aswin1906/github-advisory-2022 huggingface dataset:
Apache InLong vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-26m4-qjp9-xmc6
Aliases: CVE-2022-40955
Published: 2022-09-21T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leading to Remote Code Execution on the Apache InLong server. Users are advised to upgrade to Apache InLong 1.3.0 or newer.
YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module
Advisory: GHSA-qwc8-vjh3-gm2j
Aliases: CVE-2022-3004
Published: 2022-09-21T00:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the `WorkFlow` module. A patch is available at commit cd82ecce44d83f1f6c10c7766bf36f3026de024a.
rdiffweb 2.4.1 vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Advisory: GHSA-mjw4-xvx6-3grg
Aliases: CVE-2022-3174
Published: 2022-09-14T00:00:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

rdiffweb version 2.4.1 is vulnerable to Sensitive Cookie in HTTPS Session Without 'Secure' Attribute. This makes it so that a user's cookies can be sent to the server with an unencrypted request over the HTTP protocol. Version 2.4.2 contains a fix for the issue.
Apache ShenYu Admin has insecure permissions
Advisory: GHSA-fjjw-82xw-vfc2
Aliases: CVE-2022-37435
Published: 2022-09-02T00:01:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3. Version 2.5.0 contains a patch for this issue.
graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources
Advisory: GHSA-v62j-cxhh-fq22
Aliases: CVE-2022-37734
Published: 2022-09-13T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

graphql-java before 19.0, 18.3, and 17.4 is vulnerable to Denial of Service. An attacker send a malicious GraphQL query that consumes CPU resources. The fixed versions are 19.0, 18.3, and 17.4.
Apache Airflow vulnerable to Use of Externally-Controlled Format String
Advisory: GHSA-5rp4-749p-vx26
Aliases: CVE-2022-40604
Published: 2022-09-22T22:40:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.
MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
Advisory: GHSA-6xm7-3cc5-47f9
Aliases: CVE-2022-37189
Published: 2022-09-08T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

DDMAL MEI2Volpiano 0.8.2 is vulnerable to XML External Entity (XXE), leading to a Denial of Service. This occurs due to the usage of the unsafe 'xml.etree' library to parse untrusted XML input.
Goomph before 3.37.2 allows malicious zip file to write contents to arbitrary locations
Advisory: GHSA-p2f7-9cv7-jjf6
Aliases: CVE-2022-26049
Published: 2022-09-12T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability.

**Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.
secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery
Advisory: GHSA-q3f4-9h4p-vgr3
Aliases: CVE-2022-41340
Published: 2022-09-25T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery.
fhir-works-on-aws-authz-smart handles permissions improperly
Advisory: GHSA-vv7x-7w4m-q72f
Aliases: CVE-2022-39230
Published: 2022-09-21T20:36:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact

This issue allows a client of the API to retrieve more information than the client’s OAuth scope permits when making “search-type” requests. This issue would not allow a client to retrieve information about individuals other than those the client was already authorized to access.

### Patches

We recommend that users of fhir-works-on-aws-authz-smart 3.1.1 or 3.1.2 upgrade to version 3.1.3 or higher immediately. Versions 3.1.0 and below are unaffected.

### Workarounds

There is no workaround for this issue. Please upgrade fhir-works-on-aws-authz-smart to version 3.1.3 or higher.

### References

https://github.com/awslabs/fhir-works-on-aws-deployment
https://github.com/awslabs/fhir-works-on-aws-authz-smart

### For more information

If you have any questions or comments about this advisory:

Email us at [fhir-works-on-aws-dev@amazon.com](mailto:fhir-works-on-aws-dev@amazon.com)
WASM3 Improper Input Validation vulnerability
Advisory: GHSA-crf8-h2wq-2h9x
Aliases: CVE-2022-39974
Published: 2022-09-21T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

