aswin1906/github-advisory-2022 huggingface dataset:
Whole-script approval in Jenkins Script Security Plugin vulnerable to SHA-1 collisions
Advisory: GHSA-fv42-mx39-6fpw
Aliases: CVE-2022-45379
Published: 2022-11-16T12:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the [SHA-1 hash](https://en.wikipedia.org/wiki/SHA-1) of the approved script. SHA-1 no longer meets the security standards for producing a cryptographically secure message digest.

Script Security Plugin 1190.v65867a_a_47126 uses SHA-512 for new whole-script approvals. Previously approved scripts will have their SHA-1 based whole-script approval replaced with a corresponding SHA-512 whole-script approval when the script is next used.

Whole-script approval only stores the SHA-1 or SHA-512 hash, so it is not possible to migrate all previously approved scripts automatically on startup.

Administrators concerned about SHA-1 collision attacks on the whole-script approval feature are able to revoke all previous (SHA-1) script approvals on the In-Process Script Approval page.
Markdownify has Files or Directories Accessible to External Parties
Advisory: GHSA-qqhf-xfhw-7884
Aliases: CVE-2022-41710
Published: 2022-11-04T12:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at least not strict enough) and/or does not properly validate the contents of markdown files before rendering them.
Missing permission check in Jenkins Delete log Plugin
Advisory: GHSA-j874-47xx-9xfg
Aliases: CVE-2022-45394
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. As of publication of this advisory, there is no fix.
Jeecg-boot vulnerable to SQL injection via /sys/user/putRecycleBin
Advisory: GHSA-25gv-mvm7-5h3h
Aliases: CVE-2022-45208
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.
XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider
Advisory: GHSA-m7gv-v8xx-v47w
Aliases: CVE-2022-39387
Published: 2022-11-04T18:58:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

### Impact

Even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based OpenID provider with oidc.xwikiprovider.

With the same approach, one could also provide a specific group mapping through oidc.groups.mapping that would make his user automatically part of the XWikiAdminGroup

### Patches

Patched in version 1.29.1.

### Workarounds

There is no workaround, an upgrade of the authenticator is required.

### References

https://jira.xwiki.org/browse/OIDC-118

### For more information

If you have any questions or comments about this advisory:

* Open an issue in Jira XWiki
* Email us at our security mailing list
sweetalert2 v10.16.10 and above contains hidden functionality
Advisory: GHSA-457r-cqc8-9vj9
Published: 2022-11-23T15:39:50Z

`sweetalert2` versions 10.16.10 and up until 11.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions 10.0.0 - 10.16.9.

### Workaround
Use a version 10.0.0 - 10.16.9 of the package until the maintainer releases a fix.
Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers
Advisory: GHSA-xprv-wvh7-qqqx
Aliases: CVE-2022-41878
Published: 2022-11-09T20:47:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact

Keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option.

### Patches

Improved keyword detection.

### Workarounds

Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature.

### Collaborators

Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative

### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx
CKAN contains Improper Authentication leading to account takeover
Advisory: GHSA-m2xp-jxfg-qq6g
Aliases: CVE-2022-43685
Published: 2022-11-22T03:30:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
Browsershot version 3.57.3 vulnerable to improper input validation
Advisory: GHSA-6q49-35h6-rq2p
Aliases: CVE-2022-43984
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the JS content imported from an external source passed to the Browsershot::html method does not contain URLs that use the file:// protocol.
Concrete CMS vulnerable to Uncontrolled Resource Consumption leading to DoS
Advisory: GHSA-3cxx-3f53-m92c
Aliases: CVE-2022-43686
Published: 2022-11-15T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service (high load).
node-red-dashboard vulnerable to Cross-site Scripting
Advisory: GHSA-vrv9-3x3w-ffxw
Aliases: CVE-2022-3783
Published: 2022-11-01T12:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

