aswin1906/github-advisory-2022 huggingface dataset:
Tendermint Core vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-p658-8693-mhvg
Aliases: CVE-2021-21271
Published: 2022-10-07T07:23:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Description 

Tendermint Core v0.34.0 introduced a new way of handling evidence of misbehavior. As part of this, [we added a new `Timestamp` field to `Evidence` structs](https://github.com/tendermint/tendermint/pull/5219). This timestamp would be calculated using the same algorithm that is used when a block is created and proposed. (This algorithm relies on the timestamp of the last commit from this specific block.) 

In Tendermint Core v0.34.0-v0.34.2, the `consensus` reactor is responsible for forming `DuplicateVoteEvidence` whenever double signs are observed. However, the current block is still “in flight” when it is being formed by the `consensus` reactor. It hasn’t been finalized through network consensus yet. This means that different nodes in the network may observe different “last commits” when assigning a timestamp to `DuplicateVoteEvidence.`

In turn, different nodes could form `DuplicateVoteEvidence` objects at the same height but with different timestamps. One `DuplicateVoteEvidence` object (with one timestamp) will then eventually get finalized in the block, but this means that any `DuplicateVoteEvidence` with a different timestamp is considered invalid. Any node that formed invalid `DuplicateVoteEvidence` will continue to propose invalid evidence; its peers may see this, and choose to disconnect from this node. This bug means that double signs are DoS vectors in Tendermint Core v0.34.0-v0.34.2. 

Tendermint Core v0.34.3 is a security release which fixes this bug. As of v0.34.3, `DuplicateVoteEvidence` is no longer formed by the `consensus` reactor; rather, the `consensus` reactor passes the `Vote`s themselves into the `EvidencePool`, which is now responsible for forming `DuplicateVoteEvidence`. The `EvidencePool` has timestamp info that should be consistent across the network, which means that `DuplicateVoteEvidence` formed in this reactor should have consistent timestamps. 

This release changes the API between the `consensus` and `evidence` reactors. 

### Impact

This is a denial-of-service vector which impacts networks running Tendermint Core v0.34.0 - v0.34.2.

### Remediation

This problem has been patched in Tendermint Core v0.34.3. Networks running impacted versions of Tendermint Core should update immediately.

### Workarounds

There are no workarounds, other than upgrading to a patched version of Tendermint Core.

### Credits 

* Crypto.com (@cyril-crypto, @brianatcrypto, @tomtau and  @yihuang) for finding and submitting this vulnerability
* @melekes and @cmwaters for identifying the root cause and patching the problem 

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [tendermint/tendermint](https://github.com/tendermint/tendermint)
* Email us at [security@tendermint.com](mailto:security@tendermint.com)
rdiffweb Path Traversal vulnerability
Advisory: GHSA-hrrm-895h-xh34
Aliases: CVE-2022-3389
Published: 2022-10-06T18:52:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

rdiffweb prior to 2.4.10 is vulnerable to Path Traversal. Version 2.4.10 contains a patch.
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin
Advisory: GHSA-27rf-8mjp-r363
Aliases: CVE-2022-43404
Published: 2022-10-19T19:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.

Multiple sandbox bypass vulnerabilities exist in Script Security Plugin and Pipeline: Groovy Plugin:

- In Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier and in Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier, various casts performed implicitly by the Groovy language runtime were not intercepted by the sandbox. This includes casts performed when returning values from methods, when assigning local variables, fields, properties, and when defining default arguments for closure, constructor, and method parameters (CVE-2022-43401 in Script Security Plugin and CVE-2022-43402 in Pipeline: Groovy Plugin).
- In Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier, when casting an array-like value to an array type, per-element casts to the component type of the array are not intercepted by the sandbox (CVE-2022-43403).
- In Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier, crafted constructor bodies and calls to sandbox-generated synthetic constructors can be used to construct any subclassable type (due to an incomplete fix for SECURITY-1754 in the [2020-03-09 security advisory](https://www.jenkins.io/security/advisory/2020-03-09/#SECURITY-1754)) (CVE-2022-43404).

