aswin1906/github-advisory-2022 huggingface dataset:
SEOmatic for CraftCMS allows Server-Side Template Injection
Advisory: GHSA-23q7-59jj-2pj4
Aliases: CVE-2020-12790
Published: 2022-05-24T17:17:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.
Cross-site Scripting in Jenkins Build Failure Analyzer plugin
Advisory: GHSA-7w89-qqxx-c62r
Aliases: CVE-2016-4988
Published: 2022-05-13T01:30:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
Symfony CSRF Token Fixation
Advisory: GHSA-g4g7-q726-v5hg
Aliases: CVE-2018-11406
Published: 2022-05-14T01:14:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
Stored XSS vulnerability in Jenkins Cadence vManager Plugin
Advisory: GHSA-v46q-xjp5-7p6r
Aliases: CVE-2020-2243
Published: 2022-05-24T17:27:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

Cadence vManager Plugin 3.0.5 removes affected tooltips.
Apache Geode information disclosure vulnerability
Advisory: GHSA-2gw6-73wc-x88f
Aliases: CVE-2017-5649
Published: 2022-05-17T02:50:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.
Improper Neutralization of Special Elements used in an OS Command in Blamer
Advisory: GHSA-8cxp-cjm8-fj36
Aliases: CVE-2019-10807
Published: 2022-05-24T17:10:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer.
Moodle Reveals Student Information Meant To Be Anonymous
Advisory: GHSA-2fmv-j5xj-4fmq
Aliases: CVE-2014-0215
Published: 2022-05-13T01:12:51Z

The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source.
ChakraCore RCE Vulnerability
Advisory: GHSA-wc67-4cg3-35wf
Aliases: CVE-2018-0946
Published: 2022-05-13T01:18:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0945, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.
WSO2 API Manager vulnerable to SSRF
Advisory: GHSA-jfgp-q2hg-w285
Aliases: CVE-2020-13226
Published: 2022-05-24T17:18:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.
Injection in Jenkins
Advisory: GHSA-7592-93rm-6gpx
Aliases: CVE-2018-1000193
Published: 2022-05-13T01:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that allows users to sign up using user names containing control characters that can then appear to have the same name as other users, and cannot be deleted via the UI.
Improper privilege management in pyftpdlib
Advisory: GHSA-8xgx-75qw-6268
Aliases: CVE-2007-6741
Published: 2022-05-01T18:45:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

The ftp_PORT function in FTPServer.py in pyftpdlib before 0.2.0 does not prevent TCP connections to privileged ports if the destination IP address matches the source IP address of the connection from the FTP client, which might allow remote authenticated users to conduct FTP bounce attacks via crafted FTP data, as demonstrated by an FTP bounce attack against a NAT server, a related issue to CVE-1999-0017.
Nimbus JOSE+JWT vulnerable to padding oracle attack
Advisory: GHSA-jfmq-4g4m-99rh
Aliases: CVE-2017-12973
Published: 2022-05-13T01:42:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.
Seg fault in `ndarray_tensor_bridge` due to zero and large inputs
Advisory: GHSA-jq6x-99hj-q636
Aliases: CVE-2022-41884
Published: 2022-11-21T20:39:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. E.g. the following raises an error:
```python
np.ones((0, 2**31, 2**31))
```
An example of a proof of concept:
```python
import numpy as np
import tensorflow as tf

input_val = tf.constant([1])
shape_val = np.array([i for i in range(21)])

tf.broadcast_to(input=input_val,shape=shape_val)
```
The return value of `PyArray_SimpleNewFromData`, which returns null on such shapes, is not checked.

### Patches
We have patched the issue in GitHub commit [2b56169c16e375c521a3bc8ea658811cc0793784](https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Pattarakrit Rattanukul.
Concrete CMS vulnerable to Reflected Cross-site Scripting via image manipulation library
Advisory: GHSA-jfmc-3975-fv5f
Aliases: CVE-2022-43694
Published: 2022-11-15T12:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized output.
Cross-site Scripting in Backdrop CMS
Advisory: GHSA-g9cp-9fw3-56cf
Aliases: CVE-2022-42097
Published: 2022-11-22T15:30:26Z

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.'s
XSS via uploaded gpx file
Advisory: GHSA-vv3r-fxqp-vr3f
Aliases: CVE-2022-38147
Published: 2022-11-21T23:58:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitimate user to view the file in a browser with support for GPX files. GPX is an XML-based format used to store GPS data.

