aswin1906/github-advisory-2022 huggingface dataset:
Arbitrary code execution in Apache Commons Text
Advisory: GHSA-599f-7c49-w659
Aliases: CVE-2022-42889
Published: 2022-10-13T19:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
Webhook endpoint discloses job names to unauthorized users in Jenkins Mercurial Plugin
Advisory: GHSA-j7pg-863g-22p6
Aliases: CVE-2022-43410
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Mercurial Plugin provides a webhook endpoint at `/mercurial/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. This endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. It can be accessed with GET requests and without authentication.

In Mercurial Plugin 1251.va_b_121f184902 and earlier, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Mercurial repository URLs to obtain information about the existence of jobs configured with this Mercurial repository.

Mercurial Plugin 1260.vdfb_723cdcc81 does not provide the names of jobs for which polling is triggered unless the user has the appropriate Item/Read permission.
Potential inter-blockchain communication (IBC) protocol compromise via "Dragonberry" vulnerability in cheqd
Advisory: GHSA-j92c-mmf7-j5x5
Published: 2022-10-18T17:27:36Z

### Impact
This vulnerability affects IBC transfers due to a security vulnerability dubbed "Dragonberry" upstream in [Cosmos SDK](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.45.9). The vulnerability could allow malicious attackers to compromise chain-to-chain IBC transfers.

There is no vulnerability in the DID/resource modules for cheqd-node.

### Patches
Node operators are requested to upgrade to [cheqd-node v0.6.9](https://github.com/cheqd/cheqd-node/releases/tag/0.6.9) as soon as possible. Installation instructions are in the release notes. Please do not install any beta/pre-release versions.

### Workarounds
No. The patch takes effect when more than 2/3rds of the voting power of the cheqd network has upgraded to this patch.

An emergency hotfix was released previously under v0.6.8 but this is now deprecated since [Cosmos SDK v0.45.9](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.45.9) officially fixes this upstream.

### References
- [IBC Security Advisory on "Dragonberry"](https://forum.cosmos.network/t/ibc-security-advisory-dragonberry/7702/1) (and [associated security vulnerability "Dragonfruit"](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-dragonfruit/7614))

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [cheqd-node repo](https://github.com/cheqd/cheqd-node/issues)
* Email us at [security-github@cheqd.io](mailto:security-github@cheqd.io)
* Message us on our community [Slack](http://cheqd.link/join-cheqd-slack) or [Discord](http://cheqd.link/discord-github)
Jenkins Compuware Strobe Measurement Plugin Missing Authorization vulnerability
Advisory: GHSA-hcw3-6459-pwhc
Aliases: CVE-2022-43431
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Dapr Dashboard vulnerable to Incorrect Access Control
Advisory: GHSA-2w6m-q946-399r
Aliases: CVE-2022-38817
Published: 2022-10-04T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
Dolibarr vulnerable to Eval Injection
Advisory: GHSA-7cm4-vmf2-8wf2
Aliases: CVE-2022-40871
Published: 2022-10-12T19:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Dolibarr ERP & CRM <=15.0.3 are vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
Prototype pollution in Snowboard framework
Advisory: GHSA-3fh5-q6fg-w28q
Aliases: CVE-2022-39357
Published: 2022-10-27T18:36:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

The Snowboard framework in affected versions is vulnerable to prototype pollution in the main Snowboard class as well as its plugin loader. 

### Patches

This issue has been patched in https://github.com/wintercms/winter/commit/2a13faf99972e84c9661258f16c4750fa99d29a1 (for 1.2) and https://github.com/wintercms/winter/commit/bce4b59584abf961e9400af3d7a4fd7638e26c7f (for 1.1) and is available with Winter v1.1.10 and v1.2.1.

### Workarounds

If you have not yet upgraded, or are using the 1.1 branch of Winter (1.1.8 or above), you can avoid this issue by following some common security practices for JavaScript, including implementing a [content security policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and auditing your scripts.