node-red-dashboard contains a cross-site scripting vulnerability. This issue affects some unknown processing of the file `components/ui-component/ui-component-ctrl.js` of the component ui_text Format Handler. The attack may be initiated remotely. The issue is patched in version 3.2.0.
Tribal Systems Zenario CMS vulnerable to Session Fixation
Advisory: GHSA-6657-9743-4mc6
Aliases: CVE-2022-4231
Published: 2022-11-30T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Tribal Systems Zenario CMS 9.3.57595 is vulnerable to session fixation. In Zenario CMS, the user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after user logout and login again into the application when "Remember me" option active. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with. The attack may be initiated remotely and an exploit has been disclosed.
X.509 Email Address Variable Length Buffer Overflow
Advisory: GHSA-h8jm-2x53-xhp5
Aliases: CVE-2022-3786
Published: 2022-11-01T17:45:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs after
certificate chain signature verification and requires either a CA to
have signed a malicious certificate or for an application to continue
certificate verification despite failure to construct a path to a trusted
issuer. An attacker can craft a malicious email address in a certificate
to overflow an arbitrary number of bytes containing the `.` character
(decimal 46) on the stack. This buffer overflow could result in a crash
(causing a denial of service).

In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.
Badaso vulnerable to Remote Code Execution (RCE)
Advisory: GHSA-g389-rf5p-fg56
Aliases: CVE-2022-41705
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Stored XSS in Compare Mode
Advisory: GHSA-66jf-xm2m-7m8r
Aliases: CVE-2022-38145
Published: 2022-11-22T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A malicious content author could add a Javascript payload to a page's meta description and get it executed in the versioned history compare view.

This vulnerability requires access to the CMS to be deployed. The attacker must then convince a privileged user to access the version history for that page.
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui
Advisory: GHSA-6w8h-26xx-cf8q
Aliases: CVE-2022-41934
Published: 2022-11-21T22:37:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

### Impact
Any user with view rights on commonly accessible documents including the menu macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation due to improper escaping of the macro content and parameters of the menu macro.

The issue can be demonstrated by opening `<server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Bmenu%7D%7D%7B%7Bcache+id%3D%22menuMacro%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+Groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%7B%7B%2Fmenu%7D%7D` where `<server>` is the URL of the XWiki installation. If this displays "Hello from Groovy!", the installation is vulnerable.

### Patches
The problem has been patched in XWiki 14.6RC1, 13.10.8 and 14.4.3.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/2fc20891e6c6b0ca05ee07e315e7f435e8919f8d) for the document `Menu.MenuMacro` can be manually applied or a XAR archive of a patched version can be [imported](https://www.xwiki.org/xwiki/bin/view/Documentation/UserGuide/Features/Imports#HImportingXWikipages). The menu macro was basically unchanged since XWiki 11.6 so on XWiki 11.6 or later the [patch for version of 13.10.8](https://github.com/xwiki/xwiki-platform/commit/59ccca24a8465a19f40c51d65fcc2c09c1edea16) can most likely be applied, on XWiki version 14.0 and later the versions in XWiki 14.6 and 14.4.3 should be appropriate.

### References
* https://github.com/xwiki/xwiki-platform/commit/2fc20891e6c6b0ca05ee07e315e7f435e8919f8d
* https://jira.xwiki.org/browse/XWIKI-19857

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
Advisory: GHSA-755v-r4x4-qf7m
Published: 2022-11-29T23:55:23Z

### Summary

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (16.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the groups' dropdown functionality. 

### Impact

Successful attacks of this vulnerability can result a privileged attacker to load a XSS script, and steal data from other users. The impact can be considered moderate to low, considering privileged credentials are required.

### References
- Please refer to the Keycloak Security mailing list for more information.
Cross-site Scripting in librenms/librenms
Advisory: GHSA-264w-gw9g-fhgj
Aliases: CVE-2022-3561
Published: 2022-11-20T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.
Jenkins BART Plugin vulnerable to cross-site scripting (XSS)
Advisory: GHSA-j923-26c2-qq9p
Aliases: CVE-2022-45387
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability. Currently, there are no known workarounds or patches available.
Code injection in quarkus dev ui config editor
Advisory: GHSA-g56w-cwg4-hxx9
Aliases: CVE-2022-4116
Published: 2022-11-22T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.
Browsershot does not validate URL protocols passed to Browsershot URL method
Advisory: GHSA-8c2c-jxwj-jqgf
Aliases: CVE-2022-41706
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the URL protocol passed to the Browsershot::url method.
eZ Platform users with the Company admin role can assign any role to any user
Advisory: GHSA-pcpm-vc4v-cmvx
Published: 2022-11-10T23:56:45Z