These vulnerabilities allow attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

These vulnerabilities have been fixed:

- Script Security Plugin 1184.v85d16b_d851b_3 and Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercept Groovy casts performed implicitly by the Groovy language runtime (CVE-2022-43401 in Script Security Plugin and CVE-2022-43402 in Pipeline: Groovy Plugin).
- Script Security Plugin 1184.v85d16b_d851b_3 intercepts per-element casts when casting array-like values to array types (CVE-2022-43403).
- Script Security Plugin 1184.v85d16b_d851b_3 rejects improper calls to sandbox-generated synthetic constructors (CVE-2022-43404).

Both plugins, Script Security Plugin and Pipeline: Groovy Plugin must be updated simultaneously. While Script Security Plugin could be updated independently, doing so would cause errors in Pipeline: Groovy Plugin due to an incompatible API change.
Missing rate limit on rdiffweb
Advisory: GHSA-92gf-p376-6r9r
Aliases: CVE-2022-3456
Published: 2022-10-14T12:00:17Z

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
melisplatform/melis-cms vulnerable to deserialization of untrusted data
Advisory: GHSA-m3m3-6gww-7gj9
Aliases: CVE-2022-39297
Published: 2022-10-11T20:45:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

### Impact

Attackers can deserialize arbitrary data on affected versions of `melisplatform/melis-cms`, and ultimately leads to the execution of arbitrary PHP code on the system. Conducting this attack does not require authentication.

Users should immediately upgrade to `melisplatform/melis-cms` >= 5.0.1.

### Patches

This issue was addressed by restricting allowed classes when deserializing user-controlled data. 

### References

- https://github.com/melisplatform/melis-cms/commit/d124b2474699a679a24ec52620cadceb3d4cec11

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Phoenix before 1.6.14 mishandles check_origin wildcarding
Advisory: GHSA-p8f7-22gq-m7j9
Aliases: CVE-2022-42975
Published: 2022-10-17T12:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
Apache Geode vulnerable to Cross-Site Scripting
Advisory: GHSA-373r-9mg8-3jc4
Aliases: CVE-2022-34870
Published: 2022-10-25T19:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries.
Rdiffweb is missing authentication for critical function
Advisory: GHSA-99j5-fvg3-54pm
Aliases: CVE-2022-3327
Published: 2022-10-20T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Agent-to-controller security bypass vulnerability in Jenkins BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin
Advisory: GHSA-682j-2p53-xp5f
Aliases: CVE-2022-43423
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier implements an agent/controller message that does not limit where it can be executed.

It allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).

BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.13 restricts execution of the agent/controller message to agents.
Cross site scripting in Metro UI
Advisory: GHSA-633r-r4p8-pw3w
Aliases: CVE-2022-41376
Published: 2022-10-11T19:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Metro UI v4.4.0 to v4.5.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function. User input is not properly sanitized before rendering in the `textarea` component.
Markdownify subject to Remote Code Execution via malicious markdown file
Advisory: GHSA-c942-mfmp-p4fh
Aliases: CVE-2022-41709
Published: 2022-10-19T19:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled. There are currently no patched versions and no known workarounds.
Kirby CMS vulnerable to user enumeration in the brute force protection
Advisory: GHSA-c27j-76xg-6x4f
Aliases: CVE-2022-39315
Published: 2022-10-18T21:16:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

### TL;DR

This vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.

----

### Introduction

User enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.

User enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.

### Impact

Kirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automated attacks harder and to avoid leaking whether the user exists. Unfortunately, this random delay was not inserted after the brute force limit was reached.

Because Kirby only tracks failed login attempts per email address for existing users but always tracks failed login attempts per IP address, this behavior could be abused by attackers for user enumeration. For this to work, an attacker would need to create login requests beyond the trials limit (which is 10 by default) from two or more IP addresses. After the trials limit was reached, the login form immediately blocked further requests for existing users, but not for invalid users.

