aswin1906/github-advisory-2022 huggingface dataset:
Lack of proper validation of server UUID can be used by the server to trick the client to accept invalid proofs
Advisory: GHSA-6cqj-6969-p57x
Aliases: CVE-2022-39199
Published: 2022-11-21T20:38:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

### Impact

immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. SDK does not validate this uuid and can accept any value reported by the server. A malicious server can change the reported UUID tricking the client to treat it as a different server thus accepting a state completely irrelevant to the one previously retrieved from the server.

### Patches

The following Go SDK versions are not vulnerable:

| **SDK** | **Version** |
|-------|------------|
| [go](pkg.go.dev/github.com/codenotary/immudb/pkg/client) | 1.4.1 |

### Workarounds

When initializing an immudb client object, a custom state handler can be used to store the state. Providing custom implementation that ignores the server UUID can be used to ensure that even if the server changes the UUID, client will still consider it to be the same server.

### For more information

If you have any questions or comments about this advisory:

* Open a discussion in [immudb Discussions](https://github.com/codenotary/immudb/discussions/new)
* Email us at [immudb-security@codenotary.com](mailto:immudb-security@codenotary.com)
FusionAuth vulnerable to directory traversal attack
Advisory: GHSA-rmcx-fg5w-x8j9
Aliases: CVE-2022-45921
Published: 2022-11-28T21:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request. To be specific, an attacker may be able to view or retrieve any file readable by the user running the FusionAuth process.
PyroCMS vulnerable to stored Cross Site Scripting
Advisory: GHSA-cm7f-hf2g-ghrp
Aliases: CVE-2022-37721
Published: 2022-11-25T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS) when a low privileged user, such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
Fastify: Incorrect Content-Type parsing can lead to CSRF attack 
Advisory: GHSA-3fjj-p79j-c9hh
Aliases: CVE-2022-41919
Published: 2022-11-21T22:28:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

### Impact

The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking of `fetch`. `fetch()` requests with Content-Type’s [essence](https://mimesniff.spec.whatwg.org/#mime-type-essence) as "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", could potentially be used to invoke routes that only accepts `application/json` content type, thus bypassing any [CORS protection](https://fetch.spec.whatwg.org/#simple-header), and therefore they could lead to a  Cross-Site Request Forgery attack.

### Patches
For `4.x` users, please update to at least `4.10.2`
For `3.x` users, please update to at least `3.29.4`

### Workarounds

Implement Cross-Site Request Forgery protection using [`@fastify/csrf`](https://www.npmjs.com/package/@fastify/csrf).

### References

Check out the HackerOne report: https://hackerone.com/reports/1763832.

### For more information

[Fastify security policy](https://github.com/fastify/fastify/security/policy)
NukeView CMS vulnerable to Cross-site Scripting
Advisory: GHSA-x45f-j34v-75xm
Aliases: CVE-2022-3975
Published: 2022-11-13T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NukeView CMS has been found to be vulnerable to Cross-site Scripting. Affected by this issue is the function filterAttr of the file vendor/vinades/nukeviet/Core/Request.php of the component Data URL Handler. The manipulation of the argument attrSubSet leads to cross site scripting. The attack may be launched remotely. Upgrading to version 4.5 is able to address this issue. The name of the patch is 0b3197fad950bb3383e83039a8ee4c9509b3ce02. It is recommended to upgrade the affected component.
Dolibarr vulnerable to privilege escalation
Advisory: GHSA-gh7m-j673-wm97
Aliases: CVE-2022-43138
Published: 2022-11-17T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS) 
Advisory: GHSA-58h5-h554-429q
Published: 2022-11-10T21:42:09Z

It is possible to inject JavaScript XSS in the content type entries "name" and "short name". To exploit this, one must already have permission to edit content types, which limits it in many cases to people who are already administrators. However, please verify which users have this permission. The fix ensures any injections are escaped.
Missing permission check in Jenkins loader.io Plugin allows enumerating credentials IDs
Advisory: GHSA-wg2f-9rf7-48gm
Aliases: CVE-2022-45390
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

loader.io Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
Advisory: GHSA-9hqh-fmhg-vq2j
Aliases: CVE-2022-41928
Published: 2022-11-21T22:34:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