By default, Silverstripe CMS will no longer allow GPX files to be uploaded to the assets area.
Apache Archiva subject to arbitrary directory deletion by users.
Advisory: GHSA-xgq8-jq9w-77r5
Aliases: CVE-2022-40309
Published: 2022-11-15T19:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories. Users with write permissions to a repository can delete arbitrary directories.
Denial of service in Mattermost
Advisory: GHSA-5jph-wrq7-v9hf
Aliases: CVE-2022-4044
Published: 2022-11-23T06:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.
deep-parse-json vulnerable to Prototype Pollution
Advisory: GHSA-ff9j-pwxg-q5p2
Aliases: CVE-2022-42743
Published: 2022-11-04T12:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the `__proto__` property to be edited.
Tensorflow vulnerable to Out-of-Bounds Read
Advisory: GHSA-8w5g-3wcv-9g2j
Aliases: CVE-2022-41880
Published: 2022-11-22T00:10:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

### Impact
When the [`BaseCandidateSamplerOp`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/candidate_sampler_ops.cc) function  receives a value in `true_classes` larger than `range_max`, a heap oob vuln occurs.
```python
tf.raw_ops.ThreadUnsafeUnigramCandidateSampler(
    true_classes=[[0x100000,1]],
    num_true = 2,
    num_sampled = 2,
    unique = False,
    range_max = 2,
    seed = 2,
    seed2 = 2)
```

### Patches
We have patched the issue in GitHub commit [b389f5c944cadfdfe599b3f1e4026e036f30d2d4](https://github.com/tensorflow/tensorflow/commit/b389f5c944cadfdfe599b3f1e4026e036f30d2d4).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
FPE in `tf.image.generate_bounding_box_proposals`
Advisory: GHSA-6x99-gv2v-q76v
Aliases: CVE-2022-41888
Published: 2022-11-21T20:41:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
When running on GPU, [`tf.image.generate_bounding_box_proposals`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc) receives a `scores` input that must be of rank 4 but is not checked.
```python
import tensorflow as tf

a = tf.constant(value=[[1.0, 1.0], [1.0, 1.0], [1.0, 1.0], [1.0, 1.0]])
b = tf.constant(value=[1])

tf.image.generate_bounding_box_proposals(scores=a,bbox_deltas=a,image_info=a,anchors=a,pre_nms_topn=b)
```

### Patches
We have patched the issue in GitHub commit [cf35502463a88ca7185a99daa7031df60b3c1c98](https://github.com/tensorflow/tensorflow/commit/cf35502463a88ca7185a99daa7031df60b3c1c98).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Pattarakrit Rattankul.
Stored XSS using HTMLEditor
Advisory: GHSA-wc6r-4ggc-79w5
Aliases: CVE-2022-37429
Published: 2022-11-21T23:59:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A malicious content author could add a JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.

An attacker must have access to the CMS to exploit this issue.
Cross-site Scripting in Backdrop CMS
Advisory: GHSA-g8jw-8vpv-pv5q
Aliases: CVE-2022-42096
Published: 2022-11-21T21:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content. The account must have admin privileges.
HTTP response splitting in CGI
Advisory: GHSA-vc47-6rqg-c7f5
Aliases: CVE-2021-33621
Published: 2022-11-19T00:30:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ruby gem cgi.rb prior to versions 0.3.5, 0.2.2 and 0.1.0.2 allow HTTP header injection. If a CGI application using the CGI library inserts untrusted input into the HTTP response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients. This issue has been patched in versions 0.3.5, 0.2.2 and 0.1.0.2.
Unsafe deserialization in Apache MINA SSHD
Advisory: GHSA-fhw8-8j55-vwgq
Aliases: CVE-2022-45047
Published: 2022-11-16T12:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server.

Until version 2.1.0, the code affected by this vulnerability appeared in `org.apache.sshd:sshd-core`. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package `org.apache.sshd:sshd-common`, which did not exist until version 2.1.0.
XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)
Advisory: GHSA-83w4-x5w9-hf4h
Aliases: CVE-2022-43183
Published: 2022-11-17T21:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.
Missing Authorization in Jenkins XP-Dev Plugin
Advisory: GHSA-x9wp-gfrr-p5rp
Aliases: CVE-2022-45389
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-specified repository.
Missing Authorization to enable or disable users in org.xwiki.platform:xwiki-platform-user-profile-ui
Advisory: GHSA-p5v9-g8w8-5q4v
Aliases: CVE-2022-41930
Published: 2022-11-21T22:35:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user to re-enable themselves, or to an attacker to disable any user of the wiki. 

### Patches

The problem has been patched in XWiki 13.10.7, 14.5RC1 and 14.4.2. 

### Workarounds

The problem can be patched immediately by editing the page `XWiki.XWikiUserProfileSheet` in the wiki and by performing the changes contained in https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa.

### References

  * https://github.com/xwiki/xwiki-platform/commit/5be1cc0adf917bf10899c47723fa451e950271fa
  * https://jira.xwiki.org/browse/XWIKI-19792

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Account Takeover Through Password Reset Poisoning
Advisory: GHSA-rp7f-fhm8-9hpf
Aliases: CVE-2022-33012
Published: 2022-11-22T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Microweber 1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.
Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords
Advisory: GHSA-wcjj-qm5v-j4pc
Aliases: CVE-2022-45384
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
OS Command Injection in Apache Airflow
Advisory: GHSA-rmf2-pwfq-h75j
Aliases: CVE-2022-40189
Published: 2022-11-22T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Pig Provider is installed (Pig Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pig Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
Cross-Site Request Forgery in Jenkins Cluster Statistics Plugin
Advisory: GHSA-24hp-84jp-8wgm
Aliases: CVE-2022-45398
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.
Arches vulnerable to execution of arbitrary SQL
Advisory: GHSA-gmpq-xrxj-xh8m
Aliases: CVE-2022-41892
Published: 2022-11-11T00:05:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

### Impact
With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database.  
Anyone running the impacted versions (<=6.1.1, 6.2.0, >=7.0.0, <=7.1.1) should upgrade as soon as possible.

### Patches
The problem has been patched in the following versions: [6.1.2](https://pypi.org/project/arches/6.1.2/), [6.2.1](https://pypi.org/project/arches/6.2.1/), and [7.2.0](https://pypi.org/project/arches/7.2.0/)
Users are strongly urged to upgrade to the most recent relevant patch.

### Workarounds
There are no workarounds.

### General References 
https://www.w3schools.com/sql/sql_injection.asp
https://en.wikipedia.org/wiki/SQL_injection

### For more information
Post any questions to the [Arches project forum](https://community.archesproject.org/).
Concrete CMS vulnerable to Improper Authentication
Advisory: GHSA-q56r-mw39-944g
Aliases: CVE-2022-43690
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server
Advisory: GHSA-p88w-fhxw-xvcc
Aliases: CVE-2022-41936
Published: 2022-11-21T23:25:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are exposed though the `modifications` rest endpoint (e.g., comments, page names...). 

### Patches
Users should upgrade to XWiki 14.6+, 14.4.3+,  or13.10.8+. Older versions have not been patched.

### Workarounds
No known workaround.

### References

- Patch: https://github.com/xwiki/xwiki-platform/commit/38dc1aa1a4435f24d58f5b8e4566cbcb0971f8ff
- Jira issue: https://jira.xwiki.org/browse/XWIKI-19997

### For more information
If you have any questions or comments about this advisory:

- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
- Email us at [Security Mailing List](mailto:security@xwiki.org)
TemporaryFolder on unix-like systems does not limit access to created files
Advisory: GHSA-562r-vg33-8x8h
Aliases: CVE-2022-41946
Published: 2022-11-23T22:17:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

**Vulnerability**

`PreparedStatement.setText(int, InputStream)`
and

`PreparedStatemet.setBytea(int, InputStream)`

will create a temporary file if the InputStream is larger than 51k

 
Example of vulnerable code:

```java
String s = "some very large string greater than 51200 bytes";

PreparedStatement.setInputStream(1, new ByteArrayInputStream(s.getBytes()) );
```
This will create a temporary file which is readable by other users on Unix like systems, but not MacOS.

Impact
On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system.

This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability.

When analyzing the impact of this vulnerability, here are the important questions to ask:

Is the driver running in an environment where the OS has other untrusted users.
If yes, and you answered 'yes' to question 1, this vulnerability impacts you.
If no, this vulnerability does not impact you.
Patches
Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using.

Java 1.8 and higher users: this vulnerability is fixed in 42.2.27, 42.3.8, 42.4.3, 42.5.1
Java 1.7 users: this vulnerability is fixed in 42.2.27.jre7
Java 1.6 and lower users: no patch is available; you must use the workaround below.
Workarounds
If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability.

References
[CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](https://cwe.mitre.org/data/definitions/200.html)
Fix commit https://github.com/pgjdbc/pgjdbc/commit/9008dc9aade6dbfe4efafcd6872ebc55f4699cf5
Similar Vulnerabilities
Google Guava - https://github.com/google/guava/issues/4011
Apache Ant - https://nvd.nist.gov/vuln/detail/CVE-2020-1945
JetBrains Kotlin Compiler - https://nvd.nist.gov/vuln/detail/CVE-2020-15824
Segfault via invalid attributes in `pywrap_tfe_src.cc`
Advisory: GHSA-xxcj-rhqg-m46g
Aliases: CVE-2022-41889
Published: 2022-11-21T20:42:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a `nullptr`, which is not caught. An example can be seen in [`tf.compat.v1.extract_volume_patches`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc) by passing in quantized tensors as input `ksizes`.
```python
import numpy as np
import tensorflow as tf

a_input = np.array([1, -1], dtype= np.int32)
a_ksizes =  a_strides = tf.constant(dtype=tf.dtypes.qint16, value=[[1, 4], [5, 2]])


tf.compat.v1.extract_volume_patches(input=a_input,ksizes=a_ksizes,strides=a_strides,padding='VALID')
```

### Patches
We have patched the issue in GitHub commit [e9e95553e5411834d215e6770c81a83a3d0866ce](https://github.com/tensorflow/tensorflow/commit/e9e95553e5411834d215e6770c81a83a3d0866ce).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Pattarakrit Rattankul.
Froxlor vulnerable to Code Injection
Advisory: GHSA-h95w-p3x6-wwj6
Aliases: CVE-2022-3721
Published: 2022-11-04T19:01:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Froxlor prior to version 0.10.39 is vulnerable to Code Injection.
code injection in phpxmlrpc/phpxmlrpc
Advisory: GHSA-3fgr-xjr6-xqm8
Published: 2022-11-28T22:07:33Z

code injection in `Wrapper::buildClientWrapperCode` via manipulation of the `$client` argument. It was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url.
wger vulnerable to brute force attempts
Advisory: GHSA-gr58-76rp-mmg4
Aliases: CVE-2022-2650
Published: 2022-11-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2.
Istio may allow identity impersonation if user has localhost access
Advisory: GHSA-6c6p-h79f-g6p4
Aliases: CVE-2022-39388
Published: 2022-11-09T22:07:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

### Impact

User can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.

### Patches
1.15.3

### Workarounds
No. If using 1.15.2 please upgrade to 1.15.3 or later.

### References
None at this time.

### For more information
If you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)
Blind SQL Injection via GridFieldSortableHeader
Advisory: GHSA-rr8h-f97q-8p9c
Aliases: CVE-2022-38148
Published: 2022-11-22T00:00:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Gridfield state is vulnerable to SQL injections. The vast majority of Gridfields in Silverstripe CMS are affected by this vulnerability.

An attacker with CMS access could execute an arbitrary SQL statement by adding an SQL payload in some parts of the GridField state.
Unsanitized input leading to code injection in Dalli
Advisory: GHSA-3xg8-cc8f-9wv2
Aliases: CVE-2022-4064
Published: 2022-11-19T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

A vulnerability was found in Dalli. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to apply a patch to fix this issue.
Apache Spark vulnerable to Log Injection
Advisory: GHSA-43xg-8wmj-cw8h
Aliases: CVE-2022-31777
Published: 2022-11-01T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.
Out of bounds segmentation fault due to unequal op inputs in Tensorflow
Advisory: GHSA-w58w-79xv-6vcj
Aliases: CVE-2022-41883
Published: 2022-11-21T20:39:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

### Impact
 [`tf.raw_ops.DynamicStitch`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/dynamic_stitch_op.cc) specifies input sizes when it is [registered](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/data_flow_ops.cc). 
```cpp
REGISTER_OP("DynamicStitch")
    .Input("indices: N * int32")
    .Input("data: N * T")
    .Output("merged: T")
    .Attr("N : int >= 1")
    .Attr("T : type")
    .SetShapeFn(DynamicStitchShapeFunction);
```
When it receives a differing number of inputs, such as when it is called with an `indices` size 1 and a `data` size 2, it will crash.
```python
import tensorflow as tf

# indices = 1*[tf.random.uniform([1,2], dtype=tf.dtypes.int32, maxval=100)]
indices = [tf.constant([[0, 1]]),]

# data = 2*[tf.random.uniform([1,2], dtype=tf.dtypes.float32, maxval=100)]
data = [tf.constant([[5, 6]]), tf.constant([[7, 8]])]

tf.raw_ops.DynamicStitch(
    indices=indices, 
    data=data)
```

### Patches
We have patched the issue in GitHub commit [f5381e0e10b5a61344109c1b7c174c68110f7629](https://github.com/tensorflow/tensorflow/commit/f5381e0e10b5a61344109c1b7c174c68110f7629).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1 as this is also affected.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Zizhuang Deng of IIE, UCAS
FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess
Advisory: GHSA-xvwp-h6jv-7472
Aliases: CVE-2022-41900
Published: 2022-11-21T22:03:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

### Impact
An input `pooling_ratio` that is smaller than 1 will trigger a heap OOB in [`tf.raw_ops.FractionalMaxPool`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/fractional_max_pool_op.cc) and [`tf.raw_ops.FractionalAvgPool`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/fractional_avg_pool_op.cc).

### Patches
We have patched the issue in GitHub commit [216525144ee7c910296f5b05d214ca1327c9ce48](https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48).

The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Zenario CMS is vulnerable to Remote Code Execution (RCE).
Advisory: GHSA-4p38-rc98-cr39
Aliases: CVE-2022-44136
Published: 2022-11-30T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zenario CMS 9.3.57186 is vulnerable to RCE.
HTSJDK is vulnerable to exposure of resource(s) to the wrong sphere
Advisory: GHSA-96vh-4rfp-c42c
Aliases: CVE-2022-21126
Published: 2022-11-29T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.
Jenkins Config Rotator Plugin vulnerable to path traversal
Advisory: GHSA-9pqq-h9qv-28fp
Aliases: CVE-2022-45388
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Currently there is no known workaround and no fix available.
Path Traversal in Liferay Portal
Advisory: GHSA-hffx-r282-w2g9
Aliases: CVE-2022-42123
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.
Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled
Advisory: GHSA-xx6g-jj35-pxjv
Aliases: CVE-2022-41905
Published: 2022-11-16T00:02:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

### Impact
Implementations using this library with directory browsing enabled may be susceptible to [Cross Site Scripting (XSS)](https://owasp.org/www-community/attacks/xss/) attacks.

### Patches
Users can upgrade to v4.1.0

### Workarounds
Set `dir_browser.enable = False` in the configuration. For instance, when using a Python dictionary to configure the library:

```
config = {
    # your normal configuration
    "dir_browser": {
      "enable": False
    },
}
app = WsgiDAVApp(config)
```

### For more information

Note that an attacker cannot exploit this vulnerability, by simply  uploading a file or folder with a manipulated file name.
However if the WsgiDAV library is used in a scenario where untrusted data is displayed in the directory browser's user interface (e.g. 'realm' or user name, ...) XSS may happen.

If you have any questions or comments about this advisory:
* Open an issue in [mar10/wsgidav](https://github.com/mar10/wsgidav/)
* See the [security policy](https://github.com/mar10/wsgidav/security/policy)
spring-security-oauth2-client vulnerable to Privilege Escalation
Advisory: GHSA-32vj-v39g-jh23
Aliases: CVE-2022-31690
Published: 2022-11-01T12:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.
`CHECK_EQ` fail via input in `SparseMatrixNNZ`
Advisory: GHSA-g9fm-r5mm-rf9f
Aliases: CVE-2022-41901
Published: 2022-11-21T22:03:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail in [`tf.raw_ops.SparseMatrixNNZ`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse/sparse_matrix.h).

```python
import tensorflow as tf
tf.raw_ops.SparseMatrixNNZ(sparse_matrix=[])
```

### Patches
We have patched the issue in GitHub commit [f856d02e5322821aad155dad9b3acab1e9f5d693](https://github.com/tensorflow/tensorflow/commit/f856d02e5322821aad155dad9b3acab1e9f5d693).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Kang Hong Jin
Cross-site Scripting in librenms/librenms
Advisory: GHSA-r4gq-hv2r-mrf5
Aliases: CVE-2022-3516
Published: 2022-11-20T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
Exfiltration of hashed SMB credentials on Windows via file:// redirect
Advisory: GHSA-p2jh-44qj-pf2v
Aliases: CVE-2022-36077
Published: 2022-11-10T12:38:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L

### Impact
When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.

### Patches
This issue has been fixed in all current stable versions of Electron. Specifically, these versions contain the fixes:

- 21.0.0-beta.1
- 20.0.1
- 19.0.11
- 18.3.7

We recommend all apps upgrade to the latest stable version of Electron.

### Workarounds
If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents:

```js
app.on('web-contents-created', (e, webContents) => {
  webContents.on('will-redirect', (e, url) => {
    if (/^file:/.test(url)) e.preventDefault()
  })
})
```

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).

### Credit
Thanks to user @coolcoolnoworries for reporting this issue.
snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)
Advisory: GHSA-4r6j-fwcx-94cf
Aliases: CVE-2022-42965
Published: 2022-11-10T12:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the get_file_transfer_type method.
XML External Entity Reference in Jenkins CCCC Plugin
Advisory: GHSA-f3gj-hvv4-f57v
Aliases: CVE-2022-45395
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
xmldom allows multiple root nodes in a DOM
Advisory: GHSA-crh6-fp67-6883
Aliases: CVE-2022-39353
Published: 2022-11-01T17:29:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing.
This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.

### Patches
Update to `@xmldom/xmldom@~0.7.7`, `@xmldom/xmldom@~0.8.4` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.4` (dist-tag `next`).

### Workarounds
One of the following approaches might help, depending on your use case:
- Instead of searching for elements in the whole DOM, only search in the `documentElement`.
- Reject a document with a document that has more then 1 `childNode`.

### References
- https://nvd.nist.gov/vuln/detail/CVE-2022-39299
- https://github.com/jindw/xmldom/issues/150

### For more information
If you have any questions or comments about this advisory:
* Email us at security@xmldom.org
SQL injection in Dolibarr
Advisory: GHSA-gjg7-qfvp-9hm4
Aliases: CVE-2022-4093
Published: 2022-11-21T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affect 16.0.1 and 16.0.2 only. 16.0.0 or lower, and 16.0.3 or higher are not affected
ToolJet is vulnerable to Denial of Service (DoS)
Advisory: GHSA-hgp8-w8fj-r4cm
Aliases: CVE-2022-4111
Published: 2022-11-22T03:30:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

ToolJet/ToolJet placed no limit on the file size for user avatars. This could cause a denial of service if too many users upload large files. This is fixed in commit 01cd3f0464747973ec329e9fb1ea12743d3235cc in version 1.27.0.

`tooljet` is no longer listed on npmjs.com but was [listed on npmjs.com in the past](https://web.archive.org/web/20220210014826/https://www.npmjs.com/package/tooljet). This advisory is maintained for historical completeness.
Concrete CMS vulnerable to Cross-site Request Forgery
Advisory: GHSA-w8fp-3gwq-gxpw
Aliases: CVE-2022-43693
Published: 2022-11-14T19:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth.
Incorrect Default Permissions in Liferay Portal
Advisory: GHSA-wgqm-qp44-cg6x
Aliases: CVE-2022-42128
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attackers to obtain a WikiNode object via the WikiNodeResource.getSiteWikiNodeByExternalReferenceCode API.
TablePress Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-9mf2-hpj4-rw3r
Aliases: CVE-2022-3788
Published: 2022-11-01T19:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability was found in an unknown function of the component Table Import Handler. The manipulation of the argument Import data leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
static-dev-server vulnerable to path traversal
Advisory: GHSA-7fxm-c848-89q8
Aliases: CVE-2022-25848
Published: 2022-11-29T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A path traversal vulnerability affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory. There is currently no known workaround or fix for this issue.
Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
Advisory: GHSA-rcrx-fpjp-mfrw
Aliases: CVE-2022-39381
Published: 2022-11-02T18:10:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be appended to another.

### Patches
It has been patched in 2.6.0 for muhammara and not at all for hummus

### Workarounds
Do not process files from untrusted sources

### References
PR: https://github.com/julianhille/MuhammaraJS/pull/194
Issue: https://github.com/julianhille/MuhammaraJS/issues/191
Issue in hummus: https://github.com/galkahana/HummusJS/issues/293

### Outline differences to https://nvd.nist.gov/vuln/detail/CVE-2022-25892

The difference is one is in [src/deps/PDFWriter/PDFParser.cpp](https://github.com/julianhille/MuhammaraJS/commit/1890fb555eaf171db79b73fdc3ea543bbd63c002#diff-09ac2c64aeab42b14b2ae7b11a5648314286986f8c8444a5b3739ba7203b1e9b) and the other is [PDFDocumentHandler.cpp](https://github.com/julianhille/MuhammaraJS/pull/194/files#diff-38d338ea4c047fd7dd9a05b5ffe7c964f0fa7e79aff4c307ccee7596457b1ef2) both is a null pointer but for different cases
These are totally diffent issues, one is in reading a pdf the other is in appendending a maliciously crafted one. The function calls are different the versions in which they are solved are diffent.
eZ Platform users with the Company admin role can assign any role to any user
Advisory: GHSA-8h83-chh2-fchp
Published: 2022-11-10T23:58:32Z

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Cross-site Scripting in kiwitcms
Advisory: GHSA-hf94-8mx5-2vvj
Aliases: CVE-2022-4105
Published: 2022-11-21T21:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Cross-site Scripting in Backdrop CMS
Advisory: GHSA-58rj-w2qf-qjg7
Aliases: CVE-2022-42095
Published: 2022-11-23T03:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content.
fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
Advisory: GHSA-fppq-mj76-fpj2
Aliases: CVE-2022-39379
Published: 2022-11-02T18:15:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

### Impact
A remote code execution (RCE) vulnerability in non-default configurations of Fluentd  allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads.

Fluentd setups are only affected if the environment variable `FLUENT_OJ_OPTION_MODE` is explicitly set to `object`.

Please note: The option FLUENT_OJ_OPTION_MODE was introduced in Fluentd version 1.13.2. Earlier versions of Fluentd are not affected by this vulnerability.

### Patches
v1.15.3

### Workarounds
Do not use `FLUENT_OJ_OPTION_MODE=object`.

### References

* GHSL-2022-067
Pillow subject to DoS via SAMPLESPERPIXEL tag
Advisory: GHSA-q4mp-jvh2-76fj
Aliases: CVE-2022-45199
Published: 2022-11-14T12:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pillow starting with 9.2.0 and prior to 9.3.0 allows denial of service via SAMPLESPERPIXEL. A large value in the SAMPLESPERPIXEL tag could lead to a memory and runtime DOS in TiffImagePlugin.py when setting up the context for image decoding. This issue has been patched in version 9.3.0.
Jeecg-boot vulnerable to SQL Injection
Advisory: GHSA-g5cj-5h58-j93w
Aliases: CVE-2022-45206
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.
Garbage collection issue in BC-FJA in Java 13 and later
Advisory: GHSA-68m8-v89j-7j2p
Aliases: CVE-2022-45146
Published: 2022-11-21T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue in the BC-FJA FIPS modules where it is possible for temporary keys used by the module to be zeroed out while still in use by the module, resulting in errors or potential information loss. 

NOTE: FIPS compliant users are unaffected because the FIPS certification is only for Java 7, 8, and 11.