aswin1906/github-advisory-2022 huggingface dataset:
opcua Vulnerable to Out-of-bounds Write
Advisory: GHSA-hgxq-hcrm-c5pm
Aliases: CVE-2022-25903
Published: 2022-08-25T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package opcua from 0.0.0 until 0.11.0 is vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message size is less than the maximum allowed.
OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
Advisory: GHSA-9j3m-g383-29qr
Aliases: CVE-2022-35916
Published: 2022-08-14T00:25:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact

Contracts using the cross chain utilies for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cross chain calls, even though they are not started on L1. This is assessed as low severity because any action taken by an EOA on the contract could also be taken by the EOA through the bridge if the issue was not present.

### Patches

This issue has been patched in v4.7.2.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3578

### For more information

If you have any questions or comments about this advisory, or need assistance deploying a fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution
Advisory: GHSA-7qqq-gh2f-wq76
Aliases: CVE-2022-25907
Published: 2022-08-10T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package ts-deepmerge before version 2.0.2 is vulnerable to Prototype Pollution due to missing sanitization of the `merge` function.
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
Advisory: GHSA-qpq9-jpv4-6gwr
Aliases: CVE-2021-3632
Published: 2022-08-27T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
django-sendfile2 before 0.7.0 contains reflected file download vulnerability
Advisory: GHSA-pcjh-6r5h-r92r
Published: 2022-08-11T18:12:35Z

Similar to CVE-2022-36359 for Django, django-sendfile2 did not protect against a reflected file download attack in version 0.6.1 and earlier. If the file name used by django-sendfile2 was derived from user input, then it would be possible to perform a such an attack. A new version of django-sendfile2 will be released. Either download django-sendfile2 0.7.0 as a workaround or sanitize user input yourself, using Django's patch as a template: https://github.com/django/django/commit/bd062445cffd3f6cc6dcd20d13e2abed818fa173
tower-http's improper validation of Windows paths could lead to directory traversal attack
Advisory: GHSA-qrqq-9c63-xfrg
Published: 2022-08-11T15:36:42Z

`tower_http::services::fs::ServeDir` didn't correctly validate Windows paths, meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

See [tower-http#204] for more details.

[tower-http#204]: https://github.com/tower-rs/tower-http/pull/204
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
Advisory: GHSA-rvgm-35jw-q628
Aliases: CVE-2022-36036
Published: 2022-08-31T22:26:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

### Impact

Arbitary javascript injection

Modify any mermaid code blocks with the following code and the code inside will execute when the component is loaded by MDXjs

```
` + (function () {
  // Put Javascript code here
  return ''
}()) + `
```

The block below shows a valid mermaid code block

````md
```mermaid
graph TD;
    A-->B;
    A-->C;
    B-->D;
    C-->D;
```
````

The same block but with the exploit added

````md
```mermaid
` + (function () {
  alert('vulnerable')
  return ''
}()) + `
graph TD;
    A-->B;
    A-->C;
    B-->D;
    C-->D;
```
````

### Patches
1.3.0 and 2.0.0-rc2

### Workarounds
None known
Drupal core Information Disclosure vulnerability
Advisory: GHSA-xh3v-6f9j-wxw3
Aliases: CVE-2022-25275
Published: 2022-08-06T05:31:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system.

Access to a non-public file is checked only if it is stored in the "private" file system. However, some contributed modules provide additional file systems, or schemes, which may lead to this vulnerability.

This vulnerability is mitigated by the fact that it only applies when the site sets (Drupal 9) `$config['image.settings']['allow_insecure_derivatives']` or (Drupal 7) `$conf['image_allow_insecure_derivatives']` to TRUE. The recommended and default setting is FALSE, and Drupal core does not provide a way to change that in the admin UI.

Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing files or image styles after updating.
Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type
Advisory: GHSA-f772-66g8-q5h3
Aliases: CVE-2022-35948
Published: 2022-08-18T19:02:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact

`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header.