### Impact
Any user with the right to edit his personal page can follow one of the scenario below:

**Scenario 1**:
- Log in as a simple user with just edit rights on the user profile
- Go to the user's profile
- Upload an attachment in the attachment tab at the bottom of the page (any image is fine)
- Click on "rename" in the attachment list and enter `{{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/async}}.png` as new attachment name and submit the rename
- Go back to the user profile
- Click on the edit icon on the user avatar
- `Hello from groovy!` is displayed as the title of the attachment

**Scenario 2**:
- Log in as a simple user with just edit rights on a page
- Create a Page `MyPage.WebHome`
- Create an XClass field of type String named `avatar`
- Add an XObject of type `MyPage.WebHome` on the page
- Insert an `attachmentSelector` macro in the document with the following values:
  - **classname**: `MyPage.WebHome`
  - **property**: `avatar`
  - **savemode**: `direct`
  - **displayImage**: `true`
  - **width**: `]] {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/async}}`. You'll find below a snippet of an `attachmentSelector` macro declaration.
- Display the page
- Use the attachment picker to select an image
- `Hello from groovy` is displayed aside the image

Example of an `attachmentSelector` macro declaration:
```
`{{attachmentSelector classname="MyPage.WebHome" property="avatar" savemode="direct" displayImage="true" width="]] {{async async=~"true~" cached=~"false~" context=~"doc.reference~"~}~}{{groovy~}~}println(~"Hello from groovy!~"){{/groovy~}~}{{/async~}~}"/}}`
```

**Note**: The issue can also be reproduced by inserting the dangerous payload in the `height` or `alt` macro properties.

### Patches
The issue can be fixed on a running wiki by updating `XWiki.AttachmentSelector` with the versions below:

- 14.5-rc-1+: https://github.com/xwiki/xwiki-platform/commit/eb15147adf94bddb92626f862c1710d45bcd64a7#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
- 14.4.2+: https://github.com/xwiki/xwiki-platform/commit/c02f8eb1f3c953d124f2c097021536f8bc00fa8d#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23
- 13.10.7+: https://github.com/xwiki/xwiki-platform/commit/efd0df0468d46149ba68b66660b93f31b6318515#diff-e1513599ab698991f6cbba55d38f3f464432ced8d137a668b1f7618c7e747e23

### Workarounds
No known workaround.

### References
- https://jira.xwiki.org/browse/XWIKI-19800

### For more information
If you have any questions or comments about this advisory:
- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
- Email us at [Security Mailing List](mailto:security@xwiki.org)
Cross-site Scripting in Backdrop CMS
Advisory: GHSA-vcvg-g8p2-3hqr
Aliases: CVE-2022-42094
Published: 2022-11-22T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content.
Apache Airflow Cross-site Scripting vulnerability
Advisory: GHSA-h63r-9xxf-f2c7
Aliases: CVE-2022-43982
Published: 2022-11-02T19:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.
Concrete CMS vulnerable to XML External Entity
Advisory: GHSA-q48r-xg9h-78m8
Aliases: CVE-2022-43689
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure.
Apache DolphinScheduler vulnerable to Path Traversal
Advisory: GHSA-fp35-xrrr-3gph
Aliases: CVE-2022-34662
Published: 2022-11-01T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

When users add resources to the resource center with a relation path, this vulnerability will cause path traversal issues for logged-in users. Users should upgrade to version 3.0.0 to avoid this issue.
fastest-json-copy vulnerable to Prototype Pollution
Advisory: GHSA-p5g9-rjcf-95vj
Aliases: CVE-2022-41714
Published: 2022-11-04T12:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the `__proto__` property to be edited.
XXE vulnerability on agents in Jenkins SourceMonitor Plugin
Advisory: GHSA-h4wx-78p9-fwxw
Aliases: CVE-2022-45396
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control XML input files for the 'Publish SourceMonitor results' post-build step to have agent processes parse a crafted file that uses external entities for extraction of secrets from the Jenkins agent or server-side request forgery.

Because Jenkins agent processes usually execute build tools whose input (source code, build scripts, etc.) is controlled externally, this vulnerability only has a real impact in very narrow circumstances: when attackers can control XML files, but are unable to change build steps, Jenkinsfiles, test code that gets executed on the agents, or similar.
OpenFGA Authorization Bypass
Advisory: GHSA-3gfj-fxx4-f22w
Aliases: CVE-2022-39352
Published: 2022-11-08T22:31:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

### Overview
During our internal security assessment, it was discovered that OpenFGA versions v0.2.4 and prior are vulnerable to authorization bypass under certain conditions.

