aswin1906/github-advisory-2022 huggingface dataset:
Change in port should be considered a change in origin
Advisory: GHSA-q559-8m2m-g699
Aliases: CVE-2022-31091
Published: 2022-06-21T20:07:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact

`Authorization` and `Cookie` headers on requests are sensitive information. On making a request which responds with a redirect to a URI with a different port, if we choose to follow it, we should remove the `Authorization` and `Cookie` headers from the request, before containing. Previously, we would only consider a change in host or scheme downgrade. Now, we consider any change in host, port or scheme to be a change in origin.

### Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5.

### Workarounds

An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

### References

* [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)
* [CVE-2022-27776](https://curl.se/docs/CVE-2022-27776.html)

### For more information

If you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).
Code injection in Elefant CMS
Advisory: GHSA-gx6v-67qv-rhx5
Aliases: CVE-2017-20064
Published: 2022-06-21T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
Got allows a redirect to a UNIX socket
Advisory: GHSA-pfrx-2q88-qq97
Aliases: CVE-2022-33987
Published: 2022-06-19T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The got package before 11.8.5 and 12.1.0 for Node.js allows a redirect to a UNIX socket.
Prototype Pollution in deep-get-set
Advisory: GHSA-mjjj-6p43-vhhv
Aliases: CVE-2022-21231
Published: 2022-06-25T00:00:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-7715](https://security.snyk.io/vuln/SNYK-JS-DEEPGETSET-598666)
Threshold value is ignored (all shares are n=3)
Advisory: GHSA-978j-88f3-p5j3
Published: 2022-06-17T00:18:43Z

Affected versions of this crate did not properly calculate secret shares requirements.

This reduces the security of the algorithm by restricting the crate to always
using a threshold value of three, rather than a configurable limit.

The flaw was corrected by correctly configuring the threshold.
Improper Check for Unusual or Exceptional Conditions in Elasticsearch
Advisory: GHSA-wh6w-69xc-5rq5
Aliases: CVE-2022-23712
Published: 2022-06-07T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A Denial of Service flaw was discovered in Elasticsearch 8.0.0 through 8.2.0. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request. Version 8.2.1 contains a patch.
Improper handling of double quotes in file name in Diffy in Windows environment
Advisory: GHSA-5ww9-9qp2-x524
Aliases: CVE-2022-33127
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.
Reachable Assertion in rulex
Advisory: GHSA-8v9w-p43c-r885
Aliases: CVE-2022-31100
Published: 2022-06-21T20:12:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
When parsing untrusted rulex expressions, rulex may crash, possibly enabling a Denial of Service attack. This happens when the expression contains a multi-byte UTF-8 code point in a string literal or after a backslash, because rulex tries to slice into the code point and panics as a result.

This is a security concern for you, if
- your service parses untrusted rulex expressions (expressions provided by an untrusted user), and
- your service becomes unavailable when the thread running rulex panics.

### Patches
The crashes are fixed in version **0.4.3**. Affected users are advised to update to this version.

### Workarounds
You can use `catch_unwind` to recover from panics.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [rulex](https://github.com/rulex-rs/rulex/issues)
* Email me at [ludwig.stecher@gmx.de](mailto:ludwig.stecher@gmx.de)

### Credits

Credit for finding these bugs goes to

- [cargo fuzz](https://github.com/rust-fuzz/cargo-fuzz) and [afl.rs](https://github.com/rust-fuzz/afl.rs)
- [evanrichter](https://github.com/evanrichter)
- [ForAllSecure Mayhem](https://forallsecure.com/)
Cross-site Scripting in FacturaScripts
Advisory: GHSA-r7jw-mg27-j839
Aliases: CVE-2022-1988
Published: 2022-06-04T00:00:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