Example:

```
import { request } from 'undici'

const unsanitizedContentTypeInput =  'application/json\r\n\r\nGET /foo2 HTTP/1.1'

await request('http://localhost:3000, {
    method: 'GET',
    headers: {
      'content-type': unsanitizedContentTypeInput
    },
})
```

The above snippet will perform two requests in a single `request` API call:

1) `http://localhost:3000/`
2) `http://localhost:3000/foo2`

### Patches

This issue was patched in Undici v5.8.1

### Workarounds

Sanitize input when sending content-type headers using user input.

## For more information
If you have any questions or comments about this advisory:

- Open an issue in [undici repository](https://github.com/nodejs/undici/issues)
- To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document
ansible-runner 2.0.0 vulnerable to Race Condition
Advisory: GHSA-772j-xvf9-qpf5
Aliases: CVE-2021-3702
Published: 2022-08-24T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.
Improper Privilege Management in com.xuxueli:xxl-job
Advisory: GHSA-7qq9-9g2w-56f9
Aliases: CVE-2022-36157
Published: 2022-08-20T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.
Mingsoft MCMS SQL injection vulnerability in /mdiy/model/delete URI via models List
Advisory: GHSA-w3rc-2whg-w934
Aliases: CVE-2022-36599
Published: 2022-08-17T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.
HashiCorp Consul Template could reveal Vault secret contents in error messages
Advisory: GHSA-8449-7gc2-pwrp
Aliases: CVE-2022-38149
Published: 2022-08-18T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In HashiCorp Consul Template through version 0.29.1, invalid templates could inadvertently reveal the contents of Vault secret in errors returned by the `*template.Template.Execute 5` method, when given a template using Vault secret contents incorrectly. This method has been updated to redact Vault secrets when creating an error string, making it safe to log the error.. This issue was fixed in version 0.29.2.
Unexpected server crash in Next.js
Advisory: GHSA-wff4-fpwg-qqv3
Aliases: CVE-2022-36046
Published: 2022-08-30T20:38:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact

When specific requests are made to the Next.js server it can cause an `unhandledRejection` in the server which can crash the process to exit in specific Node.js versions with strict `unhandledRejection` handling. 

- Affected: All of the following must be true to be affected by this CVE
  - Node.js version above v15.0.0 being used with strict `unhandledRejection` exiting
  - Next.js version v12.2.3
  - Using next start or a [custom server](https://nextjs.org/docs/advanced-features/custom-server)
 
- Not affected: Deployments on Vercel ([vercel.com](https://vercel.com/)) are not affected along with similar environments where `next-server` isn't being shared across requests.

### Patches
https://github.com/vercel/next.js/releases/tag/v12.2.4
Unverified Password Change in OctoPrint
Advisory: GHSA-39gf-864w-pxw4
Aliases: CVE-2022-2930
Published: 2022-08-23T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances.
node-fetch Inefficient Regular Expression Complexity 
Advisory: GHSA-vp56-6g26-6827
Aliases: CVE-2022-2596
Published: 2022-08-02T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

[node-fetch](https://www.npmjs.com/package/node-fetch) is a light-weight module that brings window.fetch to node.js.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `isOriginPotentiallyTrustworthy()` function in `referrer.js`, when processing a URL string with alternating letters and periods, such as `'http://' + 'a.a.'.repeat(i) + 'a'`.
heroku-env susceptible to command injection
Advisory: GHSA-jp45-65jw-94mj
Aliases: CVE-2020-28437
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
Improper token validation leading to code execution in Teleport
Advisory: GHSA-6xf3-5hp7-xqqg
Aliases: CVE-2022-36633
Published: 2022-08-25T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.
Apache Hadoop argument injection vulnerability
Advisory: GHSA-8wm5-8h9c-47pc
Aliases: CVE-2022-25168
Published: 2022-08-05T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).
Cross-site scripting from dynamic options in the multiselect field
Advisory: GHSA-3f89-869f-5w76
Aliases: CVE-2022-36037
Published: 2022-08-29T17:34:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

### Introduction

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

### Impact

The multiselect field allows to select tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value.