The 1.0 branch of Winter is not affected, as it does not contain the Snowboard framework.

### For more information

If you have any questions or comments about this advisory:

- Email us at [hello@wintercms.com](mailto:hello@wintercms.com)
JXPath Out-of-bounds Write vulnerability
Advisory: GHSA-99jc-v8qm-wjvv
Aliases: CVE-2022-40159
Published: 2022-10-06T18:52:04Z
Withdrawn: 2022-11-10T22:39:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

## Withdrawn

This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references.

## Original Description

Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin and Pipeline: Deprecated Groovy Libraries Plugin
Advisory: GHSA-4hjj-9gp7-4frg
Aliases: CVE-2022-43405
Published: 2022-10-19T19:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Pipeline: Groovy Libraries Plugin and older releases of the Pipeline: Deprecated Groovy Libraries Plugin (formerly Pipeline: Shared Groovy Libraries Plugin) define the l`ibrary` Pipeline step, which allows Pipeline authors to dynamically load Pipeline libraries. The return value of this step can be used to instantiate classes defined in the loaded library.

In Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier and in Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier, the `library` step can be used to invoke sandbox-generated synthetic constructors in crafted untrusted libraries and construct any subclassable type. This is similar to SECURITY-582 in the [2017-08-07 security advisory](https://www.jenkins.io/security/advisory/2017-08-07/#multiple-groovy-language-features-allowed-script-security-plugin-sandbox-bypass), but in a different plugin.

This vulnerability allows attackers with permission to define untrusted Pipeline libraries and to define and run sandboxed Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Pipeline: Groovy Libraries Plugin 613.v9c41a_160233f rejects improper calls to sandbox-generated synthetic constructors when using the `library` step.

Pipeline: Deprecated Groovy Libraries Plugin 588.v576c103a_ff86 no longer contains the `library` step. It has been moved into the Pipeline: Groovy Libraries Plugin.
com.amazon.redshift:redshift-jdbc42 vulnerable to remote command execution
Advisory: GHSA-jc69-hjw2-fm86
Aliases: CVE-2022-41828
Published: 2022-10-12T18:23:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L

### Impact

A potential remote command execution issue exists within `redshift-jdbc42` versions 2.1.0.7 and below. When plugins are used with the driver, it instantiates plugin instances based on Java class names provided via the `sslhostnameverifier`, `socketFactory`, `sslfactory`, and `sslpasswordcallback` connection properties. In affected versions, the driver does not verify if a plugin class implements the expected interface before instantiatiaton. This can lead to loading of arbitrary Java classes, which a knowledgeable attacker with control over the JDBC URL can use to achieve remote code execution.

### Patches

This issue is patched within `redshift-jdbc-42` 2.1.0.8 and above.

### Workarounds

We advise customers using plugins to upgrade to `redshift-jdbc42` version 2.1.0.8 or above. There are no known workarounds for this issue.

### For more information

If you have any questions or comments about this advisory, please contact AWS Security at [aws-security@amazon.com](mailto:aws-security@amazon.com).
Backdrop CMS Unrestricted File Upload vulnerability
Advisory: GHSA-33c9-rppf-m7fq
Aliases: CVE-2022-42092
Published: 2022-10-07T18:15:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via `themes` that allows attackers to achieve Remote Code Execution.
Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins
Advisory: GHSA-x5gv-5rqv-654m
Aliases: CVE-2022-43427
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
JXPath Out-of-bounds Write vulnerability
Advisory: GHSA-hw4q-585g-f92x
Aliases: CVE-2022-40161
Published: 2022-10-06T18:52:04Z
Withdrawn: 2022-11-10T22:39:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

## Withdrawn

This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references.