WASM3 v0.5.0 was discovered to contain a segmentation fault via the component `op_Select_i32_srs` in `wasm3/source/m3_exec.h`.
rdiffweb CSRF vulnerability in admin area can lead to deletion of repositories and users
Advisory: GHSA-cw2v-wv4g-w4p6
Aliases: CVE-2022-3232
Published: 2022-09-18T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

rdiffweb prior to 2.4.5 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker exploiting this vulnerability can use it to delete repositories and users.
Apache IoTDB grafana-connector contains an interface without authorization
Advisory: GHSA-c86f-9grv-pmqf
Aliases: CVE-2022-38370
Published: 2022-09-06T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of a database. Users should upgrade to version 0.13.1, which addresses this issue.
Casdoor arbitrary file write vulnerability
Advisory: GHSA-9vm3-r8gq-cr6x
Aliases: CVE-2022-38638
Published: 2022-09-10T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion
Advisory: GHSA-fpgf-pjjv-2qgm
Aliases: CVE-2022-39248
Published: 2022-09-30T04:37:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

### Impact
An attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. 

Additionally, a sophisticated attacker cooperating with a malicious homeserver could employ this vulnerability to perform a targeted attack in order to send fake to-device messages appearing to originate from another user. This can allow, for example, to inject the key backup secret during a self-verification, to make a targeted device start using a malicious key backup spoofed by the homeserver. matrix-android-sdk2 would then additionally sign such a key backup with its device key, spilling trust over to other devices trusting the matrix-android-sdk2 device.

These attacks are possible due to a protocol confusion vulnerability that accepts to-device messages encrypted with Megolm instead of Olm.

### Patches

matrix-android-sdk2 has been modified to only accept Olm-encrypted to-device messages and to stop signing backups on a successful decryption.

Out of caution, several other checks have been audited or added:
- Cleartext `m.room_key`, `m.forwarded_room_key` and `m.secret.send` to_device messages are discarded.
- Secrets received from untrusted devices are discarded.
- Key backups are only usable if they have a valid signature from a trusted device (no more local trust, or trust-on-decrypt).
- The origin of a to-device message should only be determined by observing the Olm session which managed to decrypt the message, and not by using claimed sender_key, user_id, or any other fields controllable by the homeserver.


### Workarounds

As this attack requires coordination between a malicious home server and an attacker, if you trust your home server no particular workaround is needed.  Notice that the backup spoofing attack is a particularly sophisticated targeted attack.

We are not aware of this attack being used in the wild, though specifying a false positive-free way of noticing malicious key backups key is challenging.

As an abundance of caution, to avoid malicious backup attacks, you should not verify your new logins using emoji/QR verifications methods until patched. Prefer using verify with passphrase.


### References
Blog post: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients

### For more information
If you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
Apache Tomcat Race Condition vulnerability
Advisory: GHSA-jx7c-7mj5-9438
Aliases: CVE-2021-43980
Published: 2022-09-29T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
TensorFlow vulnerable to `CHECK` failures in `AvgPool3DGrad`
Advisory: GHSA-wxjj-cgcx-r3vq
Aliases: CVE-2022-35959
Published: 2022-09-16T22:11:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of `AvgPool3DGradOp` does not fully validate the input `orig_input_shape`. This results in an overflow that results in a  `CHECK` failure which can be used to trigger a denial of service attack:
```python
import tensorflow as tf

ksize = [1, 1, 1, 1, 1]
strides = [1, 1, 1, 1, 1]
padding = "SAME"
data_format = "NDHWC"
orig_input_shape = tf.constant(1879048192, shape=[5], dtype=tf.int32)
grad = tf.constant(1, shape=[1,3,2,4,2], dtype=tf.float32)
tf.raw_ops.AvgPool3DGrad(orig_input_shape=orig_input_shape, grad=grad, ksize=ksize, strides=strides, padding=padding, data_format=data_format)
```

### Patches
We have patched the issue in GitHub commit [9178ac9d6389bdc54638ab913ea0e419234d14eb](https://github.com/tensorflow/tensorflow/commit/9178ac9d6389bdc54638ab913ea0e419234d14eb).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.
Vuetify Cross-site Scripting vulnerability
Advisory: GHSA-q4q5-c5cv-2p68
Aliases: CVE-2022-25873
Published: 2022-09-19T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder
Advisory: GHSA-w4pr-4vjg-hffh
Aliases: CVE-2022-39254
Published: 2022-09-30T22:56:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

When matrix-nio before 0.20 requests a room key from our devices, it correctly accepts key forwards only if they are a response to a previous request. However, it doesn't check that the device that responded matches the device the key was requested from.