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Rdiffweb vulnerable to Missing Authentication for Critical Function
Advisory: GHSA-4wph-9vrm-6v3w
Aliases: CVE-2022-4018
Published: 2022-11-16T19:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
NodeBB vulnerable to Cross-Site Request Forgery
Advisory: GHSA-5gwx-wf9g-r5mx
Aliases: CVE-2022-3978
Published: 2022-11-13T19:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A vulnerability was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component.
`CHECK` fail via inputs in `PyFunc`
Advisory: GHSA-mv77-9g28-cwg3
Aliases: CVE-2022-41908
Published: 2022-11-21T22:09:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in [`tf.raw_ops.PyFunc`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc).

```python
import tensorflow as tf

value = tf.constant(value=[1,2])
token = b'\xb0'
dataType = [tf.int32]

tf.raw_ops.PyFunc(input=value,token=token,Tout=dataType)
```

### Patches
We have patched the issue in GitHub commit [9f03a9d3bafe902c1e6beb105b2f24172f238645](https://github.com/tensorflow/tensorflow/commit/9f03a9d3bafe902c1e6beb105b2f24172f238645).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by pattarakritr@smu.edu.sg
Concrete CMS vulnerable to Cross-site Scripting
Advisory: GHSA-9jc5-9wh5-mc36
Aliases: CVE-2022-43688
Published: 2022-11-15T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft application tile color is not sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
Browsershot vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-82h9-v8vh-mfpq
Aliases: CVE-2022-43983
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate that the HTML content passed to the Browsershot::html method does not contain URL's that use the file:// protocol.
muhammara and hummus vulnerable to null pointer dereference on bad response object
Advisory: GHSA-frp9-2v6r-gj97
Aliases: CVE-2022-25885
Published: 2022-11-01T12:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package muhammara before 2.6.0 and the package hummus before 1.0.111 are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
cleo is vulnerable to Regular Expression Denial of Service (ReDoS)
Advisory: GHSA-2p9h-ccw7-33gf
Aliases: CVE-2022-42966
Published: 2022-11-10T12:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the cleo PyPI package, when an attacker is able to supply arbitrary input to the Table.set_rows method.
`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode
Advisory: GHSA-xf83-q765-xm6m
Published: 2022-11-21T23:51:30Z

### Impact
Another instance of CVE-2022-35991, where `TensorListScatter` and `TensorListScatterV2` crash via non scalar inputs in`element_shape`, was found in eager mode and fixed.
```python
import tensorflow as tf
arg_0=tf.random.uniform(shape=(2, 2, 2), dtype=tf.float16, maxval=None)
arg_1=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536)
arg_2=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536)
arg_3=''
tf.raw_ops.TensorListScatter(tensor=arg_0, indices=arg_1, 
element_shape=arg_2, name=arg_3)
```

### Patches
We have patched the issue in GitHub commit [bf9932fc907aff0e9e8cccf769e8b00d30fd81a1](https://github.com/tensorflow/tensorflow/commit/bf9932fc907aff0e9e8cccf769e8b00d30fd81a1).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Pattarakrit Rattankul
Missing Authorization in Jenkins Cluster Statistics Plugin
Advisory: GHSA-w8wg-62wf-62gm
Aliases: CVE-2022-45399
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics.
Stored XSS using uppercase characters in HTMLEditor
Advisory: GHSA-qw4w-vq8v-2wcv
Aliases: CVE-2022-37430
Published: 2022-11-21T23:59:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A malicious content author could add a Javascript payload to the href attribute of a link. A similar issue was identified and fixed via CVE-2022-28803. However, the fix didn't account for the casing of the href attribute. An attacker must have access to the CMS to exploit this issue.
OS Command Injection in Apache Airflow
Advisory: GHSA-7wqf-h36w-47mc
Aliases: CVE-2022-38649
Published: 2022-11-22T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pinot Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
Tribal Systems Zenario CMS vulnerable to Cross-site Scripting
Advisory: GHSA-f92p-f8r2-c87q
Aliases: CVE-2020-36608
Published: 2022-11-03T12:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability has been found in Tribal Systems Zenario CMS prior to version 8.5.51340. Affected by this issue is some unknown functionality of the file `admin_organizer.js` of the component `Error Log Module`. The manipulation leads to cross site scripting. The attack may be launched remotely. The issue is patched in version 8.5.51340.
Concrete CMS vulnerable to Reflected Cross-site Scripting
Advisory: GHSA-rg6w-c352-p8pg
Aliases: CVE-2022-43692
Published: 2022-11-15T12:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflected XSS with a url if the targeted administrator is using an old browser that lacks XSS protection. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
`FractionalMaxPoolGrad` Heap out of bounds read
Advisory: GHSA-f2w8-jw48-fr7j
Aliases: CVE-2022-41897
Published: 2022-11-21T21:54:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If [`FractionMaxPoolGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/fractional_max_pool_op.cc) is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`, TensorFlow will crash.

```python
import tensorflow as tf
tf.raw_ops.FractionMaxPoolGrad(
	orig_input = [[[[1, 1, 1, 1, 1]]]],
    orig_output = [[[[1, 1, 1]]]],
    out_backprop = [[[[3], [3], [6]]]],
    row_pooling_sequence = [-0x4000000, 1, 1], 
    col_pooling_sequence = [-0x4000000, 1, 1], 
    overlapping = False
 )
```

### Patches
We have patched the issue in GitHub commit [d71090c3e5ca325bdf4b02eb236cfb3ee823e927](https://github.com/tensorflow/tensorflow/commit/d71090c3e5ca325bdf4b02eb236cfb3ee823e927).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Vul AI.
Apache Jena vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-g2qw-6vrr-v6pq
Aliases: CVE-2022-45136
Published: 2022-11-14T19:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

** UNSUPPORTED WHEN ASSIGNED ** Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerable to this class of attack. As a result an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020 and users should migrate to alternative options e.g. Apache Jena TDB 2.
Microweber vulnerable to cross-site scripting (XSS)
Advisory: GHSA-79gx-3fm8-qxqq
Aliases: CVE-2022-0698
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter. There was a patch released in the development branch but is not yet committed to the main branch.
Ibexa DXP users with the Company admin role can assign any role to any user
Advisory: GHSA-394j-x37r-2q27
Published: 2022-11-10T23:54:04Z

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Lin CMS vulnerable to Improper Authentication
Advisory: GHSA-4vrc-q7m6-vq7w
Aliases: CVE-2022-44244
Published: 2022-11-10T12:01:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.
TYPO3 Extension femanager vulnerable to Broken Access Control
Advisory: GHSA-59m9-p6cm-94q5
Aliases: CVE-2022-44543
Published: 2022-11-03T18:10:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

The TYPO3 Extension femanager prior to versions 5.5.2, 6.3.3, and 7.0.1 is vulnerable to broken access control. The `usergroup.inList` validation can be bypassed resulting in new frontend users created by the extension may be members of groups that are restricted. The vulnerability is only exploitable if the field usergroup is available in the registration form. Versions 5.5.2, 6.3.3, and 7.0.1 contain patches.
Incorrect Default Permissions in Liferay Portal
Advisory: GHSA-5x9h-p2gx-35mg
Aliases: CVE-2022-42127
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allows remote attackers to obtain the history of all friendly URLs that was assigned to a page.
Cross site scripting vulnerability with discussion titles
Advisory: GHSA-7x4w-j98p-854x
Aliases: CVE-2022-41938
Published: 2022-11-21T23:53:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after `v1.5` and was not noticed.

This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or renaming one. The XSS attack occurs after a visitor opens the relevant discussion page.

### Impact
All communities running Flarum from `v1.5.0` to `v1.6.1` are impacted.

### Patches
The vulnerability has been fixed and published as flarum/core `v1.6.2`. All communities running Flarum from `v1.5.0` to `v1.6.1` have to upgrade as soon as possible to v1.6.2 using:

```
composer update --prefer-dist --no-dev -a -W
```

You can then confirm you run the latest version using:

```
composer show flarum/core
```

### Workarounds
**None**

### For more information
For any questions or comments on this vulnerability please visit https://discuss.flarum.org/d/27558.

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.
Buffer overflow in `CONV_3D_TRANSPOSE` on TFLite
Advisory: GHSA-h6q3-vv32-2cq5
Aliases: CVE-2022-41894
Published: 2022-11-21T20:44:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

### Impact
The reference kernel of the [`CONV_3D_TRANSPOSE`](https://github.com/tensorflow/tensorflow/blob/091e63f0ea33def7ecad661a5ac01dcafbafa90b/tensorflow/lite/kernels/internal/reference/conv3d_transpose.h#L121) TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result.

Instead of `data_ptr += num_channels;` it should be `data_ptr += output_num_channels;` as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if num_channels > output_num_channels.

An attacker can craft a model with a specific number of input channels in a way similar to the attached example script. It is then possible to write specific values through the bias of the layer outside the bounds of the buffer. This attack only works if the reference kernel resolver is used in the interpreter (i.e. `experimental_op_resolver_type=tf.lite.experimental.OpResolverType.BUILTIN_REF` is used).
```python
import tensorflow as tf
model = tf.keras.Sequential(
    [
        tf.keras.layers.InputLayer(input_shape=(2, 2, 2, 1024), batch_size=1),
        tf.keras.layers.Conv3DTranspose(
            filters=8,
            kernel_size=(2, 2, 2),
            padding="same",
            data_format="channels_last",
        ),
    ]
)

converter = tf.lite.TFLiteConverter.from_keras_model(model)
tflite_model = converter.convert()

interpreter = tf.lite.Interpreter(
    model_content=tflite_model,
    experimental_op_resolver_type=tf.lite.experimental.OpResolverType.BUILTIN_REF,
)

interpreter.allocate_tensors()
interpreter.set_tensor(
    interpreter.get_input_details()[0]["index"], tf.zeros(shape=[1, 2, 2, 2, 1024])
)
interpreter.invoke()
```

### Patches
We have patched the issue in GitHub commit [72c0bdcb25305b0b36842d746cc61d72658d2941](https://github.com/tensorflow/tensorflow/commit/72c0bdcb25305b0b36842d746cc61d72658d2941).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Thibaut Goetghebuer-Planchon, Arm Ltd.
Cross-site Scripting in Zenario
Advisory: GHSA-gmf5-q34v-vwvp
Aliases: CVE-2022-44073
Published: 2022-11-16T19:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg, Users & Contacts.
Centreon vulnerable to SQL Injection
Advisory: GHSA-j5wx-jvw3-j363
Aliases: CVE-2022-3827
Published: 2022-11-02T19:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SQL injection vulnerability in Centreon affects unknown code of the file formContactGroup.php of the component Contact Groups Form. The manipulation of the argument cg_id leads to sql injection. The attack can be initiated remotely. Version 22.10.0-beta1 contains a patch for this issue.
TestNG is vulnerable to Path Traversal
Advisory: GHSA-rc2q-x9mf-w3vf
Aliases: CVE-2022-4065
Published: 2022-11-19T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact

Affected by this vulnerability is the function `testngXmlExistsInJar` of the file `testng-core/src/main/java/org/testng/JarFileUtils.java` of the component `XML File Parser`.

The manipulation leads to path traversal only for `.xml`, `.yaml` and `.yml` files by default. The attack implies running an unsafe test JAR. However since that JAR can also contain executable code itself, the path traversal is unlikely to be the main attack.

### Patches

A patch is available in [version 7.7.0](https://github.com/cbeust/testng/releases/tag/7.7.0) at commit 9150736cd2c123a6a3b60e6193630859f9f0422b. It is recommended to apply a patch to fix this issue. The patch was pushed into the master branch but no releases have yet been made with the patch included.

A backport of the fix is available in [version 7.5.1]((https://github.com/cbeust/testng/releases/tag/7.5.1) for Java 8 projects.

### Workaround

* Specify which tests to run when invoking TestNG by configuring them on the CLI or in the build tool controlling the run.
* Do not run tests with untrusted JARs on the classpath, this includes pull requests on open source projects.
Out of bounds write in grappler in Tensorflow
Advisory: GHSA-cg88-rpvp-cjv5
Aliases: CVE-2022-41902
Published: 2022-11-21T22:04:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

### Impact
The function [MakeGrapplerFunctionItem](https://https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221) takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered.

### Patches
We have patched the issue in GitHub commit [a65411a1d69edfb16b25907ffb8f73556ce36bb7](https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7).

The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
OS Command Injection in Apache Airflow
Advisory: GHSA-45r6-j3cc-6mxx
Aliases: CVE-2022-40954
Published: 2022-11-22T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed).
Reflected XSS in querystring parameters
Advisory: GHSA-vvxf-r4vm-2vm6
Aliases: CVE-2022-38462
Published: 2022-11-21T23:59:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request.

To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload.

This will only affect projects configured to output PHP warnings to the browser. By default, Silverstripe CMS will only output PHP warnings if your SS_ENVIRONMENT_TYPE environment variable is set to dev. Production sites should always set SS_ENVIRONMENT_TYPE to live.
Remote code execution vulnerability in dependency System.Drawing.Common
Advisory: GHSA-gpv5-rp6w-58r8
Published: 2022-11-22T00:13:44Z

### Impact

The core Akka module depended on an old System.Configuration.ConfigurationManager version 4.7.0 which transitively depends on System.Common.Drawing v4.7.0. The System.Common.Drawing v4.7.0 is affected by a remote code execution vulnerability https://github.com/advisories/GHSA-ghhp-997w-qr28.

The real-world impact of this should be low, but users should be advised to upgrade to later versions of Akka.NET.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

This issue is resolved in Akka.NET v1.4.46 and Akka.NET v1.5.0-alpha3.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You might be able to explicitly reference System.Configuration.ConfigurationManager's NuGet package and upgrade to 6.0.1 or later without upgrading Akka.NET, but it's probably best to upgrade Akka.NET itself.

### References
_Are there any links users can visit to find out more?_

Original issue: https://github.com/akkadotnet/akka.net/issues/6226
MSFT advisory: https://github.com/advisories/GHSA-ghhp-997w-qr28

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [the Akka.NET repository](https://github.com/akkadotnet/akka.net/issues/new)
* Contact us on [the Akka.NET Discord](https://discord.gg/GSCfPwhbWP)
Heap buffer overflow in GPU
Advisory: GHSA-995f-9x5r-2rcj
Aliases: CVE-2022-4135
Published: 2022-11-25T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
TiDB vulnerable to Use of Externally-Controlled Format String
Advisory: GHSA-7fxj-fr3v-r9gj
Aliases: CVE-2022-3023
Published: 2022-11-04T19:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TiDB server (importer CLI tool) prior to version 6.4.0 & 6.1.3 is vulnerable to data source name injection. The database name for generating and inserting data into a database does not properly sanitize user input which can lead to arbitrary file reads."
Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`
Advisory: GHSA-5m39-wx2q-mxg3
Published: 2022-11-08T21:42:06Z

The compression and decompression function used `mem:uninitialized` to create an array of uninitialized values, to later write values into it. This later leads to reads from uninitialized memory.

The flaw was corrected in commit b633bf265e41c60dfce3be7eac4e4dd5e18d06cf by using a heap-allocated `Vec` and removing out use of `mem::uninitialized`. The fix was released in v0.3.2 and v1.0.0

Subsequently, the crate was deprecated and its use is discouraged.
Vulnerable OpenSSL included in cryptography wheels
Advisory: GHSA-39hc-v87j-747x
Published: 2022-11-02T18:11:56Z

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221101.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Subrion CMS is vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-jrvr-gmqv-hgrh
Aliases: CVE-2022-43121
Published: 2022-11-09T19:02:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS in version 4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field.
`CHECK` fail via inputs in `SparseFillEmptyRowsGrad`
Advisory: GHSA-hq7g-wwwp-q46h
Aliases: CVE-2022-41898
Published: 2022-11-21T21:54:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If [`SparseFillEmptyRowsGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse_fill_empty_rows_op_gpu.cu.cc) is given empty inputs, TensorFlow will crash.

```python
import tensorflow as tf
tf.raw_ops.SparseFillEmptyRowsGrad(
    reverse_index_map=[], grad_values=[], name=None
)
```