This allowed **attackers with influence on the options source** (e.g. content of sibling pages or an API endpoint) to inject HTML code. If a page in the Panel that uses the manipulated multiselect options was visited by a victim and the victim opened the autocomplete dropdown, the victim's browser will then have rendered this malicious HTML code.

You are *not* affected by this vulnerability if you don't use the multiselect field or only use it with options that cannot be manipulated by attackers.

### Patches

The problem has been patched in [Kirby 3.5.8.1](https://github.com/getkirby/kirby/releases/tag/3.5.8.1). Please update to this or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

### Workarounds

We recommend to update to the patch release. If you cannot update immediately, you can work around the issue by disabling the multiselect field. This can be done by uncommenting this field from all your blueprints.
Directus vulnerable to unhandled exception on illegal filename_disk value
Advisory: GHSA-77qm-wvqq-fg79
Aliases: CVE-2022-36031
Published: 2022-08-30T20:18:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The Directus process can be aborted by having an authorized user update the `filename_disk` value to a folder and accessing that file through the `/assets` endpoint. 

The vulnerability is patched and released in v9.15.0.

You can prevent this problem by making sure no (untrusted) non-admin users have permissions to update the `filename_disk` field on `directus_files`.

### For more information

If you have any questions or comments about this advisory:
* Open a Discussion in [directus/directus](https://github.com/directus/directus/discussions)
* Email us at [security@directus.io](mailto:security@directus.io)

### Credits

This vulnerability was first discovered and reported by Witold Gorecki.
node-opcua DoS vulnerability via message with memory allocation that exceeds v8's memory limit
Advisory: GHSA-qpgc-xh7j-52q8
Aliases: CVE-2022-25231
Published: 2022-08-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit.
mz-avro's incorrect use of `set_len` allows for un-initialized memory
Advisory: GHSA-jwh2-vrr9-vcp2
Published: 2022-08-30T19:53:54Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` 
implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure)
and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke
undefined behavior.

Note: there is only UB in the case where a user provides a struct whose `Read`
implementation inspects the buffer passed to `read_exact` before writing to it.
This is an unidiomatic (albeit possible) `Read` implementation.

See https://github.com/MaterializeInc/materialize/issues/8669 for details.
Path Traversal in Gravitee API Management 
Advisory: GHSA-xc4w-28g8-vqm5
Aliases: CVE-2019-25075
Published: 2022-08-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request.
Moodle reflected XSS Vulnerability
Advisory: GHSA-fcpw-vqh5-6qwj
Aliases: CVE-2020-14320
Published: 2022-08-17T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.
Keycloak user may register themselves with same email ID of any existing user
Advisory: GHSA-j9xq-j329-2xvg
Aliases: CVE-2021-3754
Published: 2022-08-27T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
Regular expression denial of service in eth-account
Advisory: GHSA-v65g-f3cj-fjp4
Aliases: CVE-2022-1930
Published: 2022-08-23T00:00:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method
exceedone/exment and exceedone/laravel-admin SQL Injection vulnerability
Advisory: GHSA-p74q-2pf8-j5jx
Aliases: CVE-2022-37333
Published: 2022-08-25T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows remote authenticated attackers to execute arbitrary SQL commands.
`temporary` makes use of uninitialized memory
Advisory: GHSA-2jq9-6xx7-3h29
Published: 2022-08-11T18:10:52Z

Uninitialized memory is used as a RNG seed in temporary. This has been resolved in the 0.6.4 release. The crate is not intended to be used outside of a testing environment. For a general purpose crate to create temporary directories, [`tempfile`](https://crates.io/crates/tempfile) is an alternative for this crate.
exotel-py 0.1.6 includes code execution backdoor inserted by a third party
Advisory: GHSA-cv6j-9835-p7fh
Aliases: CVE-2022-38792
Published: 2022-08-28T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party. Users should downgrade to version 0.1.5 to avoid the problem.
rocksdb vulnerable to out-of-bounds read
Advisory: GHSA-xpp3-xrff-w6rh
Published: 2022-08-12T15:31:10Z

Affected versions of this crate called the RocksDB C API
`rocksdb_open_column_families_with_ttl()` with a pointer to a single integer
TTL value, but one TTL value for each column family is expected.