This exploit does not scale to brute force attacks because of the delay during the first 10 requests per user, the faint difference between the responses for valid and invalid users and the fact that code-based logins would send an email for every login attempt, which makes the attack easy to spot. The vulnerability is therefore only relevant for targeted attacks.

### Patches

The problem has been patched in [Kirby 3.5.8.2](https://github.com/getkirby/kirby/releases/tag/3.5.8.2), [Kirby 3.6.6.2](https://github.com/getkirby/kirby/releases/tag/3.6.6.2), [Kirby 3.7.5.1](https://github.com/getkirby/kirby/releases/tag/3.7.5.1) and [Kirby 3.8.1](https://github.com/getkirby/kirby/releases/tag/3.8.1). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

In all of the mentioned releases, we have rewritten the affected code so that the delay is also inserted after the brute force limit is reached.
OpenCRX vulnerable to password enumeration via error messages in password reset
Advisory: GHSA-j5v3-363p-g843
Aliases: CVE-2022-40084
Published: 2022-10-20T19:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid.
DNN vulnerable to Relative Path Traversal
Advisory: GHSA-9w72-2f23-57gm
Aliases: CVE-2022-2922
Published: 2022-10-01T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

DNN (GitHub repository dnnsoftware/dnn.platform) prior to 9.11.0 is vulnerable to Relative Path Traversal. Version 9.11.0 contains a patch for this issue.
rdiffweb allows a new password to be the same as the previous password
Advisory: GHSA-7wr6-fj4x-893v
Aliases: CVE-2022-3376
Published: 2022-10-06T18:52:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

rdiffweb prior to 2.5.0a4 allows users to set their new password to be the same as the old password during a password reset. Version 2.5.0a4 enforces a password policy in which a new password cannot be the same as the old one.
ReDoS in py library when used with subversion 
Advisory: GHSA-w596-4wvx-j9j6
Aliases: CVE-2022-42969
Published: 2022-10-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.

The particular codepath in question is the regular expression at `py._path.svnurl.InfoSvnCommand.lspattern` and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version `7.2.0` which removes their dependency on `py`. Users of `pytest` seeing alerts relating to this advisory may update to version `7.2.0` of `pytest` to resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context.
acryl-datahub missing JWT signature check
Advisory: GHSA-r8gm-v65f-c973
Aliases: CVE-2022-39366
Published: 2022-10-31T22:42:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

# Missing JWT signature check (`GHSL-2022-078`)

The [`StatelessTokenService`](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30) of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the [`parse`](https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134) method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm.

#### Impact

This issue may lead to an authentication bypass.

#### Resources

* [CodeQL: Missing JWT signature check](https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check/)
SIF's Digital Signature Hash Algorithms Not Validated
Advisory: GHSA-m5m3-46gj-wch8
Aliases: CVE-2022-39237
Published: 2022-10-06T19:54:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

### Impact

The `github.com/sylabs/sif/v2/pkg/integrity` package does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures.

### Patches

A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade.

The patch is commit https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa

### Workarounds

Users may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

### References

* [CVE-2004-2761](https://nvd.nist.gov/vuln/detail/cve-2004-2761)
* [CVE-2005-4900](https://nvd.nist.gov/vuln/detail/cve-2005-4900)

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github.com/sylabs/sif](https://github.com/sylabs/sif/issues/new)
* Email us at [security@sylabs.io](mailto:security@sylabs.io)
Content-Security-Policy protection for user content can be disabled in Jenkins 360 FireLine Plugin
Advisory: GHSA-7rrj-hqv6-fvpp
Aliases: CVE-2022-43435
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically `DirectoryBrowserSupport`), such as workspaces, `/userContent`, or archived artifacts, unless a Resource Root URL is specified.

