aswin1906/github-advisory-2022 huggingface dataset:
go-merkledag's ProtoNode may be modified such that common method calls may panic
Advisory: GHSA-x39j-h85h-3f46
Aliases: CVE-2022-23495
Published: 2022-12-08T16:12:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns.

A `ProtoNode` should only be able to encode to valid DAG-PB, attempting to encode invalid DAG-PB forms will result in an error from the codec. Manipulation of an existing (newly created or decoded) `ProtoNode` using the modifier methods did not account for certain states that would place the `ProtoNode` into an unencodeable form.

Due to conformance with the [`github.com/ipfs/go-block-format#Block`](https://pkg.go.dev/github.com/ipfs/go-block-format#Block) and [`github.com/ipfs/go-ipld-format#Node`](https://pkg.go.dev/github.com/ipfs/go-ipld-format#Node) interfaces, certain methods, which internally require a re-encode if state has changed, will panic due to the inability to return an error.

Additionally, use of the `ProtoNode#SetCidBuilder()` method to set a non-functioning `CidBuilder` (such as one that refers to a multihash where an implementation of that hash function is not available) may cause the same methods to panic as a new CID is required but cannot be created.

### Patches

Releases involving fixes for this issue are [v0.8.0](https://github.com/ipfs/go-merkledag/releases/tag/v0.8.0) and [v0.8.1](https://github.com/ipfs/go-merkledag/releases/tag/v0.8.1). The recommended minimum version is **v0.8.1**.

* Additional checks are performed on `ProtoNode` state changes to avoid the possibility of creating unencodeable forms, errors are returned where this is the case.
* The builder passed in to `SetCidBuilder()` is inspected to attempt to determine if it is usable to generate CIDs, otherwise an error is returned.
* The panics have been removed and replaced with default values (empty byte slice for `RawData()` and a default zero-bytes DAG-PB CID for methods involving CIDs).

### Workarounds

These workarounds are available when using impacted versions to avoid panic conditions, and may be generally appropriate in order to provide meaningful feedback to users and avoid generating bad, or unexpected encoded data:

* Sanitise inputs when allowing user-input to set a new `CidBuilder` on a `ProtoNode`.
* Sanitise `Tsize` (`Link#Size`) values such that they are a reasonable byte-size for sub-DAGs where derived from user-input.

### References

* https://github.com/ipfs/kubo/issues/9297
* https://github.com/ipfs/go-merkledag/issues/90
* https://github.com/ipfs/go-merkledag/releases/tag/v0.8.0
* https://github.com/ipfs/go-merkledag/pull/91
* https://github.com/ipfs/go-merkledag/pull/92
* https://github.com/ipfs/go-merkledag/pull/93
* https://github.com/ipfs/go-merkledag/releases/tag/v0.8.1