This is only relevant when using
`rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl()` with multiple
column families.

This bug has been fixed in v0.19.0.
PolicyController before 0.2.1 may bypass attestation verification
Advisory: GHSA-739f-hw6h-7wq8
Aliases: CVE-2022-35930
Published: 2022-08-10T18:38:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

PolicyController will report a false positive, resulting in an admission when it should not be admitted when:
 * There is at least one attestation with a valid signature
 * There are NO attestations of the type being verified (--type defaults to "custom")

Users should upgrade to cosign version 0.2.1 or greater for a patch. There are no known workarounds at this time.
Uncontrolled Resource Consumption in opcua
Advisory: GHSA-8mx2-gqx9-rm7f
Aliases: CVE-2022-25888
Published: 2022-08-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
Kirby CMS 2.5.12 Cross-site Request Forgery
Advisory: GHSA-c7x2-7h8r-jq4m
Aliases: CVE-2018-14519
Published: 2022-08-25T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
Deluge Web-UI vulnerable to XSS through a crafted torrent file
Advisory: GHSA-5c8p-qhch-qhx6
Aliases: CVE-2021-3427
Published: 2022-08-27T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Deluge Web-UI is vulnerable to cross-site scripting through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's browser session.
Cryptographically weak PRNG in `utils.generateUUID`
Advisory: GHSA-p4cc-w597-6cpm
Aliases: CVE-2022-36045
Published: 2022-08-30T20:38:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### In Brief
`utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to.

### Impact
This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. Patches have been provided for both active branches of NodeBB (v2.x and v1.19.x)—please see below.

If you are already on v2.0.0 or v1.19.7, you can upgrade with no ill effects. The new version contains only the patch for this vulnerability.

The impact of this vulnerability is slightly lessened by the requirement that the target's email address must be known, **and** user emails are protected values in NodeBB. However, since NodeBB can be configured to display email addresses if the admin so wishes, and as email addresses can often by derived from other sources and/or guessed, the impact of this vulnerability is still fairly high.

### Patches

#### v2.x
The vulnerability has been patched in https://github.com/NodeBB/NodeBB/commit/e802fab87f94a13f397f04cfe6068f2f7ddf7888. You can cherry-pick this directly into your codebase.

#### v1.19.x
The vulnerability has been patched in 81e3c1ba488d03371a5ce8d0ebb5c5803026e0f9. You can cherry-pick this directly into your codebase.

### Workarounds
There is no known workaround, but the patch sets listed above will fully patch the vulnerability.

### References
* [CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)](http://cwe.mitre.org/data/definitions/338.html)

### For more information
If you have any questions or comments about this advisory:
* Discuss it on [our community forum](community.nodebb.org/)
* Email us at [support@nodebb.org](mailto:support@nodebb.org)
Cross site scripting in yetiforce/yetiforce-crm
Advisory: GHSA-rjvc-mf7r-ch7r
Aliases: CVE-2022-2885
Published: 2022-08-22T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
oauth2-server through 3.1.1 vulnerable to Open Redirect
Advisory: GHSA-4rg6-fm25-gc34
Aliases: CVE-2020-26938
Published: 2022-08-30T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the `redirect_uri` parameter received during the authorization and token request is checked against an incorrect URI pattern (`[a-zA-Z][a-zA-Z0-9+.-]+:`) before making a redirection. This allows a malicious client to pass an XSS payload through the redirect_uri parameter while making an authorization request. NOTE: this vulnerability is similar to CVE-2020-7741.
Cross site scripting in mobiledoc-kit
Advisory: GHSA-hw2p-xqhq-3mjf
Aliases: CVE-2022-2932
Published: 2022-08-23T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2.
RabbitMQ password stored in plain text by Jenkins CollabNet Plugins Plugin
Advisory: GHSA-qh87-2qvh-5jf8
Aliases: CVE-2022-38665
Published: 2022-08-24T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Openstack Keystone Incorrect Authorization vulnerability
Advisory: GHSA-cc99-whm5-mmq3
Aliases: CVE-2021-3563
Published: 2022-08-27T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.
Keycloak XSS via use of malicious payload as group name when creating new group from admin console
Advisory: GHSA-fqc7-5xxc-ph7r
Aliases: CVE-2022-0225
Published: 2022-08-27T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
node-latex-pdf is susceptible to command injection
Advisory: GHSA-32fw-9wq8-9x9c
Aliases: CVE-2020-28433
Published: 2022-08-03T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of the package node-latex-pdf.
JSPUI Possible Cross Site Scripting in "Request a Copy" Feature
Advisory: GHSA-4wm8-c2vv-xrpq
Aliases: CVE-2022-31192
Published: 2022-08-06T05:46:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