This allows a malicious homeserver to insert room keys of questionable validity into the key store in some situations, potentially assisting in an impersonation attack.

### For more information
If you have any questions or comments about this advisory, e-mail us at [poljar@termina.org.uk](mailto:poljar@termina.org.uk).
XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form
Advisory: GHSA-9r9j-57rf-f6vj
Aliases: CVE-2022-36097
Published: 2022-09-16T17:39:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

### Impact

It's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the corresponding attachment.

For example, an attachment with name `><img src=1 onerror=alert(1)>.jpg` will execute the alert.

### Patches
This issue has been patched in XWiki 14.4RC1.

### Workarounds
It is possible to fix the vulnerability by copying [moveStep1.vm](https://raw.githubusercontent.com/xwiki/xwiki-platform/xwiki-platform-14.0-rc-1/xwiki-platform-core/xwiki-platform-attachment/xwiki-platform-attachment-api/src/main/resources/templates/attachment/moveStep1.vm) to `webapp/xwiki/templates/moveStep1.vm` and replace 

```
#set($titleToDisplay = $services.localization.render('attachment.move.title', 
  [$attachment.name, $escapetool.xml($doc.plainTitle), $doc.getURL()]))
```

by 

```
#set($titleToDisplay = $services.localization.render('attachment.move.title', [
  $escapetool.xml($attachment.name), 
  $escapetool.xml($doc.plainTitle), 
  $escapetool.xml($doc.getURL())
]))
```

See the corresponding [patch](https://github.com/xwiki/xwiki-platform/commit/fbc4bfbae4f6ce8109addb281de86a03acdb9277).

### References

- https://jira.xwiki.org/browse/XWIKI-19667

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
- Email us at [Security Mailing List](mailto:security@xwiki.org)
Dendrite signature checks not applied to some retrieved missing events
Advisory: GHSA-pfw4-xjgm-267c
Aliases: CVE-2022-39200
Published: 2022-09-15T03:28:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

### Impact

Events retrieved from a remote homeserver using `/get_missing_events` did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint.

Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified.

Homeservers that have federation disabled are not vulnerable.

### Patches

The problem has been fixed in Dendrite 0.9.8.

### Workarounds

There are no workarounds.

### Special thanks

Tulir Asokan, who spotted the issue originally.
Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type
Advisory: GHSA-4v5m-vwvp-p7w8
Aliases: CVE-2022-38916
Published: 2022-09-21T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files
XWiki Platform Security Parent POM vulnerable to overwriting of security rules of a page with a final page having the same reference
Advisory: GHSA-gg53-wf5x-r3r6
Aliases: CVE-2022-31167
Published: 2022-09-20T21:18:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

### Impact

A bug in the security cache is storing rules associated to document Page1.Page2 and space Page1.Page2 in the same cache entry.

That means that it's possible to overwrite the rights of a space or a document by creating the page of the space with the same name and checking the right of the new one first so that they end up in the security cache and are used for the other too.

### Patches

The problem has been patched in XWiki 12.10.11, 13.10.1, 13.4.6.

### Workarounds

No workaround other than patching.