## Original Description

Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
Uncontrolled Resource Consumption in Jackson-databind
Advisory: GHSA-jjjh-jjxp-wpff
Aliases: CVE-2022-42003
Published: 2022-10-03T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In FasterXML jackson-databind 2.4.0-rc1 until 2.12.7.1 and in 2.13.x before 2.13.4.2 resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. This was patched in 2.12.7.1, 2.13.4.2, and 2.14.0.
Apache DolphinScheduler vulnerable to Path Traversal
Advisory: GHSA-vpgf-fgm8-gxr2
Aliases: CVE-2022-26884
Published: 2022-10-28T12:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
Feather-Sequelize cleanQuery method vulnerable to Prototype Pollution
Advisory: GHSA-p5m3-27vh-52j4
Aliases: CVE-2022-29823
Published: 2022-10-26T12:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Feather-Sequelize cleanQuery method uses insecure recursive logic to filter unsupported keys from the query object. This results in a Remote Code Execution (RCE) with privileges of application.
Non-constant time webhook token comparison in Jenkins Generic Webhook Trigger Plugin
Advisory: GHSA-2jxx-2x93-2q2f
Aliases: CVE-2022-43412
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Generic Webhook Trigger Plugin 1.84.1 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token are equal.

This could potentially allow attackers to use statistical methods to obtain a valid webhook token.

Generic Webhook Trigger Plugin 1.84.2 uses a constant-time comparison when validating the webhook token.
Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package
Advisory: GHSA-9rpw-2h95-666c
Aliases: CVE-2022-2529
Published: 2022-10-01T15:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The sflow decode package prior to version 3.4.4 is vulnerable to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service.

### Patches
Version 3.4.4 contains patches fixing this.

### Workarounds
A possible workaround is to not have your goflow collector publicly reachable.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [goflow repo](https://github.com/cloudflare/goflow)
* Email us [netdev[@]cloudflare.com ](mailto:netdev@cloudflare.com)
tiny-csrf has openly visible CSRF tokens
Advisory: GHSA-pj2c-h76w-vv6f
Aliases: CVE-2022-39287
Published: 2022-10-07T21:23:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

### Impact

Weak encryption on CSRF so tokens can be read by malicious attackers. 

### Patches

Problems have been patched as of v1.1.0

### Workarounds

Upgrade to v1.1.0

### References

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html 

### For more information

Submit an issue at [the github repo](https://github.com/valexandersaulys/tiny-csrf)
Content-Security-Policy protection for user content disabled by Jenkins ScreenRecorder Plugin
Advisory: GHSA-cvxj-4745-843x
Aliases: CVE-2022-43433
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins sets the `Content-Security-Policy` header to static files served by Jenkins (specifically `DirectoryBrowserSupport`), such as workspaces, `/userContent`, or archived artifacts, unless a Resource Root URL is specified.

ScreenRecorder Plugin 0.7 and earlier programmatically updates [the Java system property](https://www.jenkins.io/doc/book/managing/system-properties/#hudson-model-directorybrowsersupport-csp) allowing administrators to customize the `Content-Security-Policy` header for static files served by Jenkins to include `media-src: 'self'`. On a Jenkins instance with default configuration, this effectively disables all other directives in the default rule set, including `script-src`. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with [Resource Root URL](https://www.jenkins.io/doc/book/security/user-content/#resource-root-url) configured are unaffected.
@dependencytrack/frontend vulnerable to  Persistent Cross-Site-Scripting via Vulnerability Details
Advisory: GHSA-c33w-pm52-mqvf
Aliases: CVE-2022-39350
Published: 2022-10-25T20:22:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

### Description

Due to the common practice of providing vulnerability details in markdown format, the Dependency-Track frontend renders them using the JavaScript library [Showdown](https://github.com/showdownjs/showdown). Showdown [does not have any XSS countermeasures built in](https://github.com/showdownjs/showdown/wiki/Markdown's-XSS-Vulnerability-(and-how-to-mitigate-it)), and versions before 4.6.1 of the Dependency-Track frontend did not encode or sanitize Showdown's output. This made it possible for arbitrary JavaScript included in vulnerability details via HTML attributes to be executed in context of the frontend.