FacturaScripts 2022.08 and prior is vulnerable to cross-site scripting. A patch is available on the `master` branch of the repository and anticipated to be part of version 2022.09.
Token bruteforcing
Advisory: GHSA-q874-g24w-4q9g
Aliases: CVE-2022-29241
Published: 2022-06-16T23:13:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affects: Notebook and Lab between 6.4.0?(potentially earlier) and 6.4.11 (currently latest). Jupyter Server <=1.16.0. If I am correct about the responsible code it will affect Jupyter-Server 1.17.0 and 2.0.0a0 as well.
Description: If notebook server is started with a value of `root_dir` that contains the starting user's home directory, then the underlying REST API can be used to leak the access token assigned at start time by guessing/brute forcing the PID of the jupyter server. While this requires an authenticated user session, this url can be used from an xss payload (as in CVE-2021-32798) or from a hooked or otherwise compromised browser to leak this access token to a malicious third party. This token can be used along with the REST API to interact with Jupyter services/notebooks such as modifying or overwriting critical files, such as .bashrc or .ssh/authorized_keys, allowing a malicious user to read potentially sensitive data and possibly gain control of the impacted system.
Unrestricted Attachment Upload
Advisory: GHSA-fr2w-mp56-g4xp
Aliases: CVE-2022-2111
Published: 2022-06-17T01:16:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

InvenTree allows unrestricted upload of files as attachments to various database fields. Potentially dangerous files (such as HTML files containing malicious javascript) can be uploaded, and (when opened by the user) run the malicious code directly in the users browser.

![image](https://user-images.githubusercontent.com/10080325/173549827-af2d7a5c-1359-4d68-a920-dfdd0ccc882e.png)

*Note that the upload of malicious files must be performed by an authenticated user account*

### Solution

The solution for this vulnerability is to ensure that attachment files are downloaded to the local machine before opening, rather than opening the file in the current browser context.

### Patches

- The issue is addressed in the upcoming 0.8.0 release
- This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

### Workarounds

Users can alleviate risk of opening malicious files by right-clicking on the attachment link and selecting "Save link as"

![image](https://user-images.githubusercontent.com/10080325/173550035-2de4bf01-f0d3-4be8-ac45-6fbcf66a95e7.png)

This minimizes risk (e.g. of XSS attacks) by opening the HTML file from the users computer

### References

https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1/

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [github](http://github.com/inventree/inventree)
* Email us at [security@inventree.org](mailto:security@inventree.org)
gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy
Advisory: GHSA-jcr6-mmjj-pchw
Aliases: CVE-2017-20146
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.
Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
Advisory: GHSA-x45c-cvp8-q4fm
Aliases: CVE-2022-46167
Published: 2022-12-05T23:08:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items.

With that said, an attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation.

### Patches

Patches have been released for version 0.1.3 and all users must upgrade to this release.

### Workarounds

N.A.

### References

N.A.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [github.com/clastix/capsule](https://github.com/clastix/capsule)
* Reach out on [#capsule](https://kubernetes.slack.com/archives/C03GETTJQRL) channel available on Kubernetes Slack workspace
Alist vulnerable to Path Traversal
Advisory: GHSA-pmg2-rph8-p8r6
Aliases: CVE-2022-45969
Published: 2022-12-16T00:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In versions of Alist prior to 3.6.0, a user with only file upload permission can bypass the base path restriction by using '... /' to bypass the base path restriction and upload files to an arbitrary path.
FeehiCMS Cross Site Scripting vulnerability
Advisory: GHSA-6jj8-mqx2-7fg5
Aliases: CVE-2020-36607
Published: 2022-12-15T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
usememos/memos Denial of Service vulnerability
Advisory: GHSA-33m8-f4hw-wm3q
Aliases: CVE-2022-4767
Published: 2022-12-27T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Denial of Service in GitHub repository usememos/memos 0.9.0 and prior. A patch is available on the `main` branch at commit number f888c628408501daf639de07b90a72ab443b0f4c.
Traefik may display authorization header in the debug logs
Advisory: GHSA-h2ph-vhm7-g4hp
Aliases: CVE-2022-23469
Published: 2022-12-08T16:11:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

### Impact

There is a potential vulnerability in Traefik displaying the Authorization header in its debug logs.