### References

https://jira.xwiki.org/browse/XWIKI-14075
https://jira.xwiki.org/browse/XWIKI-18983

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
TensorFlow vulnerable to segfault in `SparseBincount`
Advisory: GHSA-397c-5g2j-qxpv
Aliases: CVE-2022-35982
Published: 2022-09-16T22:27:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
If `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a valid sparse tensor, it results in a segfault that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
binary_output = True
indices = tf.random.uniform(shape=[], minval=-10000, maxval=10000, dtype=tf.int64, seed=-1288)
values = tf.random.uniform(shape=[], minval=-10000, maxval=10000, dtype=tf.int32, seed=-9366)
dense_shape = tf.random.uniform(shape=[0], minval=-10000, maxval=10000, dtype=tf.int64, seed=-9878)
size = tf.random.uniform(shape=[], minval=-10000, maxval=10000, dtype=tf.int32, seed=-10000)
weights = tf.random.uniform(shape=[], minval=-10000, maxval=10000, dtype=tf.float32, seed=-10000)
tf.raw_ops.SparseBincount(indices=indices, values=values, dense_shape=dense_shape, size=size, weights=weights, binary_output=binary_output)
```

### Patches
We have patched the issue in GitHub commit [40adbe4dd15b582b0210dfbf40c243a62f5119fa](https://github.com/tensorflow/tensorflow/commit/40adbe4dd15b582b0210dfbf40c243a62f5119fa).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Di Jin, Secure Systems Labs, Brown University
Brokercap Bifrost subject to authentication bypass when using HTTP basic authentication
Advisory: GHSA-p6fh-xc6r-g5hw
Aliases: CVE-2022-39219
Published: 2022-09-27T15:45:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to authentication bypass when using HTTP basic authentication. This may allow group members who only have read permissions to write requests when they are normally forbidden from doing so. Version 1.8.7-release contains a patch. There are currently no known workarounds.
TensorFlow vulnerable to floating point exception in `Conv2D`
Advisory: GHSA-q5jv-m6qw-5g37
Aliases: CVE-2022-35996
Published: 2022-09-16T22:11:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
If `Conv2D` is given empty `input` and the `filter` and `padding` sizes are valid, the output is all-zeros. This causes division-by-zero floating point exceptions that can be used to trigger a denial of service attack.
```python
import tensorflow as tf
import numpy as np
with tf.device("CPU"): # also can be triggerred on GPU
   input = np.ones([1, 0, 2, 1])
   filter = np.ones([1, 1, 1, 1])
   strides = ([1, 1, 1, 1])
   padding = "EXPLICIT"
   explicit_paddings = [0 , 0, 1, 1, 1, 1, 0, 0]
   data_format = "NHWC"
   res = tf.raw_ops.Conv2D(
       input=input,
       filter=filter,
       strides=strides,
       padding=padding,
        explicit_paddings=explicit_paddings,
       data_format=data_format,
  )
```

### Patches
We have patched the issue in GitHub commit [611d80db29dd7b0cfb755772c69d60ae5bca05f9](https://github.com/tensorflow/tensorflow/commit/611d80db29dd7b0cfb755772c69d60ae5bca05f9).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Jingyi Shi.
CRI-O incorrect handling of supplementary groups may lead to sensitive information disclosure
Advisory: GHSA-phjr-8j92-w5v7
Aliases: CVE-2022-2995
Published: 2022-09-20T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
Pageflow vulnerable to sensitive user data extraction via Ransack query injection
Advisory: GHSA-wrrw-crp8-979q
Published: 2022-09-15T03:21:00Z

### Impact

The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to.

Pageflow uses the `ActiveAdmin` Ruby library to provide some management features to its users. `ActiveAdmin` relies on the `Ransack` library to implement search functionality. In its default configuration, `Ransack` will allow for query conditions based on properties of associated database objects [1]. The `*_starts_with`, `*_ends_with` or `*_contains` search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force.

[1] https://activerecord-hackery.github.io/ransack/going-further/associations/
[2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/

### Mitigation

Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem.

### For more information

If you have any questions or comments about this advisory email us at info(at)codevise.de 

### Credits

[Positive Security](https://positive.security/)
LIEF contains a segmentation violation
Advisory: GHSA-2p5h-hpj4-fxgg
Aliases: CVE-2022-38497
Published: 2022-09-14T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

LIEF commit 365a16a was discovered to contain a segmentation violation via the component `CoreFile.tcc:69`. A patch is available at commit ca938740264f1fcb18f91cba8e4039c518ecb75b.
TensorFlow vulnerable to `CHECK` failures in `UnbatchGradOp`
Advisory: GHSA-h5vq-gw2c-pq47
Aliases: CVE-2022-35952
Published: 2022-09-16T22:12:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The [`UnbatchGradOp`](https://github.com/tensorflow/tensorflow/blob/769eddaf479c8debead9a59a72617d6ed6f0fe10/tensorflow/core/kernels/batch_kernels.cc#L891) function takes an argument `id` that is assumed to be a scalar. A nonscalar `id` can trigger a `CHECK` failure and crash the program.
```python
import numpy as np
import tensorflow as tf