### Impact
The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form.  This means that item requests could be vulnerable to XSS attacks.  This vulnerability only impacts the JSPUI.

_This vulnerability does NOT impact the XMLUI or 7.x._

### Patches

_DSpace 6.x:_ 
* Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/503a6af57fd720c37b0d86c34de63baa5dd85819
* 6.x patch file: https://github.com/DSpace/DSpace/commit/503a6af57fd720c37b0d86c34de63baa5dd85819.patch (may be applied manually if an immediate upgrade to 6.4 is not possible)

_DSpace 5.x:_
* Fixed in 5.11 via commit: https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37
* 5.x patch file: https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37.patch (may be applied manually if an immediate upgrade to 5.11 or 6.4 is not possible)

#### Apply the patch to your DSpace
If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:
1. Download the appropriate patch file to the machine where DSpace is running
2. From the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`
3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:
    1. Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)
    2. Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.
    3. Restart Tomcat

### Workarounds
As a workaround, you can temporarily disable the "Request a Copy" feature by either commenting out the below configuration (or setting its value to empty):
```
# Comment out this default value
# request.item.type = all
```
Once your JSPUI site is patched, you can re-enable this setting. See https://wiki.lyrasis.org/display/DSDOC6x/Request+a+Copy for more information on this setting.

### References
Discovered & reported by Andrea Bollini of 4Science

### For more information
If you have any questions or comments about this advisory:
* Email us at security@dspace.org
cosign's `cosign verify-attestaton  --type` can report a false positive if any attestation exists
Advisory: GHSA-vjxv-45g9-9296
Aliases: CVE-2022-35929
Published: 2022-08-10T18:40:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

`cosign verify-attestation` used with the `--type` flag will report a false positive verification when:

- There is at least one attestation with a valid signature
- There are NO attestations of the type being verified (--type defaults to "custom")

This can happen when signing with a standard keypair and with "keyless" signing with Fulcio. Users should upgrade to cosign version 1.10.1 or greater for a patch. Currently the only workaround is to upgrade.
Solana Pay Vulnerable to Weakness in Transfer Validation Logic
Advisory: GHSA-j47c-j42c-mwqq
Aliases: CVE-2022-35917
Published: 2022-08-06T05:39:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Description
When a Solana Pay transaction is located using a [reference key](https://github.com/solana-labs/solana-pay/blob/master/SPEC.md#reference), it may be checked to represent a transfer of the desired amount to the recipient, using the supplied [`validateTransfer` function](https://github.com/solana-labs/solana-pay/blob/master/core/src/validateTransfer.ts). An edge case regarding this mechanism could cause the validation logic to validate multiple transfers.

### Impact
Most known Solana Pay point of sale applications are currently run on physical point of sale devices, which makes this issue unlikely to occur. However, there may be web-based point of sale applications using the protocol where it may be more likely to occur.