Traefik uses [oxy](https://github.com/vulcand/oxy) to provide the following features:

- Round Robin: https://doc.traefik.io/traefik/routing/services/#weighted-round-robin-service
- Buffering: https://doc.traefik.io/traefik/middlewares/http/buffering/
- Circuit Breaker: https://doc.traefik.io/traefik/middlewares/http/circuitbreaker/
- In-Flight Requests: https://doc.traefik.io/traefik/middlewares/http/inflightreq/

In such cases, if the log level is set to DEBUG, the credentials provided using the Authorization header are displayed in the debug logs:

```
level=debug msg="vulcand/oxy/roundrobin/rr: completed ServeHttp on request" Request="{\\"Method\\":\\"POST\\",\\"URL\\":{\\"Scheme\\":\\"\\",\\"Opaque\\":\\"\\",\\"User\\":null,\\"Host\\":\\"\\",\\"Path\\":\\"/<redacted>/<redacted>\\",\\"RawPath\\":\\"\\",\\"ForceQuery\\":false,\\"RawQuery\\":\\"\\",\\"Fragment\\":\\"\\",\\"RawFragment\\":\\"\\"},\\"Proto\\":\\"HTTP/2.0\\",\\"ProtoMajor\\":2,\\"ProtoMinor\\":0,\\"Header\\":{\\"Authorization\\":[\\"Bearer <token value was here>\\"],\\"Content-Type\\":[\\"application/grpc\\"],\\"Grpc-Accept-Encoding\\":[\\"gzip\\"],\\"Grpc-Timeout\\":[\\"29999886u\\"],\\"Te\\":[\\"trailers\\"],\\"User-Agent\\":[\\"<redacted>\\"],<remainder of log message removed>
```

### Patches

https://github.com/traefik/traefik/pull/9574
https://github.com/traefik/traefik/releases/tag/v2.9.6

### Workarounds

Set the log level to `INFO`, `WARN`, or `ERROR`.

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
vm2 vulnerable to Arbitrary Code Execution
Advisory: GHSA-4w2j-2rg4-5mjw
Aliases: CVE-2022-25893
Published: 2022-12-21T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package vm2 before 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Microweber vulnerable to Stored Cross-Site Scripting
Advisory: GHSA-9cmm-52cv-6hvc
Aliases: CVE-2022-4647
Published: 2022-12-22T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Microweber versions 1.3.1 and prior are vulnerable to stored Cross-site Scripting (XSS). A patch is available on the 1.4, dev, and laravel-sail branches.
Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue
Advisory: GHSA-q2fj-6h62-59m2
Published: 2022-12-30T22:13:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

If you are using the **Apiman Vert.x Gateway** prior to Apiman 3.0.0.Final, a connection caching issue in Hazelcast could allow an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity.

Hazelcast is a transitive dependency of the Apiman Vert.x Gateway.

The precise risk is difficult to quantify at this juncture as plugins deployed by users may make use of Hazelcast in a different manner to the main Apiman codebase.

If any of your custom Apiman plugins specify Hazelcast dependencies, you should also bump these versions. 

Hint: an easy way to track Apiman dependency versions is to use `apiman-parent`.

If you use the Apiman Tomcat or WildFly Gateway this does not affect you.

### Patches

Upgrade to **Apiman 3.0.0.Final or later**.

If you are using an older version of Apiman and need to remain on that version, contact to your Apiman support provider for advice/long-term support.

### Workarounds

None (other than doing your own build).

### References

* https://github.com/advisories/GHSA-c5hg-mr8r-f6jp
usememos/memos Improper Access Control vulnerability
Advisory: GHSA-6w5w-wx8w-2cq9
Aliases: CVE-2022-4809
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

usememos/memos 0.9.0 and prior is vulnerable to full account takeover via changing user name, email address, and display name.
liquidjs may leak properties of a prototype
Advisory: GHSA-45rm-2893-5f49
Aliases: CVE-2022-25948
Published: 2022-12-22T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The package liquidjs before 10.0.0 is vulnerable to Information Exposure when `ownPropertyOnly` parameter is set to `False`, which results in leaking properties of a prototype. Workaround For versions 9.34.0 and higher, an option to disable this functionality is provided.
usememos/memos Improper Access Control vulnerability
Advisory: GHSA-6fx9-29x2-fmfj
Aliases: CVE-2022-4814
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Improper Access Control in GitHub repository usememos/memos 0.9.0 and prior.
hutool-json stack overflow vulnerability
Advisory: GHSA-whgh-g24c-3j5q
Aliases: CVE-2022-45690
Published: 2022-12-13T15:30:26Z

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data.
baserCMS vulnerable to stored Cross-site Scripting
Advisory: GHSA-vxwf-79ch-f7f7
Aliases: CVE-2022-41994
Published: 2022-12-07T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
EnumStringValues vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-vq23-hwg7-hxrh
Aliases: CVE-2020-36620
Published: 2022-12-21T21:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A vulnerability was found in Brondahl EnumStringValues 4.0.1. It has been declared as problematic. This vulnerability affects the function GetStringValuesWithPreferences_Uncache of the file EnumStringValues/EnumExtensions.cs. The manipulation leads to resource consumption. Upgrading to version 4.0.2 to address this issue. The name of the patch is c0fc7806beb24883cc2f9543ebc50c0820297307. It is recommended to upgrade the affected component. VDB-216466 is the identifier assigned to this vulnerability.
Improper neutralization of data URIs may allow XSS in Loofah
Advisory: GHSA-228g-948r-83gx
Aliases: CVE-2022-23515
Published: 2022-12-13T17:39:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

## Summary

Loofah `>= 2.1.0, < 2.19.1` is vulnerable to cross-site scripting via the `image/svg+xml` media type in data URIs.


## Mitigation

Upgrade to Loofah `>= 2.19.1`.


## Severity

The Loofah maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266)
- https://hackerone.com/reports/1694173
- https://github.com/flavorjones/loofah/issues/101

## Credit

This vulnerability was responsibly reported by Maciej Piechota (@haqpl).
yaml package for Go can consume excessive amounts of CPU or memory
Advisory: GHSA-6q6q-88xp-6f2r
Aliases: CVE-2022-3064
Published: 2022-12-28T00:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory
@cubejs-backend/api-gateway row level security bypass
Advisory: GHSA-6jqm-3c9g-pch7
Aliases: CVE-2022-23510
Published: 2022-12-12T21:28:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact
All authenticated Cube clients could bypass row-level security and run arbitrary SQL via the newly introduced /v1/sql-runner endpoint.

### Patches
The change has been reverted in 0.31.24

### Workarounds
Upgrade to >=0.31.24 or downgrade to <=0.31.22

### Post mortem
As part of implementing the Cube Cloud SQL runner functionality, we’ve added a new endpoint to the Cube Core so that we could add arbitrary queries directly to the queue, bypassing the modeling layer.

The endpoint was added in this commit: https://github.com/cube-js/cube.js/commit/f1e25bb50323c0b99f3891d349467e7b637baeea

It went through the code review; however, it slipped everyone’s attention that this endpoint completely bypasses any row-level security logic implemented in the modeling layer. Now anyone with a valid Cube JWT token could fetch any data, even if they were not allowed to do so by their security context.

The issue was noticed by the Core team on Dec 12 and immediately reverted.

The just-released 0.31.23 version of the Cube has been pulled out of all the registries, and a CVE was published on Github.
Another change (https://github.com/cube-js/cube.js/commit/2c5db32f2ded074ebe5e83668eee8c024101240b) was also rolled back along with the SQL runner endpoint. It didn't pose a significant security threat, but it increased the attacker’s ability to enumerate cube schema, and it should be revisited.

The 0.31.24 was released to replace the revoked version with a change completely reverted. All customers are urged to upgrade to the newest Cube version.
Jenkins Plot Plugin XML External Entity Reference vulnerability
Advisory: GHSA-wgpp-g6v9-7hxp
Aliases: CVE-2022-46682
Published: 2022-12-12T09:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control XML input files for the 'Plot build data' build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Plot Plugin 2.1.12 disables external entity resolution for its XML parser.
Python Charmers Future denial of service vulnerability
Advisory: GHSA-v3c5-jqr6-7qm8
Aliases: CVE-2022-40899
Published: 2022-12-23T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. This issue has been patched in version 0.18.3.
usememos/memos vulnerable to stored Cross-site Scripting
Advisory: GHSA-f552-97qx-c694
Aliases: CVE-2022-4692
Published: 2022-12-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
usememos/memos vulnerable to Cross-site Scripting
Advisory: GHSA-x9p9-v3x6-68mq
Aliases: CVE-2022-4866
Published: 2022-12-31T09:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Certifi removing TrustCor root certificate
Advisory: GHSA-43fp-rhv2-5gv8
Aliases: CVE-2022-23491
Published: 2022-12-07T23:05:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.

TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ).
pastebinit Path Traversal vulnerability
Advisory: GHSA-cwh7-28vg-jmpr
Aliases: CVE-2018-25059
Published: 2022-12-30T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. The manipulation of the argument `r.URL.Path` leads to path traversal. Upgrading to version 0.2.3 can address this issue. The name of the patch is 1af2facb6d95976c532b7f8f82747d454a092272. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217040.
Concrete CMS vulnerable to cross-site scripting in the text input field
Advisory: GHSA-xj33-8r43-r227
Aliases: CVE-2022-43556
Published: 2022-12-06T00:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3.
rdiffweb vulnerable to Business Logic Errors
Advisory: GHSA-2wpw-cm9w-v4xm
Aliases: CVE-2022-4719
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
golang.org/x/text/language Out-of-bounds Read vulnerability
Advisory: GHSA-ppp9-7jff-5vj2
Aliases: CVE-2021-38561
Published: 2022-12-26T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
UBI Reader vulnerable to Path Traversal
Advisory: GHSA-hc37-84v3-8gmq
Aliases: CVE-2022-4572
Published: 2022-12-17T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched remotely. Upgrading to version 0.8.5 can address this issue. The name of the patch is d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146 is the identifier assigned to this vulnerability.
usememos/memos Cross-Site Request Forgery vulnerability
Advisory: GHSA-gw9m-2m5v-c6x5
Aliases: CVE-2022-4845
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
Advisory: GHSA-c5wx-6c2c-f7rm
Aliases: CVE-2022-23503
Published: 2022-12-13T17:11:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

### Problem
Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it was possible to inject code instructions to be processed and executed via TypoScript as PHP code.

The existence of individual TypoScript instructions for a particular form item (known as [`formDefinitionOverrides`](https://docs.typo3.org/c/typo3/cms-form/main/en-us/I/Concepts/FrontendRendering/Index.html#form-element-properties)) and a valid backend user account with access to the form module are needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

### References
* [TYPO3-CORE-SA-2022-015](https://typo3.org/security/advisory/typo3-core-sa-2022-015)
usememos/memos missing Secure cookie attribute
Advisory: GHSA-qcw2-492v-57xj
Aliases: CVE-2022-4683
Published: 2022-12-23T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking.
Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
Advisory: GHSA-c4pm-63cg-9j7h
Aliases: CVE-2022-23496
Published: 2022-12-08T15:52:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

### Impact
Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. Applications that do not use this feature are not affected.