### Credit

Thanks to [@mrd0ll4r](https://github.com/mrd0ll4r) for reporting the original error to Kubo!
go-unzip vulnerable to Path Traversal
Advisory: GHSA-rmj9-q58g-9qgg
Aliases: CVE-2020-36560
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Due to improper path santization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
WSO2 carbon-registry vulnerable to Cross-site Scripting
Advisory: GHSA-gp5f-gqgq-7254
Aliases: CVE-2022-4521
Published: 2022-12-15T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability classified as problematic has been found in WSO2 carbon-registry before 4.8.7. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profile_menu leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 4.8.7 or later will address this issue. The name of the patch is 9f967abfde9317bee2cda469dbc09b57d539f2cc. It is recommended to upgrade the affected component. The identifier VDB-215901 was assigned to this vulnerability.
go-resolver vulnerable to attacker-controlled domains due to unvalidated RRSIG RRs
Advisory: GHSA-87mm-qxm5-cp3f
Aliases: CVE-2022-3346
Published: 2022-12-28T03:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The owner name of RRSIG RRs is not validated, permitting an attacker to present the RRSIG for an attacker-controlled domain in a response for any other domain.
Keycloak vulnerable to path traversal via double URL encoding 
Advisory: GHSA-g8q8-fggx-9r3q
Aliases: CVE-2022-3782
Published: 2022-12-13T19:44:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.
golang.org/x/net/http2 vulnerable to possible excessive memory growth
Advisory: GHSA-xrjj-mj9h-534m
Aliases: CVE-2022-41717
Published: 2022-12-08T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.
Jettison Out-of-bounds Write vulnerability
Advisory: GHSA-7rf3-mqpx-h7xg
Aliases: CVE-2022-45685
Published: 2022-12-13T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.
Memos Cross-site Scripting vulnerability
Advisory: GHSA-rgj5-jj5q-v3v7
Aliases: CVE-2022-4609
Published: 2022-12-19T12:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Memos, an open-source, self-hosted memo hub, is vulnerable to stored Cross-site Scripting (XSS) in versions 0.8.3 and prior. A patch is available and anticipated to be part of version 0.9.0.
pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS)
Advisory: GHSA-r9hx-vwmv-q579
Aliases: CVE-2022-40897
Published: 2022-12-23T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Python Packaging Authority (PyPA)'s setuptools is a library designed to facilitate packaging Python projects. Setuptools version 65.5.0 and earlier could allow remote attackers to cause a denial of service by fetching malicious HTML from a PyPI package or custom PackageIndex page due to a vulnerable Regular Expression in `package_index`. This has been patched in version 65.5.1.
Yii2 FileAPI Widget vulnerable to Cross-site Scripting
Advisory: GHSA-j82x-fh8h-326g
Aliases: CVE-2017-20158
Published: 2022-12-31T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.1.9 can address this issue. The name of the patch is c00d1e4fc912257fca1fce66d7a163bdbb4c8222. It is recommended to upgrade the affected component. The identifier VDB-217141 was assigned to this vulnerability.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Knex.js has a limited SQL injection vulnerability
Advisory: GHSA-4jv9-3563-23j3
Aliases: CVE-2016-20018
Published: 2022-12-19T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. This vulnerability has been fixed in version 2.4.0.
NodeBB vulnerable to account takeover via prototype vulnerability
Advisory: GHSA-rf3g-v8p5-p675
Aliases: CVE-2022-46164
Published: 2022-12-05T23:06:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

### Impact
Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts.

### Patches
Patched in 2.6.1

### Workarounds
Site maintainers can cherry-pick https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8 into their codebase to patch the exploit.

### For more information
If you have any questions or comments about this advisory:

Discuss it on [our community forum](https://github.com/NodeBB/NodeBB/security/advisories/community.nodebb.org/)
Email us at [support@nodebb.org](mailto:support@nodebb.org)
phpMyFAQ vulnerable to Cross-site Scripting
Advisory: GHSA-cp9c-phxx-55xm
Aliases: CVE-2022-4407
Published: 2022-12-11T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

phpMyFAQ prior to version 3.1.9 is vulnerable to reflected Cross-site Scripting (XSS).
tar-utils Path Traversal vulnerability
Advisory: GHSA-jpf8-h7h7-3ppm
Aliases: CVE-2020-36566
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
binwalk vulnerable to UNIX Symbolic Link (Symlink) Following
Advisory: GHSA-8m3f-g62j-3vx8
Aliases: CVE-2021-4287
Published: 2022-12-27T12:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 can address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876.
Elrond-GO processing: fallback search of SCRs when not found in the main cache
Advisory: GHSA-p228-4mrh-ww7r
Aliases: CVE-2022-46173
Published: 2022-12-30T16:57:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

### Impact
Processing issue, nodes are affected when trying to process a cross-shard relayed transaction with a smart contract deploy transaction data. The problem was a bad correlation between the transaction caches and the processing component. If the above-mentioned transaction was sent with more gas than required, the smart contract result (SCR transaction) that should have returned the leftover gas, would have been wrongly added to a cache that the processing unit did not consider. The node stopped notarizing metachain blocks. The fix was actually to extend the SCR transaction search in all other caches if it wasn't found in the correct (expected) sharded-cache. 

### Patches
All versions >= v1.3.50 will contain this patch

### Workarounds
For the moment there is no workaround

### References
N/A

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [elrond-go main repo](https://github.com/ElrondNetwork/elrond-go)
usememos/memos vulnerable to improper authorization
Advisory: GHSA-vwg4-846x-f94v
Aliases: CVE-2022-4688
Published: 2022-12-23T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos versions prior to 0.9.0 are vulnerable to improper authorization, which can allow a user to modify the nickname, username and email of other users without permission.
destiny.gg chat vulnerable to cross-site request forgery
Advisory: GHSA-cjcc-46j8-xmr8
Aliases: CVE-2020-36625
Published: 2022-12-22T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
usememos/memos vulnerable to Improper Authorization
Advisory: GHSA-rx2m-xr4x-54hh
Aliases: CVE-2022-4802
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