# `id` is not scalar
tf.raw_ops.UnbatchGrad(original_input= tf.constant([1]),batch_index=tf.constant([[0,0,0 ], ], dtype=tf.int64),grad=tf.constant([1,]),id=tf.constant([1,1,], dtype=tf.int64))
```
It also requires its argument `batch_index` to contain three times the number of elements as indicated in its `batch_index.dim_size(0)`. An incorrect `batch_index` can trigger a `CHECK` failure and crash the program.
```python
import numpy as np
import tensorflow as tf

# batch_index's size is not 3
tf.raw_ops.UnbatchGrad(original_input= tf.constant([1]),batch_index=tf.constant([[0,0], ], dtype=tf.int64),grad=tf.constant([1,]),id=tf.constant([1,], dtype=tf.int64))
```

### Patches
We have patched the issue in GitHub commit [5f945fc6409a3c1e90d6970c9292f805f6e6ddf2](https://github.com/tensorflow/tensorflow/commit/5f945fc6409a3c1e90d6970c9292f805f6e6ddf2).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Kang Hong Jin from Singapore Management University and 刘力源 from the Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology
rdiffweb's unlimited username field length can lead to DoS
Advisory: GHSA-5v95-j4rr-6f3c
Aliases: CVE-2022-3290
Published: 2022-09-27T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

rdiffweb prior to 2.4.8 is vulnerable to a potential Dos attack via an unlimited length "username" field. This can result in excess memory consumption, or memory corruption, leading to a Denial of Service (DoS). This issue is patched in version 2.4.8. There are no known workarounds.
TensorFlow vulnerable to Int overflow in `RaggedRangeOp`
Advisory: GHSA-x989-q2pq-4q5x
Aliases: CVE-2022-35940
Published: 2022-09-16T22:12:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The [`RaggedRangOp`](https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/kernels/ragged_range_op.cc#L74-L88) function takes an argument `limits` that is eventually used to construct a `TensorShape` as an `int64`. If `limits` is a very large float, it can overflow when converted to an `int64`. This triggers an `InvalidArgument` but also throws an abort signal that crashes the program.
```python
import tensorflow as tf
tf.raw_ops.RaggedRange(starts=[1.1,0.1],limits=[10.0,1e20],deltas=[1,1])
```

### Patches
We have patched the issue in GitHub commit [37cefa91bee4eace55715eeef43720b958a01192](https://github.com/tensorflow/tensorflow/commit/37cefa91bee4eace55715eeef43720b958a01192).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Jingyi Shi.
Nepxion Discovery vulnerable to potential Information Disclosure due to  Server-Side Request Forgery 
Advisory: GHSA-hhxh-qphc-v423
Aliases: CVE-2022-23464
Published: 2022-09-25T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTemplate’s getForEntity to retrieve the contents of a URL containing user-controlled input, potentially resulting in Information Disclosure. There is no patch available for this issue at time of publication. There are no known workarounds.
rdiffweb vulnerable to account access via session fixation
Advisory: GHSA-j3q4-gmj4-mj95
Aliases: CVE-2022-3269
Published: 2022-09-25T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

rdiffweb prior to 2.4.7 fails to invalidate session cookies on logout, leading to session fixation and allowing an attacker to access a users account. After logging in and logging out, the application continues to use the preauthentication cookies. The cookies remain the same after closing the browser and after password reset. The same cookies are reassigned for additional user logins which can lead to session fixation. An attacker can gain unauthorized access to the account of users who are using the same browser as long as a single session cookie persists on that browser once the attacker obtains a session cookie through another attack. This issue is patched in version 2.4.7. There are no known workarounds.
TensorFlow vulnerable to `CHECK` fail in `RaggedTensorToVariant`
Advisory: GHSA-m6cv-4fmf-66xf
Aliases: CVE-2022-36018
Published: 2022-09-16T21:14:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack.
```python
import tensorflow as tf