### Impact

Actors with the `VULNERABILITY_MANAGEMENT` permission can exploit this weakness by creating or editing a custom vulnerability and providing XSS payloads in any of the following fields:

* Description
* Details
* Recommendation
* References

The payload will be executed for users with the `VIEW_PORTFOLIO` permission when browsing to the modified vulnerability's page, for example: 

```
https://dtrack.example.com/vulnerabilities/INTERNAL/INT-jd8u-e8tl-8lwu
```

Alternatively, malicious JavaScript could be introduced via any of the vulnerability databases mirrored by Dependency-Track (NVD, GitHub Advisories, OSV, OSS Index, VulnDB). However, this attack vector is highly unlikely, and the team is not aware of any occurrence of this happening.

> **Note**
> The *Vulnerability Details* element of the *Audit Vulnerabilities* tab in the project view is **not** affected.

### Patches

The issue has been fixed in frontend version 4.6.1.

### Credit

Thanks to GitHub user **Waterstraal** for finding and responsibly disclosing the issue.
Missing permission checks in Jenkins Katalon Plugin allow capturing credentials
Advisory: GHSA-5fvg-h778-jjjx
Aliases: CVE-2022-43417
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Katalon Plugin 1.0.32 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Katalon Plugin 1.0.33 properly performs permission checks when accessing the affected HTTP endpoints.
Content-Security-Policy protection for user content disabled by Jenkins NeuVector Vulnerability Scanner Plugin
Advisory: GHSA-wmfh-h3vm-rcxm
Aliases: CVE-2022-43434
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically `DirectoryBrowserSupport`), such as workspaces, `/userContent`, or archived artifacts, unless a Resource Root URL is specified.

NeuVector Vulnerability Scanner Plugin 1.20 and earlier globally disables the `Content-Security-Policy` header for static files served by Jenkins whenever the 'NeuVector Vulnerability Scanner' build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with [Resource Root URL](https://www.jenkins.io/doc/book/security/user-content/#resource-root-url) configured are unaffected.
Snyk CLI affected by Command Injection vulnerability
Advisory: GHSA-hpqj-7cj6-hfj8
Aliases: CVE-2022-40764
Published: 2022-10-04T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.
ProcessWire vulnerable to Cross-Site Request Forgery
Advisory: GHSA-vpwh-qmwc-2phg
Aliases: CVE-2022-40488
Published: 2022-10-31T19:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).
Uncontrolled Resource Consumption in FasterXML jackson-databind
Advisory: GHSA-rgv9-q543-rqg4
Aliases: CVE-2022-42004
Published: 2022-10-03T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In FasterXML jackson-databind before 2.12.7.1 and in 2.13.x before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
react-native-reanimated vulnerable to ReDoS
Advisory: GHSA-2j79-8pqc-r7x6
Aliases: CVE-2022-24373
Published: 2022-10-01T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package react-native-reanimated before 2.10.0 is vulnerable to Regular Expression Denial of Service (ReDoS) due to improper usage of regular expression in the parser of Colors.js.
css-what vulnerable to ReDoS due to use of insecure regular expression
Advisory: GHSA-p28h-cc7q-c4fg
Aliases: CVE-2022-21222
Published: 2022-10-01T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package css-what before 2.1.3 is vulnerable to Regular Expression Denial of Service (ReDoS) due to the use of insecure regular expression in the `re_attr` variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.
OrchardCore vulnerable to HTML injection
Advisory: GHSA-5gg9-gwj4-mqmj
Aliases: CVE-2022-32173
Published: 2022-10-04T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

OrchardCore versions starting with 1.0.0-rc1-11259 and prior to 1.4.0 are vulnerable to HTML injection. The vulnerability allows an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users. Version 1.4.0 contains a patch.
phpMyFAQ vulnerable to stored Cross-site Scripting
Advisory: GHSA-wr74-2v66-57pp
Aliases: CVE-2022-3765
Published: 2022-10-31T12:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

phpMyFAQ prior to version 3.1.8 is vulnerable to stored Cross-site Scripting.
run-terraform allows for RCE via terraform plan
Advisory: GHSA-f9qj-7gh3-mhj4
Aliases: CVE-2022-39326
Published: 2022-10-19T18:54:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
_What kind of vulnerability is it? Who is impacted?_  
All users of the `run-terraform` reusable workflow from the kartverket/github-workflows repo are affected. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the context of the workflow.