usememos/memos 0.9.0 and prior is vulnerable to Improper Authorization.
collective.task Cross-site Scripting vulnerability
Advisory: GHSA-4r9h-x77w-mffv
Aliases: CVE-2022-4527
Published: 2022-12-15T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in collective.task up to 3.0.9. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of the file src/collective/task/browser/table.py. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 3.0.10 is able to address this issue. The name of the patch is 1aac7f83fa2c2b41d59ba02748912953461f3fac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215907.
CodeIgniter4 Potential Session Handlers Vulnerability
Advisory: GHSA-6cq5-8cj7-g558
Aliases: CVE-2022-46170
Published: 2022-12-22T20:01:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

### Impact
When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)  a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages).

### Patches
Upgrade to version 4.2.11 or later.

### Workarounds
- Use only one session cookie.

### References
- https://codeigniter4.github.io/userguide/libraries/sessions.html#session-drivers

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
usememos/memos Cross-site Scripting vulnerability
Advisory: GHSA-8w5q-5fpq-v4pm
Aliases: CVE-2022-4865
Published: 2022-12-31T09:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
usememos/memos Improper Authorization vulnerability
Advisory: GHSA-qw36-rw5q-gxcq
Aliases: CVE-2022-4804
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

usememos/memos 0.9.0 and prior is vulnerable to Improper Authorization.
usememos/memos vulnerable to stored cross-site scripting (XSS)
Advisory: GHSA-c8jh-vcjh-fx2w
Aliases: CVE-2022-4690
Published: 2022-12-23T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 has a feature to upload file and display it, and by uploading a crafted SVG file, an attacker could perform a stored cross-site scripting attack with the image direct link. This was patched in version 0.9.0.
prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior
Advisory: GHSA-gfgm-chr3-x6px
Published: 2022-12-30T17:48:30Z

In function `Table::as_ref`, a reference of vector is force cast to slice. There are multiple problems here:
1. To guarantee the size is correct, we have to first do `Vec::shrink_to_fit`. The function requires a mutable reference, so we have to force cast from immutable to mutable, which is undefined behavior (UB).
2. Even if (1) is sound, `&Vec<T>` and `&[T]` still might not have the same layout. Treating them equally may lead to undefinted behavior (UB).
baserCMS vulnerable to stored Cross-site Scripting
Advisory: GHSA-7w2v-35j3-xrm9
Aliases: CVE-2022-42486
Published: 2022-12-07T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
Slixmpp lacks SSL Certificate hostname validation in XMLStream
Advisory: GHSA-q6cq-m9gm-6q2f
Aliases: CVE-2022-45197
Published: 2022-12-25T06:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp.
Casdoor arbitrary file deletion vulnerability via uploadFile function
Advisory: GHSA-f93f-55c2-8c89
Aliases: CVE-2022-44942
Published: 2022-12-07T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the `uploadFile` function.
nosurf vulnerable to improper input validation
Advisory: GHSA-5x84-q523-vvwr
Aliases: CVE-2020-36564
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user supplied token to be considered valid.
Thinkphp has a code logic error
Advisory: GHSA-59fh-rjq3-xq7j
Aliases: CVE-2022-44289
Published: 2022-12-06T18:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
Mingsoft MCMS vulnerable to Cross-site Scripting
Advisory: GHSA-p46c-m4j7-mjvq
Aliases: CVE-2022-4350
Published: 2022-12-08T12:30:26Z

A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation of the argument content_title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215112.
nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag
Advisory: GHSA-mwvp-qr62-cvjx
Aliases: CVE-2019-25091
Published: 2022-12-28T00:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file `src/nsupdate/settings/base.py` of the component `CSRF Cookie Handler`. The manipulation of the argument `CSRF_COOKIE_HTTPONLY` leads to cookie without `httponly` flag. It is possible to initiate the attack remotely. The name of the patch is 60a3fe559c453bc36b0ec3e5dd39c1303640a59a. It is recommended to apply a patch to fix this issue. The identifier VDB-216909 was assigned to this vulnerability.
usememos/memos Improper Authentication vulnerability
Advisory: GHSA-jvq8-w7qv-hqp6
Aliases: CVE-2022-4799
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

usememos/memos 0.9.0 and prior is vulnerable to Improper Authentication.
Nadesiko3 OS Command Injection vulnerability
Advisory: GHSA-m8r5-7wf4-63mw
Aliases: CVE-2022-41642
Published: 2022-12-05T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.68 and earlier allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product.