360 FireLine Plugin 1.7.2 and earlier globally disables the `Content-Security-Policy` header for static files served by Jenkins whenever the 'Execute FireLine' build step is executed, if the option 'Open access to HTML with JS or CSS' is checked. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with [Resource Root URL](https://www.jenkins.io/doc/book/security/user-content/#resource-root-url) configured are unaffected.
Apache Isis webconsole module may directly query the database in prototype mode
Advisory: GHSA-998r-j9rx-qm8m
Aliases: CVE-2022-42467
Published: 2022-10-19T12:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly query the database. It was felt that it is safer to require the developer to explicitly enable this capability. As of 2.0.0-M8, this can now be done using the `isis.prototyping.h2-console.web-allow-remote-access` configuration property; the web console will be unavailable without setting this configuration. As an additional safeguard, the new `isis.prototyping.h2-console.generate-random-web-admin-password` configuration parameter (enabled by default) requires that the administrator use a randomly generated password to use the console. The password is printed to the log, as `webAdminPass: xxx` (where `xxx`) is the password. To revert to the original behaviour, the administrator would therefore need to set these configuration parameter: `isis.prototyping.h2-console.web-allow-remote-access=true isis.prototyping.h2-console.generate-random-web-admin-password=false` Note also that the h2 webconsole is never available in production mode, so these safeguards are only to ensure that the webconsole is secured by default also in prototype mode.
Untrusted code execution in Apache XML Graphics Batik
Advisory: GHSA-rwqr-m72q-v6cm
Aliases: CVE-2022-42890
Published: 2022-10-25T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
fastify vulnerable to denial of service via malicious Content-Type
Advisory: GHSA-455w-c45v-86rg
Aliases: CVE-2022-39288
Published: 2022-10-11T13:45:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
An attacker can send an invalid `Content-Type` header that can cause the application to crash, leading to a possible Denial of Service attack. Only the v4.x line is affected.

(This was updated: upon a close inspection, v3.x is not affected after all).

### Patches
Yes, update to `> v4.8.0`.

### Workarounds
You can reject the malicious content types before the body parser enters in action.
```js
  const badNames = Object.getOwnPropertyNames({}.__proto__)
  fastify.addHook('onRequest', async (req, reply) => {
    for (const badName of badNames) {
      if (req.headers['content-type'].indexOf(badName) > -1) {
        reply.code(415)
        throw new Error('Content type not supported')
      }
    }
  })
```

### References

See the HackerOne report [#1715536](https://hackerone.com/bugs?report_id=1715536&subject=fastify)

### For more information
[Fastify security policy](https://github.com/fastify/fastify/security/policy)
MobSF allows attackers to read arbitrary files via a crafted HTTP request
Advisory: GHSA-f42p-vc8p-7x54
Aliases: CVE-2022-41547
Published: 2022-10-18T19:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the `StaticAnalyzer/views.py` script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.
OpenFGA Authorization Bypass via tupleset wildcard
Advisory: GHSA-vj4m-83m8-xpw5
Aliases: CVE-2022-39341
Published: 2022-10-25T20:21:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

### Overview
During our internal security assessment, it was discovered that OpenFGA versions `v0.2.3` and prior are vulnerable to authorization bypass under certain conditions.

### Am I affected?
You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` and you added a tuple with a wildcard (*) assigned to a tupleset relation (the right hand side of a ‘from’ statement).

### How to fix that?
Upgrade to version `v0.2.4`.

### Backward Compatibility
This update is not backward compatible with any authorization model that uses wildcard on a tupleset relation.
Heartex - Label Studio Community Edition vulnerable to SSRF in the Data Import module
Advisory: GHSA-pc6f-259w-w3j6
Aliases: CVE-2022-36551
Published: 2022-10-04T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF. This issue is fixed in version 1.6.0.
Signature bypass via multiple root elements
Advisory: GHSA-m974-647v-whv7
Aliases: CVE-2022-39299
Published: 2022-10-12T22:05:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.

### Patches

Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before v4.0.0-beta.5.

### Workarounds

Disable SAML authentication.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in the [node-saml repo](https://github.com/node-saml/node-saml/discussions)

### Credits

* Felix Wilhelm of Google Project Zero
Jenkins Compuware Topaz for Total Test Plugin vulnerable to Protection Mechanism Failure
Advisory: GHSA-7fvj-g3wp-29g8
Aliases: CVE-2022-43429
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.
TCPDF vulnerable to attackers triggering deserialization of arbitrary data
Advisory: GHSA-5hw4-m7f3-hhx8
Aliases: CVE-2018-17057
Published: 2022-10-06T19:53:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the `phar://` wrapper.
rdiffweb vulnerable to Open Redirect
Advisory: GHSA-8g9m-vv69-7j99
Aliases: CVE-2022-3438
Published: 2022-10-10T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A lack of user input validation leads to an open redirect vulnerability in rdiffweb prior to 2.5.0a4.
rdiffweb's lack of token name length limit can result in DoS or memory corruption
Advisory: GHSA-3fhq-72hw-jqwv
Aliases: CVE-2022-3371
Published: 2022-10-01T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

rdiffweb prior to 2.5.0a3 is vulnerable to Allocation of Resources Without Limits or Throttling. A lack of limit in the length of the `Token name` parameter can result in denial of service or memory corruption. Version 2.5.0a3 fixes this issue.
OpenFGA subject to Information Disclosure via streamed-list-objects endpoint
Advisory: GHSA-95x7-mh78-7w2r
Aliases: CVE-2022-39340
Published: 2022-10-25T20:13:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Overview
During our internal security assessment, it was discovered that `streamed-list-objects` endpoint was not validating the authorization header resulting in the disclosure of objects in the store.

### Am I Affected?
You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior and you are exposing the OpenFGA service to the internet.

### How to fix that?
Upgrade to version `v0.2.4`.

### Backward Compatibility
This update is backward compatible.
Ansible leaks password to logs
Advisory: GHSA-cpx3-93w7-457x
Aliases: CVE-2022-3697
Published: 2022-10-28T19:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A flaw was found in Ansible in the amazon.aws collection when using the `tower_callback` parameter from the `amazon.aws.ec2_instance` module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.
.NET Remote Code Execution Vulnerability
Advisory: GHSA-c6w8-7mp3-34j9
Aliases: CVE-2022-24512
Published: 2022-10-18T21:46:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0, and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A Remote Code Execution vulnerability exists in .NET 6.0, .NET 5.0, and .NET Core 3.1 where a stack buffer overrun occurs in .NET Double Parse routine.

### Patches
* Any .NET 6.0 application running on .NET 6.0.2 or lower
* Any .NET 5.0 application running on .NET 5.0.14 or lower
* Any .NET Core 3.1 application running on .NET Core 3.1.22 or lower

To fix the issue, please install the latest version of .NET 6.0, .NET 5.0, or .NET Core 3.1. If you have installed one or more .NET Core SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET Core SDKs.

* If you're using .NET 6.0, you should download and install Runtime 6.0.3 or SDK 6.0.103 (for Visual Studio 2019 v17.0) or SDK 6.0.201 (for Visual Studio 2019 V17.1) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
* If you're using .NET 5.0, you should download and install Runtime 5.0.15 or SDK 5.0.406 (for Visual Studio 2019 v16.11) or SDK 5.0.212 (for Visual Studio 2019 V16.9) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
* If you're using .NET Core 3.1, you should download and install Runtime 3.1.23 or SDK 3.1.417 (for Visual Studio 2019 v16.7) from https://dotnet.microsoft.com/download/dotnet-core/3.1.
.NET 6.0, .NET 5.0, and .NET Core 3.1 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

### Other Details

- Announcement for this issue can be found at dotnet/announcements#213
- An Issue for this can be found at https://github.com/dotnet/runtime/issues/66348
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24512
Docker Command Escaping in the GitHub Actions Runner
Advisory: GHSA-2c6m-6gqh-6qg3
Aliases: CVE-2022-39321
Published: 2022-10-25T19:54:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered that allows an input to escape the environment variable and modify that docker command invocation directly. Jobs that use [container actions](https://docs.github.com/en/actions/creating-actions/creating-a-docker-container-action), [job containers](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container), or [service containers](https://docs.github.com/en/actions/using-containerized-services/about-service-containers) alongside untrusted user inputs in environment variables may be vulnerable.

### Patches
The Actions Runner has been patched, both on `github.com` and hotfixes for GHES and GHAE customers. Please update to one of the following versions of the runner:
- 2.296.2
- 2.293.1
- 2.289.4
- 2.285.2
- 2.283.4

GHES and GHAE customers may want to patch their instance in order to have their runners automatically upgrade to these new runner versions.

### Workarounds
You may want to consider removing any container actions, job containers, or service containers from your jobs until you are able to upgrade your runner versions.


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the actions runner](https://github.com/actions/runner)
Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)
Advisory: GHSA-hhc4-47rh-cr34
Aliases: CVE-2022-39354
Published: 2022-10-25T22:27:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

A custom stateful precompile can use the `is_static` parameter to determine if the call is executed in a static context (via `STATICCALL`), and thus decide if stateful operations should be done. Previously, the passed `is_static` parameter was incorrect -- it was only set to `true` if the call comes from a **direct** `STATICCALL` opcode. However, once a static call context is entered, it should stay static. 

The issue only impacts custom precompiles that actually uses `is_static`. The maintainers estimate the usage is low. However, for those affected, it can lead to possible incorrect state transitions.

### Patches

PR: https://github.com/rust-blockchain/evm/pull/133
Released in v0.36.0.

Older patch versions can be released on request if anyone needs them. Simply contact @sorpaas by email to request it.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [evm repo](https://github.com/rust-blockchain/evm)
* Email Wei at [wei@that.world](mailto:wei@that.world)
feathers-sequelize vulnerable to SQL injection due to improper parameter filtering
Advisory: GHSA-5hq7-j5wq-p227
Aliases: CVE-2022-29822
Published: 2022-10-26T12:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

feathers-sequelize is vulnerable to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection.
CSRF vulnerability in Jenkins Katalon Plugin allows capturing credentials
Advisory: GHSA-x8j7-vxh9-p67g
Aliases: CVE-2022-43418
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Katalon Plugin 1.0.33 and earlier does not require POST requests for several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.

This vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Katalon Plugin 1.0.34 requires POST requests for the affected HTTP endpoints.
Content-Security-Policy protection for user content disabled by Jenkins XFramium Builder Plugin
Advisory: GHSA-px4x-hjm5-w8x3
Aliases: CVE-2022-43432
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically `DirectoryBrowserSupport`), such as workspaces, `/userContent`, or archived artifacts, unless a Resource Root URL is specified.

XFramium Builder Plugin 1.0.22 and earlier globally disables the `Content-Security-Policy` header for static files served by Jenkins as soon as it is loaded. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with [Resource Root URL](https://www.jenkins.io/doc/book/security/user-content/#resource-root-url) configured are unaffected.
Field-level access-control bypass for multiselect field
Advisory: GHSA-6mhr-52mv-6v6f
Aliases: CVE-2022-39322
Published: 2022-10-18T17:12:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

#### Impact

`@keystone-6/core@2.2.0 || 2.3.0` users who are using the `multiselect` field, and provided field-level access control - are vulnerable to their field-level access control not being used.

List-level access control is **NOT** affected.

Field-level access control for fields other than `multiselect` are **NOT** affected.

Example, **you are vulnerable if** you are using field-level access control on a `multiselect` like the following:
```ts
const yourList = list({
  access: {
    // this is list-level access control, this is NOT impacted
  },
  fields: {
    yourFieldName: multiselect({
      // this is field-level access control, for multiselect fields
      //   this is vulnerable
      access: {
        create: ({ session }) => session?.data.isAdmin,
        update: ({ session }) => session?.data.isAdmin,
      },
      options: [
        { value: 'apples', label: 'Apples' },
        { value: 'oranges', label: 'Oranges' },
      ],
      // ...
    }),
    // ...
  },
  // ...
});
```

#### Mitigation
Please upgrade to `@keystone-6/core >= 2.3.1`, where this vulnerability has been closed.

#### Workarounds
If for some reason you cannot upgrade your dependencies, you should stop using the `multiselect` field.

#### Credits
Thanks to [Marek R](https://github.com/marekryb) for reporting and submitting the pull request to fix this problem.

If you have any questions around this security advisory, please don't hesitate to contact us at [security@keystonejs.com](mailto:security@keystonejs.com), or [open an issue on GitHub](https://github.com/keystonejs/keystone/issues/new/choose).

If you have a security flaw to report for any software in this repository, please see our [SECURITY policy](https://github.com/keystonejs/keystone/blob/main/SECURITY.md).
PHPMailer vulnerable to email header injection
Advisory: GHSA-398j-f7m7-795j
Aliases: CVE-2012-0796
Published: 2022-10-06T21:25:46Z

### Impact
Arbitrary additional email headers can be injected via crafted From or Sender headers.

### Patches
Fixed in 2.2.1

### Workarounds
Filter user-supplied values prior to using them in From or Sender properties.

### References
https://nvd.nist.gov/vuln/detail/CVE-2012-0796

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)
easyii CMS's File Upload Management vulnerable to unrestricted upload
Advisory: GHSA-vqvm-qrwh-69h7
Aliases: CVE-2022-3771
Published: 2022-10-31T19:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initiated remotely.
.NET Denial of Service Vulnerability
Advisory: GHSA-485p-mrj5-8w2v
Aliases: CVE-2022-23267
Published: 2022-10-21T20:50:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A vulnerability exists in .NET 6.0, .NET 5.0 and .NET Core 3.1 where a malicious client can cause a Denial of Service via excess memory allocations through HttpClient.

### Affected software

* Any .NET 6.0 application running on .NET 6.0.4 or earlier.
* Any .NET 5.0 application running .NET 5.0.16 or earlier.
* Any .NET Core 3.1 applicaiton running on .NET Core 3.1.24 or earlier.

### Patches
* If you're using .NET Core 6.0, you should download and install Runtime 6.0.5 or SDK 6.0.105 (for Visual Studio 2022 v17.0) or SDK 6.0.203 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.

* If you're using .NET 5.0, you should download and install Runtime 5.0.17 or SDK 5.0.214 (for Visual Studio 2019 v16.9) or SDK 5.0.408 (for Visual Studio 2011 v16.11) from https://dotnet.microsoft.com/download/dotnet-core/5.0.

* If you're using .NET Core 3.1, you should download and install Runtime 3.1.25 or SDK 3.1.419 (for Visual Studio 2019 v16.9 or Visual Studio 2011 16.11 or Visual Studio 2022 17.0 or Visual Studio 2022 17.1 ) from https://dotnet.microsoft.com/download/dotnet-core/3.1.

.NET 6.0, .NET 5.0 and .NET Core 3.1 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

### Other Details
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/221
An Issue for this can be found at https://github.com/dotnet/runtime/issues/69149
MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-23267
CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin
Advisory: GHSA-g66m-fqxf-3w35
Aliases: CVE-2022-43407
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the `input` step. This ID is used for the URLs that process user interactions for the given `input` step (proceed or abort) and is not correctly encoded.

This allows attackers able to configure Pipelines to have Jenkins build URLs from `input` step IDs that would bypass the CSRF protection of any target URL in Jenkins when the `input` step is interacted with.

Pipeline: Input Step Plugin 456.vd8a_957db_5b_e9 limits the characters that can be used for the ID of `input` steps in Pipelines to alphanumeric characters and URL-safe punctuation. Pipelines with `input` steps having IDs with prohibited characters will fail with an error.

This includes Pipelines that have already been started but not finished before Jenkins is restarted to apply this update.

[Pipeline: Declarative Plugin](https://plugins.jenkins.io/pipeline-model-definition/) provides an `input` directive that is internally using the `input` step, and specifies a non-default ID if not user-defined. Pipeline: Declarative Plugin 2.2114.v2654ca_721309 and earlier may specify values incompatible with this new restriction on legal values: `input` directives in a `stage` use the stage name (which may include prohibited characters) and `input` directives in a `matrix` will use a value generated from the matrix axis values (which always includes prohibited characters). Administrators are advised to update Pipeline: Input Step Plugin and Pipeline: Declarative Plugin at the same time, ideally while no Pipelines are running.
Apache Linkis subject to Remote Code Execution via deserialization
Advisory: GHSA-3f3w-gmqf-4hj3
Aliases: CVE-2022-39944
Published: 2022-10-26T19:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. This issue is patched in version 1.3.0, and users are recommended to upgrade.
AdGuardHome vulnerable to Cross-Site Request Forgery
Advisory: GHSA-mwwc-3jv2-62j3
Aliases: CVE-2022-32175
Published: 2022-10-11T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules.

The file that contains the vulnerable code is no longer present as of v0.108.0-b.16.
OctoRPKI crashes when max iterations is reached
Advisory: GHSA-pmw9-567p-68pc
Aliases: CVE-2022-3616
Published: 2022-10-31T18:45:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter that would cause the program to crash and not finish the validation and thus a denial of service.

### Patches
This issue is fixed in v1.4.4

### Workarounds
None.
Invalid HTTP requests in Reactor Netty HTTP Server may reveal access tokens
Advisory: GHSA-7w4x-4h67-pgmv
Aliases: CVE-2022-31684
Published: 2022-10-20T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may request log headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
Plaintext storage of tokens in pulp_ansible
Advisory: GHSA-qv37-mfjf-42h8
Aliases: CVE-2022-3644
Published: 2022-10-25T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.
Hashicorp Boundary vulnerable to clickjacking
Advisory: GHSA-xqv2-3vvq-qg6r
Aliases: CVE-2022-36182
Published: 2022-10-27T19:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Hashicorp Boundary is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.
conduit-hyper vulnerable to Denial of Service from unchecked request length
Advisory: GHSA-9398-5ghf-7pr6
Aliases: CVE-2022-39294
Published: 2022-10-31T18:44:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Prior to version 0.4.2, `conduit-hyper` did not check any limit on a request's length before calling [`hyper::body::to_bytes`](https://docs.rs/hyper/latest/hyper/body/fn.to_bytes.html). An attacker could send a malicious request with an abnormally large `Content-Length`, which could lead to a panic if memory allocation failed for that request.

In version 0.4.2, `conduit-hyper` sets an internal limit of 128 MiB per request, otherwise returning status 400 ("Bad Request").

This crate is part of the implementation of Rust's [crates.io](https://crates.io/), but that service is not affected due to its existing cloud infrastructure, which already drops such malicious requests. Even with the new limit in place, `conduit-hyper` is not recommended for production use, nor to directly serve the public Internet.

The vulnerability was discovered by Ori Hollander from the JFrog Security Research team.
JXPath Out-of-bounds Write vulnerability
Advisory: GHSA-mqxp-cjr9-c5jm
Aliases: CVE-2022-40160
Published: 2022-10-06T18:52:04Z
Withdrawn: 2022-11-16T21:12:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

## Withdrawn

This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references.

## Original Description

Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
ProcessWire vulnerable to Cross-site Scripting
Advisory: GHSA-8g35-prrr-gxxf
Aliases: CVE-2022-40487
Published: 2022-10-31T19:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.