### Patches
_Has the problem been patched? What versions should users upgrade to?_  
Upgrade to at least 2.7.5 to resolve the issue.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_  
Until you are able to upgrade, make sure to review any PRs from exernal users for malicious payloads before allowing them to trigger a build.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [kartverket/github-workflows](https://github.com/kartverket/github-workflows)
Hessian Lite for Apache Dubbo deserialization vulnerability
Advisory: GHSA-5qwq-g2hx-r6f7
Aliases: CVE-2022-39198
Published: 2022-10-19T12:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
Jadx-gui vulnerable to swing HTML Denial of Service (DoS) attack
Advisory: GHSA-3r7j-8mqh-6qhx
Aliases: CVE-2022-39259
Published: 2022-10-20T18:20:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

### Impact
Using jadx-gui to open a special zip file with entry containing HTML sequence like `<html><frame>` will cause interface to get stuck and throw exceptions like:
```
java.lang.RuntimeException: Can't build aframeset, BranchElement(frameset) 1,3
:no ROWS or COLS defined.
	at java.desktop/javax.swing.text.html.HTMLEditorKit$HTMLFactory.create(HTMLEditorKit.java:1387)
	at java.desktop/javax.swing.plaf.basic.BasicHTML$BasicHTMLViewFactory.create(BasicHTML.java:379)
	at java.desktop/javax.swing.text.CompositeView.loadChildren(CompositeView.java:112)
```

### References
https://www.oracle.com/java/technologies/javase/seccodeguide.html

Guideline 3-7 / INJECT-7: Disable HTML display in Swing components:

Many Swing pluggable look-and-feels interpret text in certain components starting with <html> as HTML. If the text is from an untrusted source, an adversary may craft the HTML such that other components appear to be present or to perform inclusion attacks.

To disable the HTML render feature, set the "html.disable" client property of each component to Boolean.TRUE (no other Boolean true instance will do).
```java
label.putClientProperty("html.disable", true);
```
FlyteAdmin's Default OAuth Authorization Server secret must be rotated
Advisory: GHSA-67x4-qr35-qvrm
Aliases: CVE-2022-39273
Published: 2022-10-05T21:26:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
Users who enable the default [Flyte’s authorization server](https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server) without changing the default clientid hashes will be exposed to the public internet.

In an effort to make enabling authentication easier for Flyte administrators, the default configuration for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password.  This password is also set on the default Flyte Propeller configmap in the various Flyte Helm charts.  Users who enable auth but do not override this setting in Flyte Admin’s configuration may unknowingly allow public traffic in by way of this default password with attackers effectively impersonating propeller.  This only applies to users who have not specified the ExternalAuthorizationServer setting.  Using an external auth server automatically turns off this default configuration is not susceptible to this vulnerability.

### Patches
1.1.44

### Workarounds
Users should manually set the staticClients in the selfAuthServer section of their configuration if they intend to rely on Admin’s internal auth server.  

### References
https://github.com/flyteorg/flyteadmin/pull/478
https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Flyte](https://github.com/flyteorg/flyte/issues)
* Email us [here](mailto:admin@flyte.org)
LIEF vulnerable to denial of service through segmentation fault
Advisory: GHSA-rm2x-hgr8-w343
Aliases: CVE-2022-40923
Published: 2022-10-01T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file. A [patch](https://github.com/lief-project/LIEF/commit/24935f654f6df700a9a062298258b9485f584502) is available at commit number 24935f654f6df700a9a062298258b9485f584502.
Jenkins Script Security Plugin sandbox bypass vulnerability
Advisory: GHSA-f6mq-6fx5-w2ch
Aliases: CVE-2022-43403
Published: 2022-10-19T19:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM. Script Security Plugin 1184.v85d16b_d851b_3 intercepts per-element casts when casting array-like values to array types.
rdiffweb does not have a rate limit on incorrect password attempts to prevent brute force attacks
Advisory: GHSA-9g3v-v24q-jj5p
Aliases: CVE-2022-3273
Published: 2022-10-06T18:52:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