Release notes for versions 3.3.62 and 3.3.69 both link to patches for this particular issue. The [JPCERT/CC](https://jvn.jp/en/jp/JVN56968681/index.html) advisory lists versions 3.3.68 and prior as vulnerable, and the most recent patch for this issue is tagged with version 3.3.69.
ThinkPHP Framework vulnerable to remote code execution
Advisory: GHSA-p4qr-vq2g-22wp
Aliases: CVE-2022-47945
Published: 2022-12-23T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (`lang_switch_on=true`). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including `pearcmd.php`.
Tendermint Client package vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-3fm3-m23v-5r46
Aliases: CVE-2019-25072
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Due to support of Gzip compression in request bodies, as well as a lack of limiting response body sizes, a malicious server can cause a client to consume a significant amount of system resources, which may be used as a denial of service vector.
Microweber vulnerable to unrestricted malicious uploads
Advisory: GHSA-8h43-xg5g-9cj7
Aliases: CVE-2022-4732
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
Apiman has insufficient checks for read permissions
Advisory: GHSA-54r5-wr8x-x5v3
Published: 2022-12-20T00:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. A malicious user may be able to find and subscribe to private APIs they do not have permission for, thus accessing API Management-protected resources they should not be allowed to access. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
containerd CRI stream server vulnerable to host memory exhaustion via terminal
Advisory: GHSA-2qjp-425j-52j9
Aliases: CVE-2022-23471
Published: 2022-12-07T23:23:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact

A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO.

### Patches

This bug has been fixed in containerd 1.6.12 and 1.5.16.  Users should update to these versions to resolve the issue.

### Workarounds

Ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. 

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Gin's default logger allows unsanitized input that can allow remote attackers to inject arbitrary log lines
Advisory: GHSA-6vm3-jj99-7229
Aliases: CVE-2020-36567
Published: 2022-12-27T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Gin is a HTTP web framework written in Go (Golang). Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
Cross-site scripting vulnerability in TinyMCE alerts
Advisory: GHSA-gg8r-xjwq-4w92
Aliases: CVE-2022-23494
Published: 2022-12-08T23:30:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the alert and confirm dialogs when these dialogs were provided with malicious HTML content. This can occur in plugins that use the alert or confirm dialogs, such as in the `image` plugin, which presents these dialogs when certain errors occur. The vulnerability allowed arbitrary JavaScript execution when an alert presented in the TinyMCE UI for the current user.

### Patches
This vulnerability has been patched in TinyMCE 5.10.7 and TinyMCE 6.3.1 by ensuring HTML sanitization was still performed after unwrapping invalid elements.

### Fix
To avoid this vulnerability:
- Upgrade to TinyMCE 5.10.7 or higher for TinyMCE 5.x.
- Upgrade to TinyMCE 6.3.1 or higher for TinyMCE 6.x.

### Workaround
To reduce the impact of this vulnerability:
- Ensure the the `images_upload_handler` returns a valid value as per the images_upload_handler documentation.

### References
- https://www.tiny.cloud/docs/release-notes/release-notes5107/#securityfixes
- https://www.tiny.cloud/docs/tinymce/6/6.3-release-notes/#security-fixes

### For more information
If you have any questions or comments about this advisory:
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
usememos/memos vulnerable to Improper Verification of Source of a Communication Channel
Advisory: GHSA-mfvq-m3jj-8864
Aliases: CVE-2022-4800
Published: 2022-12-28T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

usememos/memos 0.9.0 and prior is vulnerable to Improper Verification of Source of a Communication Channel.
rdiffweb vulnerable to Special Element Injection
Advisory: GHSA-83pm-7v48-5jp4
Aliases: CVE-2022-4721
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

In rdiffweb prior to 2.5.5, lack of sanitisation of characters in SSH key name could allow attacker to inject a hyperlink injection that could allow attacker to redirect victim to malicious websites.
Apache Kylin vulnerable to Command injection by Useless configuration
Advisory: GHSA-f5q9-j9r2-34gq
Aliases: CVE-2022-43396
Published: 2022-12-30T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the `kylin.engine.spark-cmd` parameter of `conf`.
Spring Boot Admins integrated notifier support allows arbitrary code execution
Advisory: GHSA-w3x5-427h-wfq6
Aliases: CVE-2022-46166
Published: 2022-12-09T20:19:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

### Impact
All users who run Spring Boot Admin Server, having enabled Notifiers (e.g. Teams-Notifier) and write access to environment variables via UI are possibly affected.