### Patches
Upgrade to 7.9.0

### Workarounds
Catch and discard any exceptions from Yauaa.
rdiffweb Improper Access Control vulnerability
Advisory: GHSA-m8r9-qxx8-mrxp
Aliases: CVE-2022-4724
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
PaddlePaddle vulnerable to Code Injection
Advisory: GHSA-gcjf-29m9-888q
Aliases: CVE-2022-46742
Published: 2022-12-07T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Code injection in `paddle.audio.functional.get_window` in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. A [patch](https://github.com/PaddlePaddle/Paddle/commit/26c419ca386aeae3c461faf2b828d00b48e908eb) is available on the `develop` branch of the repository and anticipated to be part of a 2.4 release.
AList vulnerable to Improper Preservation of Permissions
Advisory: GHSA-4gjr-vgfx-9qvw
Aliases: CVE-2022-45968
Published: 2022-12-12T15:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one). Version 3.5.1 contains a patch.
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability
Advisory: GHSA-8gh8-hqwg-xf34
Aliases: CVE-2021-4279
Published: 2022-12-25T21:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 can address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
ahh vulnerable to Path Traversal
Advisory: GHSA-vp56-r7qv-783v
Aliases: CVE-2020-36559
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Due to improper santization of user input, HTTPEngine.Handle allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
email-existence Inefficient Regular Expression Complexity vulnerability
Advisory: GHSA-p27h-4cpf-fw48
Aliases: CVE-2018-25049
Published: 2022-12-27T09:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file `index.js`. The manipulation leads to inefficient regular expression complexity. The name of the patch is 0029ba71b6ad0d8ec0baa2ecc6256d038bdd9b56. It is recommended to apply a patch to fix this issue. VDB-216854 is the identifier assigned to this vulnerability.
rgb2hex vulnerable to inefficient regular expression complexity
Advisory: GHSA-7599-fqgm-v84p
Aliases: CVE-2018-25061
Published: 2022-12-31T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to inefficient regular expression complexity. The attack may be initiated remotely. Upgrading to version 0.1.6 can address this issue. The name of the patch is 9e0c38594432edfa64136fdf7bb651835e17c34f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217151.
Apache Airflow Hive Provider vulnerable to Command Injection
Advisory: GHSA-rc58-qr9j-cpgw
Aliases: CVE-2022-46421
Published: 2022-12-20T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider before 5.0.0.
rdiffweb has no rate limit on resend email feature
Advisory: GHSA-7q4r-x5qg-mmcp
Aliases: CVE-2022-4723
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

rdiffweb prior to 2.5.5 has no rate limit on the "resend email feature" while enable or disable 2FA from `/prefs/mfa` endpoint .
Oxidized Web vulnerable to Cross-site Scripting
Advisory: GHSA-8qwh-rm6c-jv96
Aliases: CVE-2019-25088
Published: 2022-12-27T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file `lib/oxidized/web/views/conf_search.haml`. The manipulation of the argument `to_research` leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 55ab9bdc68b03ebce9280b8746ef31d7fdedcc45. It is recommended to apply a patch to fix this issue. VDB-216870 is the identifier assigned to this vulnerability.
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
Advisory: GHSA-8w3p-qh3x-6gjr
Aliases: CVE-2022-23504
Published: 2022-12-13T17:13:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

### Problem
Due to the lack of handling user-submitted [YAML placeholder expressions](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Configuration/Yaml/YamlApi.html#custom-placeholder-processing) in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messages of other website visitors.

A valid backend user account having administrator privileges is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

### References
* [TYPO3-CORE-SA-2022-016](https://typo3.org/security/advisory/typo3-core-sa-2022-016)
Froxlor vulnerable to Argument Injection
Advisory: GHSA-3v7m-2jrh-vc93
Aliases: CVE-2022-4864
Published: 2022-12-31T00:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1.
django-photologue vulnerable to Cross-site Scripting
Advisory: GHSA-287q-jfcp-9vhv
Aliases: CVE-2022-4526
Published: 2022-12-15T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file photologue/templates/photologue/photo_detail.html of the component Default Template Handler. The manipulation of the argument object.caption leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.16 is able to address this issue. The name of the patch is 960cb060ce5e2964e6d716ff787c72fc18a371e7. It is recommended to apply a patch to fix this issue. VDB-215906 is the identifier assigned to this vulnerability.
usememos/memos Improper Access Control vulnerability
Advisory: GHSA-mfmp-8mqg-q4wm
Aliases: CVE-2022-4803
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

usememos/memos 0.9.0 and prior is vulnerable to Improper Access Control.
Protobuf Java vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-4gg5-vx3j-xwc7
Aliases: CVE-2022-3510
Published: 2022-12-12T15:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
FeehiCMS Cross Site Scripting vulnerability
Advisory: GHSA-gqgq-784q-v9xp
Aliases: CVE-2022-40001
Published: 2022-12-15T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.
PrestaShop has potential Information exposure in the upload directory
Advisory: GHSA-9qgp-9wwc-v29r
Aliases: CVE-2022-46158
Published: 2022-12-08T16:11:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
Potential Information exposure in the upload directory.

### Patches
Patch in PrestaShop 1.7.8.8

### References
https://capec.mitre.org/data/definitions/87.html

Thanks to DZPATROL
tree-kit vulnerable to Prototype Pollution
Advisory: GHSA-mw4x-g2x8-qcvf
Aliases: CVE-2021-4278
Published: 2022-12-25T18:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability.
cycle-import-check vulnerable to Command Injection
Advisory: GHSA-995x-33wq-8gc9
Aliases: CVE-2022-24377
Published: 2022-12-14T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package cycle-import-check before version 1.3.2 is vulnerable to Command Injection via the `writeFileToTmpDirAndOpenIt` function due to improper user-input sanitization.
Passeo uses insecure random number generator
Advisory: GHSA-mhhf-vgwh-fw9h
Aliases: CVE-2022-23472
Published: 2022-12-06T21:13:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
Everyone below v1.0.5 is impacted by this flaw, of confidentiality being at risk due to the password(s) being easily able to be guessed with Passeo's use of the ``random`` library. It is recommended to change any passwords made with Passeo before v1.0.5 and upgrade to v1.0.5, and v1.0.5 patches this with the ``secrets`` library.

### Workarounds
No current workaround available than updating to v1.0.5.
FeehiCMS Cross Site Scripting vulnerability
Advisory: GHSA-8vjp-hfgh-68rj
Aliases: CVE-2022-40000
Published: 2022-12-15T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.
yikes-inc-easy-mailchimp-extender Cross-site Scripting vulnerability
Advisory: GHSA-837v-6vgx-jqcc
Aliases: CVE-2021-4244
Published: 2022-12-12T15:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability classified as problematic has been found in yikes-inc-easy-mailchimp-extender Plugin up to 6.8.5. This affects an unknown part of the file admin/partials/ajax/add_field_to_form.php. The manipulation of the argument field_name/merge_tag/field_type/list_id leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 6.8.6 can address this issue. The name of the patch is 3662c6593aa1bb4286781214891d26de2e947695. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215307.
Prototype Pollution in JSON5 via Parse Method
Advisory: GHSA-9c47-m6qq-7p4h
Aliases: CVE-2022-46175
Published: 2022-12-29T01:51:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H

The `parse` method of the JSON5 library before and including version `2.2.1` does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object.

This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations.

## Impact
This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.

## Mitigation
This vulnerability is patched in json5 v2.2.2 and later. A patch has also been backported for json5 v1 in versions v1.0.2 and later.

## Details
 
Suppose a developer wants to allow users and admins to perform some risky operation, but they want to restrict what non-admins can do. To accomplish this, they accept a JSON blob from the user, parse it using `JSON5.parse`, confirm that the provided data does not set some sensitive keys, and then performs the risky operation using the validated data:
 
```js
const JSON5 = require('json5');

const doSomethingDangerous = (props) => {
  if (props.isAdmin) {
    console.log('Doing dangerous thing as admin.');
  } else {
    console.log('Doing dangerous thing as user.');
  }
};

const secCheckKeysSet = (obj, searchKeys) => {
  let searchKeyFound = false;
  Object.keys(obj).forEach((key) => {
    if (searchKeys.indexOf(key) > -1) {
      searchKeyFound = true;
    }
  });
  return searchKeyFound;
};

const props = JSON5.parse('{"foo": "bar"}');
if (!secCheckKeysSet(props, ['isAdmin', 'isMod'])) {
  doSomethingDangerous(props); // "Doing dangerous thing as user."
} else {
  throw new Error('Forbidden...');
}
```
 
If the user attempts to set the `isAdmin` key, their request will be rejected:
 
```js
const props = JSON5.parse('{"foo": "bar", "isAdmin": true}');
if (!secCheckKeysSet(props, ['isAdmin', 'isMod'])) {
  doSomethingDangerous(props);
} else {
  throw new Error('Forbidden...'); // Error: Forbidden...
}
```
 
However, users can instead set the `__proto__` key to `{"isAdmin": true}`. `JSON5` will parse this key and will set the `isAdmin` key on the prototype of the returned object, allowing the user to bypass the security check and run their request as an admin:
 
```js
const props = JSON5.parse('{"foo": "bar", "__proto__": {"isAdmin": true}}');
if (!secCheckKeysSet(props, ['isAdmin', 'isMod'])) {
  doSomethingDangerous(props); // "Doing dangerous thing as admin."
} else {
  throw new Error('Forbidden...');
}
 ```
Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code
Advisory: GHSA-969w-q74q-9j8v
Published: 2022-12-08T16:00:29Z

Because of incorrect bounds on method `Secp256k1::preallocated_gen_new` it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator.

The method takes a place for storing the context as a mutable reference and returns context containing that reference. Because the code internally uses `unsafe` and the bounds were incorrect it was possible to create a context that outlived the passed reference (e.g. `'static`). Because the context can alternatively carry heap-allocated pointer freed on drop it was possible to "deallocate" a pointer that wasn't returned from appropriate allocator. The code decides whether to free the memory based on type parameter but because of missing bound it was possible to construct the context with invalid parameter.

You are unaffected if you either

* don't call `Secp256k1::preallocated_gen_new`
* manually checked that your usage of the method is sound
* upgraded to the patched version of `secp256k1` (recommended)

The patched version uses correct bounds which means it is API-breaking. This effectively means adopting the policy of Rust lang itself allowing API-breaking changes to fix soundness bugs. Note however that valid straigthforward usage of the code will continue to compile. Only unsound code or code that propagates the bound in custom generics will fail to compile. If the code is sound fixing the bounds should be sufficient to make the code compile.

See the [GitHub issue](https://github.com/rust-bitcoin/rust-secp256k1/issues/543) for example "exploit" code and further discussion.
Yii2 Gii Cross-site Scripting vulnerability
Advisory: GHSA-x87m-36g7-6mpw
Aliases: CVE-2022-34297
Published: 2022-12-10T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Some fields like Message Category (requires I18N enabled) in Model Generator, CRUD Generator or Form Generator, Author Name in Extension Generator, etc. are being cached without sanitisation of their contents when the Preview button is pressed. This leads to possibility of injecting malicious javascript in specified pages by placing it in said fields and caching it by pressing Preview button. On each consequent visit of specified pages malicious javascript will be loaded from server and executed in client's browser.
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
Advisory: GHSA-qwph-4952-7xr6
Aliases: CVE-2022-23540
Published: 2022-12-22T03:32:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

# Overview

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.

# Am I affected?
You will be affected if all the following are true in the `jwt.verify()` function:
- a token with no signature is received
- no algorithms are specified 
- a falsy (e.g. null, false, undefined) secret or key is passed 

# How do I fix it?
 
Update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. 

# Will the fix impact my users?

There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.