rdiffweb prior to 2.5.0a4 does not have a rate limit to prevent attackers attempting brute force attacks to guess passwords. Version 2.5.0a4 limits the number of incorrect password attempts.
Keylime: unhandled exceptions could lead to invalid attestation states
Advisory: GHSA-hff2-x2j9-gxgv
Aliases: CVE-2022-3500
Published: 2022-10-28T19:19:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

This vulnerability creates a false sense of security for keylime users -- i.e. a user could query keylime and conclude that a parcitular node/agent is correctly attested, while attestations are not in fact taking place.

**Short explanation**: the keylime verifier creates periodic reports on the state of each attested agent. The keylime verifier runs a set of python asynchronous processes to challenge attested nodes and create reports on the outcome. 

The vulnerability consists of the above named python asynchronous processes failing silently, i.e. quitting without leaving behind a database entry, raising an error or producing even a mention of an error in a log. The silent failure can be triggered by a small set of transient network failure conditions; recoverable device driver crashes being one such condition we saw in the wild.

### Patches

The problem is fixed in keylime starting with tag 6.5.1

### Workarounds

This [patch](https://github.com/keylime/keylime/pull/1128/files) can be retroactively applied to any running keylime deployment.
Only running verifiers need to be patched.
After the patch is applied, the keylime verifier needs to be restarted.

### References

The problem, as well as the proposed fix, are described in detail [here](https://github.com/keylime/keylime/pull/1128).
Further details about the system where the bug was found, and the conditions in which the bug was found, are available from @galmasi on demand.

### For more information

If you have any questions or comments about this [advisory](https://github.com/keylime/keylime/security/advisories/GHSA-hff2-x2j9-gxgv), please comment at the bottom of the advisory itself.
Missing rate limit on rdiffweb
Advisory: GHSA-x8x2-wc2h-wc48
Aliases: CVE-2022-3439
Published: 2022-10-14T19:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Twisted vulnerable to HTTP Request Smuggling Attacks
Advisory: GHSA-8r99-h8j2-rw64
Published: 2022-10-07T07:31:33Z

### Impact
Twisted Web is vulnerable to request smuggling attacks:

1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response." (Jake Miller of Bishop Fox Security)
2. " When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length." (Jake Miller of Bishop Fox Security)
3. ~"Twisted should not allow BWS between the filed-name and colon." (ZeddYu Lu)~ _closed in 9646_
4. "Two CL header with different values is also not allowed." (ZeddYu Lu)
5. "Only accept identity and chunked Transport-Encoding." (ZeddYu Lu)

### Patches
https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081
https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281

### Workarounds
N/A

### References
https://portswigger.net/web-security/request-smuggling
Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL
Advisory: GHSA-9w4g-fp9h-3q2v
Aliases: CVE-2022-42468
Published: 2022-10-26T19:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Flume’s JMSSource class can be configured with a providerUrl parameter. A JNDI lookup is performed on this name without performing validation. This could result in untrusted data being deserialized, leading to remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed in version 1.11.0.
phpMyFAQ vulnerable to reflected Cross-site Scripting
Advisory: GHSA-mg5h-rhjq-6v84
Aliases: CVE-2022-3766
Published: 2022-10-31T12:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

phpMyFAQ prior to version 3.1.8 is vulnerable to reflected cross-site scripting.
etcd has no minimum password length
Advisory: GHSA-4993-m7g5-r9hh
Aliases: CVE-2020-15115
Published: 2022-10-06T23:14:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

### Vulnerability type
Access Control

### Workarounds
The etcdctl and etcd API do not enforce a specific password length during user creation or user password update operations. [It is the responsibility of the administrator to enforce these requirements](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/authentication.md#notes-on-password-strength).