### Patches
This issue has been patched as of version [`0.2.1`](https://www.npmjs.com/package/@solana/pay/v/0.2.1). Users of the Solana Pay SDK should upgrade to it.
snipe-it vulnerable to cross-site scripting (XSS)
Advisory: GHSA-rff2-vqm3-jpv5
Aliases: CVE-2022-3035
Published: 2022-08-30T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
administrate vulnerable to Cross-Site Request Forgery
Advisory: GHSA-cc8c-26rj-v2vx
Aliases: CVE-2016-3098
Published: 2022-08-06T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code.
ForkCMS XSS via `end_date` parameter
Advisory: GHSA-pw4j-r69m-rrr5
Aliases: CVE-2022-35590
Published: 2022-08-13T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the `end_date` Parameter. This issue was patched in version 5.11.0.
Neo4j Graph apoc plugins Partial Path Traversal Vulnerability
Advisory: GHSA-78f9-745f-278p
Aliases: CVE-2022-37423
Published: 2022-08-12T15:38:33Z

### Impact
A partial Directory Traversal Vulnerability found in `apoc.log.stream` function of apoc plugins in Neo4j Graph database. 
This issue allows a malicious actor to potentially break out of the expected directory. The impact is limited to sibling directories. For example, `userControlled.getCanonicalPath().startsWith("/usr/out")` will allow an attacker to access a directory with a name like `/usr/outnot`.

### Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability are 4.4.0.8 and 4.3.0.7

### Workarounds
If you cannot upgrade the library, you can control the [allowlist of the functions](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist) that can be used in your system


### For more information
If you have any questions or comments about this advisory:
- Open an issue in [neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)
- Email us at [security@neo4j.com](mailto:security@neo4j.com)

### Credits
We want to publicly recognise the contribution of [Jonathan Leitschuh](https://github.com/JLLeitschuh) for reporting this issue.
ForkCMS XSS via `publish_on_date` parameter
Advisory: GHSA-65wf-qm95-6mhm
Aliases: CVE-2022-35587
Published: 2022-08-13T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the `publish_on_date` Parameter. This issue was patched in version 5.11.0.
iana-time-zone vulnerable to use after free in MacOS / iOS implementation
Advisory: GHSA-3fg9-hcq5-vxrc
Published: 2022-08-30T19:55:41Z

In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.

The copied system time zone was released before its name was copied.
If the system time zone was changed between the call of `CFRelease` and `str::to_owned()`,
random memory would be copied.
LibreNMS vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-325v-g5vx-whxc
Aliases: CVE-2022-36746
Published: 2022-08-31T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

LibreNMS version 22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php.
mc-kill-port vulnerable to Arbitrary Command Execution via kill function
Advisory: GHSA-2cg4-7q4x-7rr2
Aliases: CVE-2022-25973
Published: 2022-08-11T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the `kill` function, due to missing sanitization of the `port` argument.
LibreNMS vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-5229-94p3-7wwq
Aliases: CVE-2022-36745
Published: 2022-08-31T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

LibreNMS version 22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php.
Incorrect header handling in mod-wsgi
Advisory: GHSA-7527-8855-9cf8
Aliases: CVE-2022-2255
Published: 2022-08-26T00:03:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing.
Remote code execution in Apache Flume
Advisory: GHSA-h9mh-mgpv-gqmv
Aliases: CVE-2022-34916
Published: 2022-08-22T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Cross-site Scripting in Jenkins Job Configuration History Plugin
Advisory: GHSA-28w4-h56g-grg7
Aliases: CVE-2022-38664
Published: 2022-08-24T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
Vitejs Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
Advisory: GHSA-mv48-hcvh-8jj8
Aliases: CVE-2022-35204
Published: 2022-08-19T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.
Apache Avro Rust SDK vulnerable to reader looping in cycle endlessly, consuming CPU
Advisory: GHSA-v456-chpw-6mmw
Aliases: CVE-2022-35724
Published: 2022-08-10T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
ForkCMS stored XSS via `start_date` parameter
Advisory: GHSA-9hmc-87h4-w869
Aliases: CVE-2022-35585
Published: 2022-08-13T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the `start_date` Parameter. This issue was patched in version 5.11.0.
Fava before 1.22.3 vulnerable to reflected cross-site scripting
Advisory: GHSA-6hcj-qrw3-m66q
Aliases: CVE-2022-2589
Published: 2022-08-02T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fava before 1.22.3 is vulnerable to reflected cross-site scripting due to improper validation on filter conversion.
Undertow vulnerable to Dos via Large AJP request
Advisory: GHSA-95rf-557x-44g5
Aliases: CVE-2022-2053
Published: 2022-08-06T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.
monorepo-build Command Injection vulnerability
Advisory: GHSA-5vrc-7jfr-4642
Aliases: CVE-2020-28423
Published: 2022-08-03T00:00:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package monorepo-build.
Kirby CMS 2.5.12 Cross-site Scripting
Advisory: GHSA-h3w2-qg2r-c7mf
Aliases: CVE-2018-14520
Published: 2022-08-25T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.
untangle vulnerable to XML Entity Expansion
Advisory: GHSA-7xr3-6ggc-wc9p
Aliases: CVE-2022-33977
Published: 2022-08-06T05:30:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
An attacker may be able to cause a denial-of-service (DoS) condition on the server on which the product is running. This affects untangle versions up to and including 1.2.0

