aswin1906/github-advisory-2022 huggingface dataset:
Yapscan's report receiver server vulnerable to path traversal and log injection
Advisory: GHSA-9h6h-9g78-86f7
Published: 2022-12-29T01:50:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

If you make use of the **report receiver server** (experimental), a client may be able to forge requests such that arbitrary files on the host can be overwritten (subject to permissions of the yapscan server), leading to loss of data. This is particularly problematic if you do not authenticate clients and/or run the server with elevated permissions.

### Patches

Vulnerable versions:

- v0.18.0
- v0.19.0 (unreleased)

This problem is patched in version v0.19.1

### Workarounds

Update to the newer version is highly encouraged!

Measures to reduce the risk of this include authenticating clients (see `--client-ca` flag) and containerization of the yapscan server.

### References

The tracking issue is #35. There you can find the commits, fixing the issue.
Widoco Path Traversal vulnerability
Advisory: GHSA-jj8r-jw42-mw4w
Aliases: CVE-2022-4772
Published: 2022-12-28T00:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function `unZipIt` of the file `src/main/java/widoco/WidocoUtils.java`. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
Apache Helix UI vulnerable to Open Redirect
Advisory: GHSA-mhxg-2xf7-4xwx
Aliases: CVE-2022-47500
Published: 2022-12-19T12:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to and including 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue.
libp2p DoS vulnerability from lack of resource management
Advisory: GHSA-f44q-634c-jvwv
Aliases: CVE-2022-23487
Published: 2022-12-07T23:23:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While a connection manager tasked with keeping the number of connections within manageable limits has been part of js-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource exhaustion attack.

### Patches (What to do as a js-libp2p consumer:)
Update your js-libp2p dependency to `v0.38.0` or greater.

### Workarounds
There are no workarounds, and so we recommend to upgrade your js-libp2p version.
Some range of attacks can be mitigated using OS tools (like manually blocking malicious peers using iptables or ufw ) or making use of a load balancer in front of libp2p nodes.
You can also use the [allow deny list in js-libp2p](https://docs.libp2p.io/concepts/security/dos-mitigation/#deny-specific-peers-or-create-an-allow-list-of-trusted-peers) to deny specific peers.

However these require direct action & responsibility on your part and are no substitutes for upgrading js-libp2p. Therefore, we highly recommend upgrading your js-libp2p version for the way it enables tighter scoped limits and provides visibility into and easier reasoning about js-libp2p resource utilization.

### References
* DoS Mitigation page for more information on how to incorporate mitigation strategies, monitor your application, and respond to attacks: https://docs.libp2p.io/reference/dos-mitigation/. 
* Documentation on how to configure limits to prevent excessive resource consumption: https://github.com/libp2p/js-libp2p/blob/master/doc/LIMITS.md
* Documentation on how to configure metrics: https://github.com/libp2p/js-libp2p/blob/master/doc/METRICS.md

Please see the related disclosure for go-libp2p: https://github.com/libp2p/go-libp2p/security/advisories/GHSA-j7qp-mfxf-8xjw and rust-libp2p: https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-jvgw-gccv-q5p8 

#### For more information

If you have any questions or comments about this advisory, please email us at [security@libp2p.io](mailto:security@libp2p.io).
Buildah (as part of Podman) vulnerable to Link Following
Advisory: GHSA-4crw-w8pw-2hmf
Aliases: CVE-2022-4122
Published: 2022-12-08T18:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.
gotify/server vulnerable to Cross-site Scripting in the application image file upload
Advisory: GHSA-xv6x-456v-24xh
Aliases: CVE-2022-46181
Published: 2022-12-30T00:58:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

### Impact

The XSS vulnerability allows authenticated users to upload .html files. With that, an attacker could execute client side scripts **if** another user opened a link, such as:

```
https://push.example.org/image/[alphanumeric string].html
```

An attacker could potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.

### Patches

The vulnerability has been fixed in version 2.2.2.

### Workarounds

You can block access to non image files via a reverse proxy in the `./image` directory.

### References

https://github.com/gotify/server/pull/534
https://github.com/gotify/server/pull/535

---

Thanks to rickshang (aka 无在无不在) for discovering and reporting this bug.
ff4j is vulnerable to Remote Code Execution (RCE)
Advisory: GHSA-65hj-9ppw-77xc
Aliases: CVE-2022-44262
Published: 2022-12-01T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE). This issue has been patched in version 1.9.
FeehiCMS Cross Site Scripting vulnerability
Advisory: GHSA-xv8h-43h9-v3jq
Aliases: CVE-2022-40373
Published: 2022-12-15T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack
Advisory: GHSA-7p7c-pvvx-2vx3
Published: 2022-12-05T22:03:46Z

Path resolution in `hyper-staticfile` didn't correctly validate Windows paths, meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.
camel-ldap component allows LDAP Injection when using the filter option
Advisory: GHSA-w66j-xc7r-m2jv
Aliases: CVE-2022-45046
Published: 2022-12-05T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The camel-ldap component allows LDAP Injection when using the filter option. Users are recommended to either move to the Camel-Spring-Ldap component (which is not affected) or upgrade to 3.14.6 or 3.18.4.
go-codec-dagpb vulnerable to panic when decoding invalid blocks
Advisory: GHSA-967g-cjx4-h7j6
Aliases: CVE-2022-2584
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

go-codec-dagpb is an implementation of the DAG-PB spec for Go. The dag-pb codec can panic when decoding invalid blocks. This issue has been patched in version 1.3.1.
hutool-json vulnerable to memory exhaustion
Advisory: GHSA-fxrc-hg6j-6v3x
Aliases: CVE-2022-45689
Published: 2022-12-13T15:30:26Z

hutool-json v5.8.10 was discovered to contain an out of memory error. This issue is similar to CVE-2022-45690.
usememos/memos Improper Access Control vulnerability
Advisory: GHSA-qr52-59r6-49f4
Aliases: CVE-2022-4684
Published: 2022-12-23T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
shiyanhui/dht vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-p6fg-723f-hgpw
Aliases: CVE-2020-36562
Published: 2022-12-28T03:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.
FeehiCMS Cross Site Scripting vulnerability
Advisory: GHSA-m54v-gv8p-9pqp
Aliases: CVE-2021-36572
Published: 2022-12-15T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.
Json2html vulnerable to cross-site scripting
Advisory: GHSA-79mp-cxp4-9p6r
Aliases: CVE-2018-25053
Published: 2022-12-28T12:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Json2html is a client side javascript HTML templating library with wrappers for both jQuery and Node.js. A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.2.0 can address this issue. The name of the patch is 2d3d24d971b19a8ed1fb823596300b9835d55801. The associated identifier of this vulnerability is VDB-216959.
jsonwebtoken unrestricted key type could lead to legacy keys usage 
Advisory: GHSA-8cf7-32gw-wr33
Aliases: CVE-2022-23539
Published: 2022-12-22T03:32:22Z

# Overview

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. 

# Am I affected?

You are affected if you are using an algorithm and a key type other than the combinations mentioned below

| Key type |  algorithm                                    |
|----------|------------------------------------------|
| ec           | ES256, ES384, ES512                      |
| rsa          | RS256, RS384, RS512, PS256, PS384, PS512 |
| rsa-pss  | PS256, PS384, PS512                      |

And for Elliptic Curve algorithms:

| `alg` | Curve      |
|-------|------------|
| ES256 | prime256v1 |
| ES384 | secp384r1  |
| ES512 | secp521r1  |

# How do I fix it?

Update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, If you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and/or `verify()` functions.

# Will the fix impact my users?

There will be no impact, if you update to version 9.0.0 and you already use a valid secure combination of key type and algorithm. Otherwise,  use the  `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and `verify()` functions to continue usage of invalid key type/algorithm combination in 9.0.0 for legacy compatibility.
usememos/memos Authorization Bypass Through User-Controlled Key vulnerability
Advisory: GHSA-68gw-r2x5-7r5r
Aliases: CVE-2022-4686
Published: 2022-12-23T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
usememos/memos vulnerable to stored Cross-site Scripting
Advisory: GHSA-pwhr-p68w-296x
Aliases: CVE-2022-4840
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos 0.9.0 and prior.
Snipe-IT allows attackers to check whether a user account exists
Advisory: GHSA-qqv9-gqh5-7h99
Aliases: CVE-2022-44381
Published: 2022-12-25T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
Apache Commons Net vulnerable to information leakage via malicious server
Advisory: GHSA-cgp8-4m63-fhh5
Aliases: CVE-2021-37533
Published: 2022-12-03T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client.
The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711.
FeehiCMS Unrestricted Upload vulnerability
Advisory: GHSA-67mh-hw8v-x8v9
Aliases: CVE-2021-36573
Published: 2022-12-15T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.
hyper-staticfile's location header incorporates user input, allowing open redirect
Advisory: GHSA-5wvv-q5fv-2388
Published: 2022-12-30T16:57:28Z

When `hyper-staticfile` performs a redirect for a directory request (e.g. a request for `/dir` that redirects to `/dir/`), the `Location` header value was derived from user input (the request path), simply appending a slash. The intent was to perform an origin-relative redirect, but specific inputs allowed performing a scheme-relative redirect instead.

An attacker could craft a special URL that would appear to be for the correct domain, but immediately redirects to a malicious domain. Such a URL can benefit phishing attacks, for example an innocent looking link in an email.
Authentication Bypass for passport-wsfed-saml2
Advisory: GHSA-ppjq-qxhx-m25f
Aliases: CVE-2022-23505
Published: 2022-12-13T17:16:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

# Overview
A remote attacker can bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed WSFed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.

# Am I affected?
You are affected if you are using WSFed protocol with the passport-wsfed-saml2 library versions < 4.6.3. 
SAML2 protocol is not affected. 

# How do I fix it?
Upgrade the library to version 4.6.3.

# Will the fix impact my users?
No, the fix will not impact your users.
Apache CXF Server-Side Request Forgery vulnerability
Advisory: GHSA-x3x3-qwjq-8gj4
Aliases: CVE-2022-46364
Published: 2022-12-13T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.
Cross-site Scripting in Jenkins Spring Config Plugin
Advisory: GHSA-3rrx-364r-6wf6
Aliases: CVE-2022-46687
Published: 2022-12-12T09:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change build display names. Spring Config Plugin 2.0.1 escapes build display names shown on the Spring Config view.
linux-loader reading beyond EOF could lead to infinite loop
Advisory: GHSA-52h2-m2cf-9jh6
Aliases: CVE-2022-23523
Published: 2022-12-12T22:35:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

### Impact
The linux-loader crate used the offsets and sizes provided in the ELF headers to determine the offsets to read from. If those offsets pointed beyond the end of the file this could lead to an infinite loop. Virtual Machine Monitors using the `linux-loader` crate could enter an infinite loop if the ELF header of the kernel they are loading was modified in a malicious manner.

### Patches
The issue has been addressed in 0.8.1

### Workarounds
The issue can be mitigated by ensuring that only trusted kernel images are loaded or by verifying that the headers to not point beyond the end of the file.

### References

See: https://github.com/rust-vmm/linux-loader/pull/125
Inefficient Regular Expression Complexity in Loofah
Advisory: GHSA-486f-hjj9-9vhh
Aliases: CVE-2022-23514
Published: 2022-12-13T17:36:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

Loofah `< 2.19.1` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.


## Mitigation

Upgrade to Loofah `>= 2.19.1`.


## Severity

The Loofah maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)](https://cwe.mitre.org/data/definitions/1333.html)
- https://hackerone.com/reports/1684163


## Credit

This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).
TYPO3-EXT-SA-2022-018: Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)
Advisory: GHSA-7gpw-frph-fwrg
Aliases: CVE-2022-47407
Published: 2022-12-14T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
usememos/memos Improper Privilege Management vulnerability
Advisory: GHSA-r3p3-5f35-h6mf
Aliases: CVE-2022-4808
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol
Advisory: GHSA-9p95-fxvg-qgq2
Aliases: CVE-2022-25912
Published: 2022-12-06T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the `ext` transport protocol, which makes it exploitable via `clone()` method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306).
AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field
Advisory: GHSA-6jvc-q2x7-pchv
Aliases: CVE-2022-2582
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it.
Tendermint light client verification not taking into account chain ID
Advisory: GHSA-xqqc-c5gw-c5r5
Aliases: CVE-2022-23507
Published: 2022-12-14T21:35:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

### Impact

Anyone using the `tendermint-light-client` and related packages to perform light client verification (e.g. IBC-rs, Hermes).

At present, the light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client.

The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks.

### Patches

Users of the light client-related crates can currently upgrade to `v0.28.0`.

### Workarounds

None

### References

- [Light Client specification](https://github.com/tendermint/tendermint/tree/main/spec/light-client)
usememos/memos may leak user information to an authenticated user
Advisory: GHSA-j593-h5v3-45x6
Aliases: CVE-2022-4734
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

usememos/memos 0.9.0 and prior has endpoint that leaks user information like names, email, role, and OpenID to an authenticated user. A patch is available at commit 05b41804e33a34102f1f75bb2d69195dda6a1210 on the `main` branch.
XBlock vulnerable to Cross-Site Scripting (XSS) 
Advisory: GHSA-qv6c-367r-3w6q
Aliases: CVE-2022-46147
Published: 2022-12-02T22:26:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

### Impact
XSS Vulnerability in multiple XBlock Fields.  Any platform that has deployed the XBlock will be impacted.

### Patches
https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492

The fix is compatible with all Open edX releases newer than Lilac.

### Workarounds
None.

### References
https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864
Path Traversal In MeterSpere leads to upload file to any path
Advisory: GHSA-9p62-x3c5-hr5p
Aliases: CVE-2022-46178
Published: 2022-12-30T18:03:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

### Summary

MeterSphere allow users to upload file, but not check the file name, may lead to upload file to any path if the file name in upload request is falsified.

### Details

Metersphere's [`FileUtils.java`](https://github.com/metersphere/metersphere/blob/v2.5.0/framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/FileUtils.java#L57) didn't check the filePath.

```java
    public static void createFile(String filePath, byte[] fileBytes) {
        File file = new File(filePath);
        if (file.exists()) {
            file.delete();
        }
        try {
            File dir = file.getParentFile();
            if (!dir.exists()) {
                dir.mkdirs();
            }
            file.createNewFile();
        } catch (Exception e) {
            LogUtil.error(e);
        }

        try (InputStream in = new ByteArrayInputStream(fileBytes); OutputStream out = new FileOutputStream(file)) {
            final int MAX = 4096;
            byte[] buf = new byte[MAX];
            for (int bytesRead = in.read(buf, 0, MAX); bytesRead != -1; bytesRead = in.read(buf, 0, MAX)) {
                out.write(buf, 0, bytesRead);
            }
        } catch (IOException e) {
            LogUtil.error(e);
            MSException.throwException(Translator.get("upload_fail"));
        }
    }
```

### Patches

The vulnerability has been fixed in [v2.5.1](https://github.com/metersphere/metersphere/releases/tag/v2.5.1).

https://github.com/metersphere/metersphere/commit/3a890eeeb8a6b0887927c876a73bdb3a99a82138 : add validation for file name.

### Workarounds

It is recommended to upgrade the version to [v2.5.1](https://github.com/metersphere/metersphere/releases/tag/v2.5.1).

### For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/metersphere/metersphere/issues).
usememos/memos Improper Authorization vulnerability
Advisory: GHSA-hc5q-26h8-r9wf
Aliases: CVE-2022-4811
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

In usememos/memos 0.9.0 and prior, an unauthorized user can access any private memo by URL hacking a memo on the editing screen.
express-param vulnerable to Improper Handling of Extra Parameters
Advisory: GHSA-fr54-72wr-cqvq
Aliases: CVE-2017-20160
Published: 2022-12-31T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file `lib/fetchParams.js`. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0 can address this issue. The name of the patch is db94f7391ad0a16dcfcba8b9be1af385b25c42db. It is recommended to upgrade the affected component. The identifier VDB-217149 was assigned to this vulnerability.
Apache ShardingSphere-Proxy Incomplete Cleanup vulnerability
Advisory: GHSA-wmxm-6wxc-3xqf
Aliases: CVE-2022-45347
Published: 2022-12-22T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication failed, which allowed an attacker to execute normal commands by constructing a special MySQL client. This vulnerability has been fixed in Apache ShardingSphere 5.3.0.
Protobuf Java vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-g5ww-5jh7-63cx
Aliases: CVE-2022-3509
Published: 2022-12-12T15:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Akeneo PIM Community Edition vulnerable to remote php code execution
Advisory: GHSA-w9wc-4xcq-8gr6
Aliases: CVE-2022-46157
Published: 2022-12-09T20:08:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticated users to execute arbitrary PHP code on the server by uploading a crafted image.


### Patches

Akeneo PIM Community Edition after the versions aforementioned provides patched Apache HTTP server configuration file, for docker setup and in documentation sample, to fix this vulnerability.  
Community Edition users must change their Apache HTTP server configuration accordingly to be protected.
The patch for Cloud Based Akeneo PIM Services customers has been applied since 30th October 2022. 

### Workarounds

Replace any reference to `<FilesMatch \.php$>` in your apache httpd configurations with: `<Location "/index.php">`, as shown in https://github.com/akeneo/pim-community-dev/blob/b4d79bb073c8b68ea26ab227c97cc78d86c4cba1/docker/httpd.conf#L39.

<!--
### References
_Are there any links users can visit to find out more?_


### For more information
 If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
-->
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
Advisory: GHSA-vh43-cc6x-prpr
Aliases: CVE-2022-4848
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos 0.9.0 and prior.
docconv vulnerable to Memory Allocation with Excessive Size Value
Advisory: GHSA-qvx2-59g8-8hph
Aliases: CVE-2022-4741
Published: 2022-12-25T21:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function `ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText`. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 can address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.
iText RUPS XML External Entity vulnerability
Advisory: GHSA-j69f-fgh5-f7mc
Aliases: CVE-2017-20151
Published: 2022-12-30T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability classified as problematic was found in iText RUPS. This vulnerability affects unknown code of the file `src/main/java/com/itextpdf/rups/model/XfaFile.java`. The manipulation leads to xml external entity reference. The name of the patch is ac5590925874ef810018a6b60fec216eee54fb32. It is recommended to apply a patch to fix this issue. VDB-217054 is the identifier assigned to this vulnerability.
flat vulnerable to Prototype Pollution
Advisory: GHSA-2j2x-2gpw-g8fm
Aliases: CVE-2020-36632
Published: 2022-12-25T21:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

flat helps flatten/unflatten nested Javascript objects. A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 can address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability.
Microweber vulnerable to Reflected Cross-site Scripting
Advisory: GHSA-3mmh-vq9w-4c3g
Aliases: CVE-2022-4617
Published: 2022-12-21T03:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Microweber versions 1.3.1 and prior are vulnerable to Reflected Cross-site Scripting (XSS). A patch is available on the 1.4, dev, and laravel-sail branches.
Duplicate advisory: @claviska/jquery-minicolors vulnerable to Cross-site Scripting
Advisory: GHSA-vc9x-gmmr-p7jj
Aliases: CVE-2021-4243
Published: 2022-12-12T15:30:31Z
Withdrawn: 2023-02-22T00:11:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

## Duplicate advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-crh5-vv2v-c82q](https://github.com/advisories/GHSA-crh5-vv2v-c82q). This link is maintained to preserve external references.

## Original Description
A vulnerability was found in claviska jquery-minicolors up to 2.3.5. It has been rated as problematic. Affected by this issue is some unknown functionality of the file jquery.minicolors.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.3.6 is able to address this issue. The name of the patch is ef134824a7f4110ada53ea6c173111a4fa2f48f3. It is recommended to upgrade the affected component. VDB-215306 is the identifier assigned to this vulnerability.
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Advisory: GHSA-rrfc-7g8p-99q8
Aliases: CVE-2022-23520
Published: 2022-12-13T17:51:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

## Summary

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209.

- Versions affected: ALL
- Not affected: NONE
- Fixed versions: 1.4.4


## Impact

A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements.

Code is only impacted if allowed tags are being overridden using either of the following two mechanisms:

1. Using the Rails configuration `config.action_view.sanitized_allow_tags=`:

  ```ruby
  # In config/application.rb
  config.action_view.sanitized_allowed_tags = ["select", "style"]
  ```

  (see https://guides.rubyonrails.org/configuring.html#configuring-action-view)

2. Using the class method `Rails::Html::SafeListSanitizer.allowed_tags=`:

  ```ruby
  # class-level option
  Rails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]
  ```

All users overriding the allowed tags by either of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.

NOTE: Code is _not_ impacted if allowed tags are overridden using either of the following mechanisms:

- the `:tags` option to the Action View helper method `sanitize`.
- the `:tags` option to the instance method `SafeListSanitizer#sanitize`.


## Workarounds

Remove either "select" or "style" from the overridden allowed tags.


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32209
- https://hackerone.com/reports/1654310


## Credit

This vulnerability was responsibly reported by Dominic Breuker.
Prometheus vulnerable to basic authentication bypass
Advisory: GHSA-4v48-4q5m-8vx4
Published: 2022-12-05T22:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact

Prometheus can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.

Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.

However, a flaw in the way this mechanism was implemented in the [exporter toolkit](https://github.com/prometheus/exporter-toolkit) makes it possible with people who know the hashed password to authenticate against Prometheus.

A request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.

### Patches

Prometheus 2.37.4 ([LTS](https://prometheus.io/docs/introduction/release-cycle/)) and 2.40.4 have been released to address this issue.

### Workarounds

There is no workaround but attacker must have access to the hashed password, stored in disk, to bypass the authentication.
DSInternals Credential Roaming Elevation of Privilege Vulnerability
Advisory: GHSA-vx2x-9cff-fhjw
Published: 2022-12-06T21:13:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

### Impact

A vulnerability exists in the `DSInternals.Common.Data.RoamedCredential.Save()` method, which incorrectly parses the `msPKIAccountCredentials` LDAP attribute values. As a consequence, a malicious actor would be able to modify the file system of the computer where an application using this function is executed with administrative privileges.

A [similar security issue](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30170) used to be present in the Windows operating system, as DSInternals re-implements the Credential Roaming feature of Windows.

### Exploitability

The vulnerability can be exploited under the following circumstances:
- An attacker is able to modify the `msPKIAccountCredentials` attribute of a user account in Active Directory. This attribute is used by the Credential Roaming feature of Windows and each AD user can modify their own roamed credentials. AND
- A 3rd party application uses the `DSInternals.Common` library to export roamed credentials from Active Directory to a file system. AND
- The application has administrative privileges on the local system.

The probability of any 3rd-party product using the `DSInternals.Common` library being affected by this vulnerability is extremely low.

### Patches

The issue had been fixed in DSInternals 4.8.

### References

https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming
easywebpack-cli Path Traversal vulnerability
Advisory: GHSA-252h-2cmq-pmr6
Aliases: CVE-2020-24855
Published: 2022-12-15T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request.
usememos/memos Improper Authorization vulnerability
Advisory: GHSA-qcf5-m2c6-89f2
Aliases: CVE-2022-4798
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

usememos/memos 0.9.0 and prior is vulnerable to Improper Authorization.
kyverno verifyImages rule bypass possible with malicious proxy/registry
Advisory: GHSA-m3cq-xcx9-3gvm
Aliases: CVE-2022-47633
Published: 2022-12-21T17:24:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

Users of Kyverno on versions 1.8.3 or 1.8.4 who use `verifyImages` rules to verify container image signatures, and do not prevent use of unknown registries.

### Patches

This issue has been fixed in version [1.8.5](https://github.com/kyverno/kyverno/releases/tag/v1.8.5)

### Workarounds

Configure a Kyverno policy to restrict registries to a set of secure trusted image registries ([sample](https://kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_registries/)).

### References
Inefficient Regular Expression Complexity in rails-html-sanitizer
Advisory: GHSA-5x79-w82f-gw8w
Aliases: CVE-2022-23517
Published: 2022-12-13T17:43:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

Certain configurations of rails-html-sanitizer `< 1.4.4` use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption.


## Mitigation

Upgrade to rails-html-sanitizer `>= 1.4.4`.


## Severity

The maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-1333: Inefficient Regular Expression Complexity (4.9)](https://cwe.mitre.org/data/definitions/1333.html)
- https://hackerone.com/reports/1684163


## Credit

This vulnerability was responsibly reported by @ooooooo-q (https://github.com/ooooooo-q).
abacus-ext-cmdline vulnerable to Command Injection
Advisory: GHSA-m5v8-wpw4-rj3x
Aliases: CVE-2022-24431
Published: 2022-12-21T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
golang-nanoauth authentication bypass vulnerability
Advisory: GHSA-hrm3-3xm6-x33h
Aliases: CVE-2020-36569
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
usememos/memos vulnerable to account takeover due to improper access control
Advisory: GHSA-w57v-6xp4-rm2v
Aliases: CVE-2022-4689
Published: 2022-12-23T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Versions prior to 0.9.0 improperly maintain access control allowing an attacker to take over an account by changing header values in the HTTP request.
py7zr directory traversal vulnerability
Advisory: GHSA-m8xw-9x5x-6vh3
Aliases: CVE-2022-44900
Published: 2022-12-06T21:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
keynote Cross-site Scripting vulnerability
Advisory: GHSA-399p-vq28-5hg8
Aliases: CVE-2017-20159
Published: 2022-12-31T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in rf Keynote up to 0.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/keynote/rumble.rb. The manipulation of the argument value leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.0.0 can address this issue. The name of the patch is 05be4356b0a6ca7de48da926a9b997beb5ffeb4a. It is recommended to upgrade the affected component. VDB-217142 is the identifier assigned to this vulnerability.
pgadmin4 vulnerable to Code Injection
Advisory: GHSA-3v6v-2x6p-32mc
Aliases: CVE-2022-4223
Published: 2022-12-13T18:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.
Roots Soil plugin vulnerable to Cross-site Scripting
Advisory: GHSA-jw6x-4h8h-569x
Aliases: CVE-2022-4524
Published: 2022-12-15T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability, which was classified as problematic, was found in Roots soil Plugin up to 4.1.0. Affected is the function language_attributes of the file src/Modules/CleanUpModule.php. The manipulation of the argument language leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.1.1 is able to address this issue. The name of the patch is 0c9151e00ab047da253e5cdbfccb204dd423269d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215904.
AAD Pod Identity obtaining token with backslash
Advisory: GHSA-p82q-rxpm-hjpc
Aliases: CVE-2022-23551
Published: 2022-12-21T18:48:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L

### Impact
_What kind of vulnerability is it? Who is impacted?_
The [NMI](https://azure.github.io/aad-pod-identity/docs/concepts/nmi/) component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token request made with backslash in the request (example: `/metadata/identity\oauth2\token/`) would bypass the NMI validation and be sent to [IMDS](https://learn.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=windows) allowing a pod in the cluster to access identities that it shouldn't have access to.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
- We analyzed this bug and determined that we needed to fix it. This fix has been included in AAD Pod Identity release [v1.8.13](https://github.com/Azure/aad-pod-identity/releases/tag/v1.8.13)
- If using the [AKS pod-managed identities add-on](https://learn.microsoft.com/en-us/azure/aks/use-azure-ad-pod-identity), no action is required. The clusters should now be running the `v1.8.13` release.

### For more information

If you have any questions or comments about this advisory:

Open an issue in [Azure/aad-pod-identity](https://github.com/Azure/aad-pod-identity)
Terms and Conditions Module vulnerable to Open Redirect
Advisory: GHSA-6rmf-cv6p-4h27
Aliases: CVE-2022-4589
Published: 2022-12-17T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.10 and classified as problematic. Affected by this vulnerability is the function returnTo of the file termsandconditions/views.py. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version 2.0.11 can address this issue. The name of the patch is 03396a1c2e0af95e12a45c5faef7e47a4b513e1a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216175.
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login
Advisory: GHSA-jfp7-79g7-89rf
Aliases: CVE-2022-23501
Published: 2022-12-13T17:04:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

### Problem
Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker might use this ambiguity in usernames to get access to a different account - however, credentials must be known to the adversary.

### Solution
Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

### References
* [TYPO3-CORE-SA-2022-013](https://typo3.org/security/advisory/typo3-core-sa-2022-013)
revel is vulnerable to resource exhaustion
Advisory: GHSA-hggr-p7v6-73p5
Aliases: CVE-2020-36568
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.
usememos/memos Incorrect Use of Privileged APIs vulnerability
Advisory: GHSA-mq5q-gpgv-pwxw
Aliases: CVE-2022-4805
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In usememos/memos 0.9.0 and prior, a user can archive any private memos, delete any shortcut, and edit any shortcut from other users via API.
ghinstallation returns app JWT in error responses
Advisory: GHSA-h4q8-96p6-jcgr
Aliases: CVE-2022-39304
Published: 2022-12-19T22:48:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L

### Impact

In ghinstallation v1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging.

https://github.com/bradleyfalzon/ghinstallation/blob/24e56b3fb7669f209134a01eff731d7e2ef72a5c/transport.go#L172-L174

The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum).

### Patches

- This has already been patched in d24f14f8be70d94129d76026e8b0f4f9170c8c3e, and is available in releases >= v2.0.0.

### References
_Are there any links users can visit to find out more?_

- See https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#authenticating-as-an-installation for the App installation flow.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [ghinstallation](https://github.com/bradleyfalzon/ghinstallation)
Creator Verification Error when Bubblegum Activate
Advisory: GHSA-8r76-fr72-j32w
Published: 2022-12-12T22:02:42Z

This was an error found by @metamania01 of the Audit Company Solshield.

It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with verified creators.

The issue is now patched.
For more info see.
https://twitter.com/thehasheddude/status/1601642138143375360