### Detail
etcd does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users’ passwords with little computational effort.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)
phpMyFAQ contains Weak Password Requirements
Advisory: GHSA-2rr3-rv49-p42f
Aliases: CVE-2022-3754
Published: 2022-10-29T19:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

phpMyFAQ prior to version 3.1.8 has Weak Password Requirements. Version 3.1.8 introduces an eight-character minimum password length.
Jenkins Pipeline: Stage View Plugin allows CSRF protection bypass of any target URL in Jenkins
Advisory: GHSA-g975-f26h-93g8
Aliases: CVE-2022-43408
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of `input` steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify `input` step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins. Pipeline: Stage View Plugin 2.27 correctly encodes the ID of input steps when using it to generate URLs to proceed or abort Pipeline builds.
.NET Denial of Service Vulnerability
Advisory: GHSA-cw98-9j8w-wxv9
Aliases: CVE-2022-24464
Published: 2022-10-21T20:32:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0, .NET 5.0, and .NET CORE 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

Microsoft is aware of a Denial of Service vulnerability, which exists in .NET 6.0, .NET 5.0, and .NET CORE 3.1 when parsing certain types of http form requests.

### Affected Software

* Any .NET 6.0 application running on .NET 6.0.2 or lower
* Any .NET 5.0 application running on .NET 5.0.14 or lower
* Any .NET Core 3.1 application running on .NET Core 3.1.22 or lower 

### Patches
To fix the issue, please install the latest version of .NET 6.0 or .NET 5.0 or .NET Core 3.1.. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET  SDKs.

* If you're using .NET Core 6.0, you should download and install Runtime 6.0.3 or SDK 6.0.201 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.

* If you're using .NET 5.0, you should download and install Runtime 5.0.15 or SDK 5.0.406 (for Visual Studio 2019 v16.11) or SDK 5.0.212 (for Visual Studio 2011 v16.9) from https://dotnet.microsoft.com/download/dotnet-core/5.0.

* If you're using .NET Core 3.1, you should download and install Runtime 3.1.23 or SDK 3.1.417 (for Visual Studio 2019 v16.7.26) from https://dotnet.microsoft.com/download/dotnet-core/5.0.
.NET 6.0 and .NET 5.0 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

.NET 6.0 and .NET 5.0 and, .NET Core 3.1 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

#### Other Details

- Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/212
- An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/40598
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/ CVE-2022-24464
XXE vulnerability in Jenkins REPO Plugin
Advisory: GHSA-2w2m-ccf8-57cq
Aliases: CVE-2022-43415
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

REPO Plugin 1.15.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control which `repo` binary is executed on agents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

REPO Plugin 1.16.0 disables external entity resolution for its XML parser.
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication
Advisory: GHSA-gr7w-x2jp-3xgw
Aliases: CVE-2018-21246
Published: 2022-10-06T22:58:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.
Badaso vulnerable to Remote Code Execution via malicious file upload
Advisory: GHSA-fwvc-9xhj-26v5
Aliases: CVE-2022-41711
Published: 2022-10-26T12:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Improper use of metav1.Duration allows for Denial of Service
Advisory: GHSA-f4p5-x4vc-mh4v
Aliases: CVE-2022-39272
Published: 2022-10-19T18:40:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields `.spec.interval` or `.spec.timeout` (and structured variations of these fields), causing the entire object type to stop being processed.

The issue has two root causes: a) the Kubernetes type `metav1.Duration` not being fully compatible with the Go type `time.Duration` as explained on [upstream report](https://github.com/kubernetes/apimachinery/issues/131); b) lack of validation within Flux to restrict allowed values.