### Patches
The problem has been fixed with version 1.2.1

### Workarounds
None

### References
https://jvn.jp/en/jp/JVN30454777/

### For more information
If you have any questions or comments about this advisory:
* Open an [issue](https://github.com/stchris/untangle/issues)
Incorrect implementation of lockout feature in Keycloak
Advisory: GHSA-xv7h-95r7-595j
Aliases: CVE-2021-3513
Published: 2022-08-23T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.
Rust-WebSocket memory allocation based on untrusted length
Advisory: GHSA-qrjv-rf5q-qpxc
Aliases: CVE-2022-35922
Published: 2022-08-06T05:20:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Impact
Untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server.
The root cause of the issue is during dataframe parsing.
Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source.
When `Vec::with_capacity` fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use `with_capacity`, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker.

This is a security concern for you, if
- your server application handles untrusted websocket connections
- OR your client application connects to untrusted websocket servers

## Patches
The crashes are fixed in version **0.26.5** by imposing default dataframe size limits.
Affected users are advised to update to this version.

Note that default memory limits are rather large (100MB dataframes and 200 MB messages), so they can still cause DoS in some environments (i.e. 32-bit). New API has been added to fine tune those limits for specific applications.

### Workarounds

* Migrate your project to another, maintained Websocket library like Tungstenite.
* Accept only trusted WebSocket traffic.
* Filter the WebSocket traffic though some kind of proxy that ensures sanity limits on messages.
* Handle process aborts gracefully and limit process memory using OS tools.


## Credits
This issue was reported by [Evan Richter](https://github.com/evanrichter) at ForAllSecure and found with [Mayhem](https://forallsecure.com/mayhem-for-code) and [Cargo Fuzz](https://github.com/rust-fuzz/cargo-fuzz).
Raneto vulnerable to Cross-site Scripting
Advisory: GHSA-vc68-6x72-w22f
Aliases: CVE-2022-35144
Published: 2022-08-05T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability. This issue is fixed in version 0.17.1.
Pagekit CMS cross-site scripting in Markdown text box where articles are edited
Advisory: GHSA-q6h8-qjjc-j8cg
Aliases: CVE-2022-36573
Published: 2022-08-29T20:06:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit.
Apache Avro Rust SDK corrupted data read can cause crash
Advisory: GHSA-3w5g-989p-35r8
Aliases: CVE-2022-36125
Published: 2022-08-10T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
Uncontrolled Resource Consumption in node-opcua
Advisory: GHSA-4hr4-pjjh-2q2w
Aliases: CVE-2022-21208
Published: 2022-08-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks (e.g. 2GB each) without sending the Final closing chunk.
@pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution
Advisory: GHSA-qhxv-296x-hjv7
Aliases: CVE-2022-25644
Published: 2022-08-29T20:06:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function.
ForkCMS XSS via `publish_on_time` parameter
Advisory: GHSA-q4qv-3x58-rxmh
Aliases: CVE-2022-35589
Published: 2022-08-13T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the `publish_on_time` Parameter. This issue was patched in version 5.11.0.
JetBrain Ktor before 2.1.0 vulnerable to selection of wrong authentication provider
Advisory: GHSA-hccx-cg4v-hrjx
Aliases: CVE-2022-38180
Published: 2022-08-13T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases