api/AuthenticateKey.php
+++ b/app/Http/Middleware/Api/AuthenticateKey.php
@@ -70,7 +70,7 @@ class AuthenticateKey
         } else {
             $model = $this->authenticateApiKey($request->bearerToken(), $keyType);

-            $this->auth->guard()->loginUsingId($model->user_id);
+            $this->auth->guard()->onceUsingId($model->user_id);
         }
```

### For more information
If you have any questions or comments about this advisory please reach out to `Tactical Fish#8008` on [Discord](https://discord.gg/pterodactyl) or email `dane@pterodactyl.io`.
Vulnerability: GHSA-6pj2-5fqq-xvjc
Summary: Incorrect Authorization in latte/latte
Aliases: CVE-2021-23803
Severity: CRITICAL
CWE: CWE-863
Published: 2022-01-06T20:56:27Z

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.
Vulnerability: GHSA-pjjf-hc4q-g298
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3775
Severity: MODERATE
CWE: CWE-352
Published: 2021-11-15T23:16:17Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-8m28-w6xg-35hw
Summary: Cross-Site Request Forgery (CSRF) in livehelperchat
Aliases: CVE-2022-0231
Severity: MODERATE
CWE: CWE-352
Published: 2022-01-26T20:22:08Z

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Vulnerability: GHSA-72hm-fx78-xwhc
Summary: XSS vulnerability on contacts view
Aliases: CVE-2021-27911
Severity: HIGH
CWE: CWE-79
Published: 2021-09-01T18:40:40Z

### Impact
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc. 

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-9jp8-cwwx-p64q
Summary: XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Severity: MODERATE
Published: 2021-12-01T18:28:38Z

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.