### Patches
In the most recent releases of Spring Boot Admin 2.6.10 and 2.7.8 the issue is fixed by implementing `SimpleExecutionContext` of SpEL. This prevents the arbitrary code execution (i.e. SpEL injection).

### Workarounds
 * Disable any notifier
 * Disable write access (POST request) on `/env` actuator endpoint
Jenkins Sonar Gerrit Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-m82g-fv7v-h64m
Aliases: CVE-2022-46688
Published: 2022-12-12T09:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerrit servers (previously configured by Jenkins administrators) using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.
Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
Advisory: GHSA-mcvf-2q2m-x72m
Aliases: CVE-2022-23518
Published: 2022-12-13T17:45:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

## Summary

rails-html-sanitizer `>= 1.0.3, < 1.4.4` is vulnerable to cross-site scripting via data URIs when used in combination with Loofah `>= 2.1.0`.


## Mitigation

Upgrade to rails-html-sanitizer `>= 1.4.4`.


## Severity

The maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- [SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg](https://github.com/w3c/svgwg/issues/266)
- https://github.com/rails/rails-html-sanitizer/issues/135
- https://hackerone.com/reports/1694173


## Credit

This vulnerability was independently reported by Maciej Piechota (@haqpl) and Mrinmoy Das (@goromlagche).
go-resolver's DNSSEC validation not performed correctly
Advisory: GHSA-jr65-gpj5-cw74
Aliases: CVE-2022-3347
Published: 2022-12-28T03:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

go-resolver's DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root DNSSEC public keys are not validated, permitting an attacker to present a self-signed root key and delegation chain.
Possible XSS vulnerability with certain configurations of rails-html-sanitizer
Advisory: GHSA-9h9g-93gc-623h
Aliases: CVE-2022-23519
Published: 2022-12-13T17:50:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

## Summary

There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.

- Versions affected: ALL
- Not affected: NONE
- Fixed versions: 1.4.4


## Impact

A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways:

- allow both "math" and "style" elements,
- or allow both "svg" and "style" elements

Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:

1. using application configuration:

  ```ruby
  # In config/application.rb
  config.action_view.sanitized_allowed_tags = ["math", "style"]
  # or
  config.action_view.sanitized_allowed_tags = ["svg", "style"]
  ```

  see https://guides.rubyonrails.org/configuring.html#configuring-action-view

2. using a `:tags` option to the Action View helper `sanitize`:

  ```
  <%= sanitize @comment.body, tags: ["math", "style"] %>
  <%# or %>
  <%= sanitize @comment.body, tags: ["svg", "style"] %>
  ```

  see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize

3. using Rails::Html::SafeListSanitizer class method `allowed_tags=`:

  ```ruby
  # class-level option
  Rails::Html::SafeListSanitizer.allowed_tags = ["math", "style"]
  # or
  Rails::Html::SafeListSanitizer.allowed_tags = ["svg", "style"]
  ```

4. using a `:tags` options to the Rails::Html::SafeListSanitizer instance method `sanitize`:

  ```ruby
  # instance-level option
  Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["math", "style"])
  # or
  Rails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["svg", "style"])
  ```

All users overriding the allowed tags by any of the above mechanisms to include (("math" or "svg") and "style") should either upgrade or use one of the workarounds immediately.


## Workarounds

Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.


## References

- [CWE - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (4.9)](https://cwe.mitre.org/data/definitions/79.html)
- https://hackerone.com/reports/1656627


## Credit

This vulnerability was responsibly reported by Dominic Breuker.
PaddlePaddle Out-of-bounds Read vulnerability
Advisory: GHSA-2hvc-hwg3-hpvw
Aliases: CVE-2022-46741
Published: 2022-12-07T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Out-of-bounds read in `gather_tree` in PaddlePaddle before 2.4. A [patch](https://github.com/PaddlePaddle/Paddle/commit/6712e262fc6734873cc6d5ca4f45973339a88697) is available in the `release/2.4` branch.
muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference
Advisory: GHSA-2r7v-cmch-5x26
Aliases: CVE-2022-41957
Published: 2022-12-05T17:37:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The package muhammara before 2.6.2, from 3.0.0 and before 3.3.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.

### Patches
It has been patched in 3.4.0 and has been backported to 2.6.2
There is no patch for hummus, currently

### Workarounds
Do not process files from untrusted sources or update.
Replace hummus with muhammara

### References
https://github.com/julianhille/MuhammaraJS/pull/235
https://github.com/julianhille/MuhammaraJS/pull/238
Stored XSS vulnerability in Jenkins Checkmarx Plugin
Advisory: GHSA-p86x-75j8-w4xh
Aliases: CVE-2022-46684
Published: 2022-12-12T09:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

heckmarx Plugin processes Checkmarx service API responses and generates HTML reports from them for rendering on the Jenkins UI.

Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports. This results in a stored cross-site scripting (XSS) vulnerability.

While Jenkins users without Overall/Administer permission are not allowed to configure the URL to the Checkmarx service, this could still be exploited via man-in-the-middle attacks.

Checkmarx Plugin 2022.4.3 escapes values returned from the Checkmarx service API before inserting them into HTML reports.
nadesiko3 vulnerable to OS Command Injection
Advisory: GHSA-7249-8x22-4rg4
Aliases: CVE-2022-42496
Published: 2022-12-05T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of the product and execute an arbitrary OS command on the product.
Graphite Web Cross-site Scripting vulnerability
Advisory: GHSA-3c5x-4hvx-qrrr
Aliases: CVE-2022-4728
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.
usememos/memos Cross-Site Request Forgery vulnerability
Advisory: GHSA-c5hq-35h7-r9x4
Aliases: CVE-2022-4850
Published: 2022-12-29T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos 0.9.0 and prior.
RuoYi-Cloud Cross-site Scripting vulnerability
Advisory: GHSA-vp22-232w-h9x8
Aliases: CVE-2022-4348
Published: 2022-12-08T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSON Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215108. A patch for this issue is available at https://gitee.com/y_project/RuoYi-Cloud/pulls/224.
dustjs-linkedin vulnerable to Prototype Pollution
Advisory: GHSA-c6rp-wrp9-qr4q
Aliases: CVE-2021-4264
Published: 2022-12-21T21:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in LinkedIn dustjs prior to version 3.0.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 can address this issue. The name of the patch is ddb6523832465d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464.
GitPython vulnerable to Remote Code Execution due to improper user input validation
Advisory: GHSA-hcpj-qp55-gfph
Aliases: CVE-2022-24439
Published: 2022-12-06T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
phpxmlrpc vulnerable to argument injection
Advisory: GHSA-q7qq-9gx2-ggxv
Published: 2022-12-02T22:26:45Z

phpxmlrpc vulnerable to argument injection via  local file access in `Client:send` via manipulation of `$protocol` argument.
SentinelOne impersonated via PyPI packages
Advisory: GHSA-g86j-hwg9-77q5
Published: 2022-12-27T15:25:51Z

In December 2022, threat actors impersonated SentinelOne by uploading fake software development kits (SDKs) onto PyPI. The SDKs contain fully functional SentinelOne clients, but the packages also contained malicious backdoors that are only executed when called on programmatically, as opposed to during installation. The packages have since been taken down from PyPI.
json-pointer vulnerable to Prototype Pollution
Advisory: GHSA-6xrf-q977-5vgc
Aliases: CVE-2022-4742
Published: 2022-12-26T09:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability, which was classified as critical, has been found in json-pointer. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The name of the patch is 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to apply a patch to fix this issue. VDB-216794 is the identifier assigned to this vulnerability.
GoBase Race Condition vulnerability
Advisory: GHSA-4348-x292-h437
Aliases: CVE-2022-2583
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

A race condition can cause incorrect HTTP request routing.
FeehiCMS Cross Site Scripting vulnerability
Advisory: GHSA-6vh6-72g6-xqx2
Aliases: CVE-2022-40002
Published: 2022-12-15T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.
FeehiCMS vulnerable to Cross Site Scripting
Advisory: GHSA-pwh3-3pcm-6vjh
Aliases: CVE-2020-20589
Published: 2022-12-15T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
usememos/memos vulnerable to stored Cross-site Scripting
Advisory: GHSA-97rc-mm5j-f6rj
Aliases: CVE-2022-4691
Published: 2022-12-27T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
usememos/memos has Insufficient Granularity of Access Control
Advisory: GHSA-7qpw-2j9m-rw8c
Aliases: CVE-2022-4813
Published: 2022-12-28T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

An Insufficient Granularity of Access Control in usememos/memos prior to 0.9.0 can allow an attacker to delete a memo from the archives.
Withdrawn: ConcreteCMS vulnerable to Xpath injection attacks
Advisory: GHSA-7vx2-5349-qj99
Aliases: CVE-2022-46464
Published: 2022-12-06T00:30:16Z
Withdrawn: 2023-06-06T18:32:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

## Withdrawn
This advisory has been withdrawn because it has been found not to be a security issue and withdrawn by its CNA. Please see the message from NVD [here](https://nvd.nist.gov/vuln/detail/CVE-2022-46464) for more information. This link is maintained to preserve external references.

## Original Description 

ConcreteCMS v9.1.3 was discovered to be vulnerable to Xpath injection attacks. This vulnerability allows attackers to access sensitive XML data via a crafted payload injected into the URL path folder "3".
socks Infinite Loop vulnerability
Advisory: GHSA-gxgj-xjcw-fv9p
Aliases: CVE-2013-10005
Published: 2022-12-28T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The `RemoteAddr` and `LocalAddr` methods on the returned `net.Conn` may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.
Hazelcast connection caching
Advisory: GHSA-c5hg-mr8r-f6jp
Aliases: CVE-2022-36437
Published: 2022-12-27T14:40:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

### Impact
The Connection handler in Hazelcast and Hazelcast Jet allows an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity.
The affected Hazelcast versions are through 3.12.12, 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2.
The affected Hazelcast Jet versions are through 4.5.3.

### Patches
Hazelcast Jet (and Enterprise) 4.5.4.
Hazelcast IMDG (and Enterprise)3.12.13
Hazelcast IMDG (and Enterprise) 4.1.10
Hazelcast IMDG (and Enterprise) 4.2.6
Hazelcast Platform (and Enterprise) 5.1.3

### Workarounds
There is no known workaround, but setups with TLS and mutual authentication enabled significantly lowers the exploitation risk.

### References
https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2022-36437
Netty vulnerable to HTTP Response splitting from assigning header value iterator
Advisory: GHSA-hh82-3pmq-7frp
Aliases: CVE-2022-41915
Published: 2022-12-12T21:25:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

### Impact
When calling `DefaultHttpHeaders.set` with an _iterator_ of values (as opposed to a single given value), header value validation was not performed, allowing malicious header values in the iterator to perform [HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting).

### Patches
The necessary validation was added in Netty 4.1.86.Final.

### Workarounds
Integrators can work around the issue by changing the `DefaultHttpHeaders.set(CharSequence, Iterator<?>)` call, into a `remove()` call, and call `add()` in a loop over the iterator of values.

### References
[HTTP Response Splitting](https://owasp.org/www-community/attacks/HTTP_Response_Splitting)
[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers](https://cwe.mitre.org/data/definitions/113.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [[example link to repo](https://github.com/netty/netty)](https://github.com/netty/netty)
* Email us at [netty-security@googlegroups.com](mailto:netty-security@googlegroups.com)
sememos/memos vulnerable to Improper Handling of Values
Advisory: GHSA-42q2-m54f-jh95
Aliases: CVE-2022-4851
Published: 2022-12-29T18:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

In usememos/memos 0.9.0 and prior, an attacker can post malicious content to another user's memos page via POST request.
Harvest Chosen vulnerable to Cross-site Scripting
Advisory: GHSA-x5q4-m45m-fm94
Aliases: CVE-2018-25050
Published: 2022-12-28T12:30:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 can address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.
Mingsoft MCMS vulnerable to SQL Injection
Advisory: GHSA-hc5g-xf64-j49j
Aliases: CVE-2022-4375
Published: 2022-12-09T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.
Amazon CloudWatch Agent for Windows has Privilege Escalation Vector
Advisory: GHSA-j8x2-2m5w-j939
Aliases: CVE-2022-23511
Published: 2022-12-12T14:38:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L

### Impact
A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. 
 
To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they’re able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. 

This issue does not affect the CloudWatch Agent for macOS or Linux. 

### Patches
Maintainers recommend that Agent users upgrade to the latest available version of the CloudWatch Agent to address this issue. 

### Workarounds
There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.

### References
https://github.com/aws/amazon-cloudwatch-agent/commit/6119858864c317ff26f41f576c169148d1250837

### For more information 
 
If you have any questions or comments about this advisory, contact AWS/Amazon Security via their [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.