### Patches
We have patched the issue in GitHub commit [af4a6a3c8b95022c351edae94560acc61253a1b8](https://github.com/tensorflow/tensorflow/commit/af4a6a3c8b95022c351edae94560acc61253a1b8).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Jiawei Liu, PhD student at University of Illinois, Urbana-Champaign.
Apache Commons BCEL vulnerable to out-of-bounds write
Advisory: GHSA-97xg-phpr-rg8q
Aliases: CVE-2022-42920
Published: 2022-11-07T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
Apache Tomcat may reject request containing invalid Content-Length header
Advisory: GHSA-p22x-g9px-3945
Aliases: CVE-2022-42252
Published: 2022-11-01T12:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
Heap overflow in `QuantizeAndDequantizeV2`
Advisory: GHSA-frqp-wp83-qggv
Aliases: CVE-2022-41910
Published: 2022-11-21T22:17:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
The function [MakeGrapplerFunctionItem](https://https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221) takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered.
```python
import tensorflow as tf
@tf.function
def test():
    tf.raw_ops.QuantizeAndDequantizeV2(input=[2.5],
    								   input_min=[1.0],
    								   input_max=[10.0],
    								   signed_input=True,
    								   num_bits=1,
    								   range_given=True,
    								   round_mode='HALF_TO_EVEN',
    								   narrow_range=True,
    								   axis=0x7fffffff)
test()
```

### Patches
We have patched the issue in GitHub commit [7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb](https://github.com/tensorflow/tensorflow/commit/7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb).

The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.10.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Cross-Site Request Forgery in feehi/feehicms
Advisory: GHSA-cjp8-vv38-p3g2
Aliases: CVE-2022-4014
Published: 2022-11-16T12:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

FeehiCMS vulnerable to Cross-Site Request Forgery. Affected by this issue is some unknown functionality of the component Post My Comment Tab. The manipulation leads to cross-site request forgery. The attack may be launched remotely.
XML External Entity Reference in Jenkins Violations Plugin
Advisory: GHSA-4598-wcg8-x56g
Aliases: CVE-2022-45386
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers to control XML input files for the 'Report Violations' post-build step to have agent processes parse a crafted file that uses external entities for extraction of secrets from the Jenkins agent or server-side request forgery.

Because Jenkins agent processes usually execute build tools whose input (source code, build scripts, etc.) is controlled externally, this vulnerability only has a real impact in very narrow circumstances: when attackers can control XML files, but are unable to change build steps, Jenkinsfiles, test code that gets executed on the agents, or similar.
ckb: Transaction header_deps validation issue (network forking)
Advisory: GHSA-7fw6-6mfj-g3q2
Published: 2022-11-02T18:14:30Z

### Impact
fn `HeaderChecker#check_valid` skipped main chain checking after this PR: https://github.com/nervosnetwork/ckb/pull/1646/files#diff-c4e017b67c1b3005ca0c446a9b0879571aa36a858b1f7ddd1b9328a884e3214bR171-R176

It will cause network forking if one transaction is using a forked block header which is not exists in local node's storage.

### Patches

0.101.1 and later versions
Path Traversal in Liferay Portal
Advisory: GHSA-g8hp-rc67-jf96
Aliases: CVE-2022-42125
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
decode-uri-component vulnerable to Denial of Service (DoS)
Advisory: GHSA-w573-4hg7-7wgq
Aliases: CVE-2022-38900
Published: 2022-11-28T15:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
X.509 Email Address 4-byte Buffer Overflow
Advisory: GHSA-8rwr-x37p-mx23
Aliases: CVE-2022-3602
Published: 2022-11-01T17:45:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address
to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or
potentially remote code execution.

Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution. The risk may be further mitigated based on stack layout for any given platform/compiler.

Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis based on some of the mitigating factors described above have led this to be downgraded to HIGH. Users are still encouraged to upgrade to a new version as soon as possible.

In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.