### Workarounds

Admission controllers can be employed to restrict the values that can be used for fields `.spec.interval` and `.spec.timeout`, however upgrading to the latest versions is still the recommended mitigation.

### Credits

This issue was reported by Alexander Block (@codablock) through the Flux security mailing list (as [recommended](https://fluxcd.io/security/#report-a-vulnerability)).

### For more information

If you have any questions or comments about this advisory:

- Open an issue in any of the affected repositories.
- Contact us at the CNCF Flux channel.

### References

- https://github.com/kubernetes/apimachinery/issues/131
Jenkins Katalon Plugin vulnerable to Protection Mechanism Failure
Advisory: GHSA-q6f6-6c4p-xph4
Aliases: CVE-2022-43416
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Katalon Plugin 1.0.32 and earlier implements an agent/controller message that does not limit where it can be executed and allows invoking Katalon with configurable arguments, allowing attackers able to control agent processes to invoke Katalon on the Jenkins controller with attacker-controlled version, install location, and arguments, and attackers additionally able to create files on the Jenkins controller (e.g., attackers with Item/Configure permission could archive artifacts) to invoke arbitrary OS commands. Katalon Plugin 1.0.33 changes the message type to controller-to-agent, preventing execution on the controller.
Sandbox bypass vulnerabilities in Jenkins Script Security Plugin and in Pipeline: Groovy Plugin
Advisory: GHSA-7vr5-72w7-q6jc
Aliases: CVE-2022-43401
Published: 2022-10-19T19:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.

Multiple sandbox bypass vulnerabilities exist in Script Security Plugin and Pipeline: Groovy Plugin:

- In Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier and in Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier, various casts performed implicitly by the Groovy language runtime were not intercepted by the sandbox. This includes casts performed when returning values from methods, when assigning local variables, fields, properties, and when defining default arguments for closure, constructor, and method parameters (CVE-2022-43401 in Script Security Plugin and CVE-2022-43402 in Pipeline: Groovy Plugin).
- In Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier, when casting an array-like value to an array type, per-element casts to the component type of the array are not intercepted by the sandbox (CVE-2022-43403).
- In Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier, crafted constructor bodies and calls to sandbox-generated synthetic constructors can be used to construct any subclassable type (due to an incomplete fix for SECURITY-1754 in the [2020-03-09 security advisory](https://www.jenkins.io/security/advisory/2020-03-09/#SECURITY-1754)) (CVE-2022-43404).

These vulnerabilities allow attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.\n\nThese vulnerabilities have been fixed:

- Script Security Plugin 1184.v85d16b_d851b_3 and Pipeline: Groovy Plugin 2803.v1a_f77ffcc773 intercept Groovy casts performed implicitly by the Groovy language runtime (CVE-2022-43401 in Script Security Plugin and CVE-2022-43402 in Pipeline: Groovy Plugin).
- Script Security Plugin 1184.v85d16b_d851b_3 intercepts per-element casts when casting array-like values to array types (CVE-2022-43403).
- Script Security Plugin 1184.v85d16b_d851b_3 rejects improper calls to sandbox-generated synthetic constructors (CVE-2022-43404).

Both plugins, Script Security Plugin and Pipeline: Groovy Plugin must be updated simultaneously. While Script Security Plugin could be updated independently, doing so would cause errors in Pipeline: Groovy Plugin due to an incompatible API change.
etcd's WAL `ReadAll`  method vulnerable to an entry with large index causing panic
Advisory: GHSA-m332-53r6-2w93
Aliases: CVE-2020-15112
Published: 2022-10-06T23:03:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Vulnerability type
Data Validation

### Detail
In the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md)
phpMyFAQ vulnerable to Cross-site Scripting
Advisory: GHSA-6rj8-9cm9-6gff
Aliases: CVE-2022-3608
Published: 2022-10-19T19:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

phpMyFAQ versions 3.1.7 and prior are vulnerable to stored cross-site scripting (XSS). A patch is available on the `main` branch of the repository and anticipated to be part of version 3.2.0-alpha.