batched_input = True
rt_nested_splits = tf.constant([0,32,64], shape=[3], dtype=tf.int64)
rt_dense_values = tf.constant([0,32,64], shape=[3], dtype=tf.int64)
tf.raw_ops.RaggedTensorToVariant(rt_nested_splits=rt_nested_splits, rt_dense_values=rt_dense_values, batched_input=batched_input)
```

### Patches
We have patched the issue in GitHub commit [88f93dfe691563baa4ae1e80ccde2d5c7a143821](https://github.com/tensorflow/tensorflow/commit/88f93dfe691563baa4ae1e80ccde2d5c7a143821).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.
Missing permission checks in Jenkins CONS3RT Plugin allow enumerating credentials IDs
Advisory: GHSA-p37p-wg92-2fc4
Aliases: CVE-2022-41252
Published: 2022-09-22T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CONS3RT Plugin 1.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Advisory: GHSA-8qv5-68g4-248j
Aliases: CVE-2022-36944
Published: 2022-09-25T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with LazyList object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.
Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack
Advisory: GHSA-fj2m-w3wv-x9pr
Aliases: CVE-2022-39135
Published: 2022-09-12T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Calcite prior to version 1.32.0 the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, which makes them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three) or MySQL dialect (the last one), is affected by this vulnerability (the extent of it will depend on the user under which the application is running). From Apache Calcite 1.32.0 onwards, Document Type Declarations and XML External Entity resolution are disabled on the impacted operators.
rdiffweb vulnerable to password complexity bypass leading to weak passwords
Advisory: GHSA-8wxf-c45w-g66g
Aliases: CVE-2022-3326
Published: 2022-09-30T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

ikus060/rdiffweb prior to 2.4.9 allows a user to set there password to all spaces. While rdiffweb has a password policy requiring passwords to be between 8 and 128 characters, it does not validate the password entropy, allowing users to bypass password complexity requirements with weak passwords. This issue has been fixed in version 2.4.9. No workarounds are known to exist.
CSRF vulnerability in Jenkins Security Inspector plugin
Advisory: GHSA-933x-5g7r-773q
Aliases: CVE-2022-41236
Published: 2022-09-22T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Security Inspector Plugin 117.v6eecc36919c2 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to replace the generated report stored in a per-session cache and displayed to authorized users at the `…​/report` URL with a report based on attacker-specified report generation options. This could create confusion in users of the plugin who are expecting to see a different result. A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability for the _Single user, multiple jobs_ report however, there is no fix at this time. Other report types are still affected.
TensorFlow vulnerable to `CHECK` fail in `FakeQuantWithMinMaxVarsPerChannel`
Advisory: GHSA-9j4v-pp28-mxv7
Aliases: CVE-2022-36019
Published: 2022-09-16T21:13:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack.
```python
import tensorflow as tf

num_bits = 8
narrow_range = False
inputs = tf.constant(0, shape=[4], dtype=tf.float32)
min = tf.constant([], shape=[4,0,0], dtype=tf.float32)
max = tf.constant(0, shape=[4], dtype=tf.float32)
tf.raw_ops.FakeQuantWithMinMaxVarsPerChannel(inputs=inputs, min=min, max=max, num_bits=num_bits, narrow_range=narrow_range)
```

### Patches
We have patched the issue in GitHub commit [785d67a78a1d533759fcd2f5e8d6ef778de849e0](https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Neophytos Christou, Secure Systems Labs, Brown University.
Elrond-go has improper initialization
Advisory: GHSA-mv8x-668m-53fg
Aliases: CVE-2022-36061
Published: 2022-09-16T21:21:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
Read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract's B state, the state will be altered for contract B as if the call was not made in the read-only mode. This can lead to some effects not designed by the original smart contracts programmers.

### Patches
Patch v1.3.35 or higher

### Workarounds
No workaround

### References
For future reference and understanding of this issue, anyone can check this integration test https://github.com/ElrondNetwork/elrond-go/blob/8e402fa6d7e91e779980122d3798b2bf50892945/integrationTests/vm/txsFee/asyncESDT_test.go#L452 that proves the fix and prevents a future code regression. 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in elrond-go ([http://github.com/ElrondNetwork/elrond-go/issues](https://github.com/ElrondNetwork/elrond-go/issues))
OctoPrint vulnerable to Unrestricted Upload of File with Dangerous Type
Advisory: GHSA-49wm-4fp6-h59c
Aliases: CVE-2022-2872
Published: 2022-09-22T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

OctoPrint prior to version 1.8.3 is vulnerable to Unrestricted Upload of File with Dangerous Type. Due to misconfiguration in move file functionality, an attacker could easily change the file extension of an uploaded malicious file disguised as a `.gcode` file. Version 1.8.3 contains a patch.
LIEF contains segmentation violation
Advisory: GHSA-x2xx-jw5m-5j86
Aliases: CVE-2022-38307
Published: 2022-09-14T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function `LIEF::MachO::SegmentCommand::file_offset()` at `/MachO/SegmentCommand.cpp`. Commit 7acf0bc4224081d4f425fcc8b2e361b95291d878 contains a patch.
UniSharp Laravel Filemanager directory traversal vulnerability
Advisory: GHSA-5m2h-7rf2-rpx6
Aliases: CVE-2022-40734
Published: 2022-09-15T00:00:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

UniSharp laravel-filemanager (aka Laravel Filemanager) through 2.5.1 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.
TensorFlow vulnerable to null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef`
Advisory: GHSA-828c-5j5q-vrjq
Aliases: CVE-2022-36013
Published: 2022-09-16T22:01:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
When [`mlir::tfg::GraphDefImporter::ConvertNodeDef`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ir/importexport/graphdef_import.cc) tries to convert NodeDefs without an op name, it crashes.
```cpp
Status GraphDefImporter::ConvertNodeDef(OpBuilder &builder, ConversionState &s,
                                        const NodeDef &node) {
  VLOG(4) << "Importing: " << node.name();
  OperationState state(ConvertLocation(node), absl::StrCat("tfg.", node.op()));

  // The GraphImporter does light shape inference, but here we will defer all of
  // that to the shape inference pass.
  const OpDef *op_def;
  const OpRegistrationData *op_reg_data = nullptr;
  if ((op_reg_data = registry_.LookUp(node.op()))) {
    op_def = &op_reg_data->op_def;
  } else {
    auto it = function_op_defs_.find(node.op());
    if (it == function_op_defs_.end())
      return InvalidArgument("Unable to find OpDef for ", node.op());
    op_def = it->second;
  }
```
`node.op().empty()` cannot be empty.


### Patches
We have patched the issue in GitHub commit [a0f0b9a21c9270930457095092f558fbad4c03e5](https://github.com/tensorflow/tensorflow/commit/a0f0b9a21c9270930457095092f558fbad4c03e5).

The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Apache Airflow contains open redirect
Advisory: GHSA-4fg5-j4mm-wfpg
Aliases: CVE-2022-40754
Published: 2022-09-22T22:39:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.
NuProcess vulnerable to command-line injection through insertion of NUL character(s)
Advisory: GHSA-cxgf-v2p8-7ph7
Aliases: CVE-2022-39243
Published: 2022-09-30T04:29:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perform command line injection. Java's ProcessBuilder isn't vulnerable because of a check in ProcessBuilder.start. NuProcess is missing that check.

This vulnerability can only be exploited to inject command line arguments on Linux.
- On macOS, any argument with a NUL character is truncated at that character. This means the malicious arguments are never seen by the started process.
- On Windows, the entire command line is truncated at the first NUL character. This means the malicious arguments, and any intentional arguments provided after them, are never seen by the started process.

### Patches
2.0.5

### Workarounds
Users of the library can sanitize command strings to remove NUL characters prior to passing them to NuProcess for execution.

### References
None.
Quarkus does not terminate HTTP requests header context
Advisory: GHSA-mwhw-6p27-4crc
Aliases: CVE-2022-2466
Published: 2022-09-01T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. This issue was fixed in version 2.10.4Final.
Blink1Control2 uses weak password encryption
Advisory: GHSA-jqhq-pfg3-fg5p
Aliases: CVE-2022-35513
Published: 2022-09-08T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage. Version 2.2.9 fixes the issue.
Netmaker vulnerable to Insufficient Granularity of Access Control
Advisory: GHSA-ggf6-638m-vqmg
Aliases: CVE-2022-36110
Published: 2022-09-15T03:34:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.

In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.

### Patches
This problem has been patched in v0.15.1. To apply:

1. docker-compose down
2. docker pull gravitl/netmaker:v0.15.1
3. docker-compose up -d

### For more information
If you have any questions or comments about this advisory:

Email us at [info@netmaker.io](mailto:info@netmaker.io)
This vulnerability was brought to our attention by @tweidinger
Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-jjch-7g85-4m72
Aliases: CVE-2022-41227
Published: 2022-09-22T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials. Version 4.8.0.130 requires POST requests and Overall/Administer permission for the affected form validation method.
Jodit Editor vulnerable to Cross-site Scripting
Advisory: GHSA-42hx-vrxx-5r6v
Aliases: CVE-2022-23461
Published: 2022-09-25T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds.
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController
Advisory: GHSA-9c6w-55cp-5w25
Aliases: CVE-2022-36107
Published: 2022-09-16T17:15:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0)

### Problem
It has been discovered that the `FileDumpController` (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above.

### Credits
Thanks to Vautia who reported this issue and to TYPO3 core & security team member Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2022-009](https://typo3.org/security/advisory/typo3-core-sa-2022-009)
* [Vulnerability Report on huntr.dev](https://huntr.dev/bounties/51e9b709-193c-41fd-bd4a-833aaca0bd4e/) (embargoed +30 days)
RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency
Advisory: GHSA-vh4m-mw8w-g4w8
Aliases: CVE-2022-2714
Published: 2022-09-07T00:01:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

RosarioSIS Student Information System prior to version 10.1 is vulnerable to Improper Handling of Length Parameter Inconsistency.
Lack of authentication mechanism in Jenkins DotCi Plugin webhook
Advisory: GHSA-9mc6-vgmq-x6xf
Aliases: CVE-2022-41238
Published: 2022-09-22T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

DotCi Plugin provides a webhook endpoint at `/githook/` that can be used to trigger builds of the job for a GitHub repository.

In DotCi Plugin 2.40.00 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.

This plugin has been suspended.
Valine code injection vulnerability
Advisory: GHSA-mcvg-g9wx-v5vx
Aliases: CVE-2022-38545
Published: 2022-09-20T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Valine was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module
Advisory: GHSA-2qf8-h7pr-x2r8
Aliases: CVE-2022-2924
Published: 2022-09-21T00:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the `WidgetsManagement` module. A patch is available at commit b716ecea340783b842498425faa029800bd30420.
Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted
Advisory: GHSA-j7xv-fc46-hgpg
Aliases: CVE-2022-41247
Published: 2022-09-22T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file `BigpandaGlobalNotifier.xml` on the Jenkins controller as part of its configuration. This API key can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.