### Am I Affected?
You are affected by this vulnerability if you are using `openfga/openfga` version v0.2.4 or prior, and have tuples where the `user` field is set to a `userset` e.g. `folder:test#owner`, and the tuple's relation is used on the right-hand side of a `from` statement.

### How to fix that?
Upgrade to version 0.2.5.

### Backward Compatibility
This update is not backward compatible.
Any tuples where the `user` field is set to a `userset`, and the tuple's relation is used on the right-hand side of a `from` statement have to be rewritten.
SSL/TLS certificate validation globally and unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin
Advisory: GHSA-3vwm-fc87-mq6h
Aliases: CVE-2022-45391
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM.

NS-ND Integration Performance Publisher Plugin 4.8.0.146 no longer disables SSL/TLS certificate and hostname validation globally.
HashiCorp Nomad vulnerable to non-sensitive metadata exposure
Advisory: GHSA-7wg4-8m5p-hrfg
Aliases: CVE-2022-3866
Published: 2022-11-10T12:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under `nomad/` that belong to other jobs in the same namespace. Fixed in 1.4.2.
`CHECK_EQ` fail in `tf.raw_ops.TensorListResize`
Advisory: GHSA-67pf-62xr-q35m
Aliases: CVE-2022-41893
Published: 2022-11-21T20:42:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If [`tf.raw_ops.TensorListResize`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.cc) is given a nonscalar value for input `size`, it results `CHECK` fail which can be used to trigger a denial of service attack.
```python
import numpy as np
import tensorflow as tf

a = data_structures.tf_tensor_list_new(elements = tf.constant(value=[3, 4, 5]))
b = np.zeros([0, 2, 3, 3])

tf.raw_ops.TensorListResize(input_handle=a, size=b)
```

### Patches
We have patched the issue in GitHub commit [888e34b49009a4e734c27ab0c43b0b5102682c56](https://github.com/tensorflow/tensorflow/commit/888e34b49009a4e734c27ab0c43b0b5102682c56).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Pattarakrit Rattankul
Cross-Site Request Forgery in Moodle
Advisory: GHSA-8v23-w4w5-w83c
Aliases: CVE-2022-45149
Published: 2022-11-23T15:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.
Apache Airflow Contains Open Redirect
Advisory: GHSA-rg94-84xj-7gq3
Aliases: CVE-2022-45402
Published: 2022-11-15T12:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
`MirrorPadGrad` heap out of bounds read
Advisory: GHSA-gq2j-cr96-gvqx
Aliases: CVE-2022-41895
Published: 2022-11-21T20:44:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
If [`MirrorPadGrad`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/mirror_pad_op.cc) is given outsize input `paddings`, TensorFlow will give a heap OOB error.

```python
import tensorflow as tf
tf.raw_ops.MirrorPadGrad(input=[1],
             paddings=[[0x77f00000,0xa000000]],
             mode = 'REFLECT')
```

### Patches
We have patched the issue in GitHub commit [717ca98d8c3bba348ff62281fdf38dcb5ea1ec92](https://github.com/tensorflow/tensorflow/commit/717ca98d8c3bba348ff62281fdf38dcb5ea1ec92).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Vul AI.
XXE vulnerability on agents in Jenkins OSF Builder Suite : : XML Linter Plugin
Advisory: GHSA-8847-xvjw-9g43
Aliases: CVE-2022-45397
Published: 2022-11-16T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OSF Builder Suite : : XML Linter 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control XML files that get processed by the 'OSF Builder Suite : : XML Linter' build step to have agent processes parse a crafted file that uses external entities for extraction of secrets from the Jenkins agent or server-side request forgery.

Because Jenkins agent processes usually execute build tools whose input (source code, build scripts, etc.) is controlled externally, this vulnerability only has a real impact in very narrow circumstances: when attackers can control XML files, but are unable to change build steps, Jenkinsfiles, test code that gets executed on the agents, or similar.
Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore
Advisory: GHSA-2gj2-vj98-j2qq
Aliases: CVE-2022-41929
Published: 2022-11-21T22:35:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

### Impact

It's possible for a user with only Script rights to enable or disable a user: this operation should be only doable for users with admin rights. 

### Patches

This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.

### Workarounds

There is no workaround other than upgrading the wiki, but note that this only impacts users with Script rights: administrator should take care which users have such right. 

### References

  * https://jira.xwiki.org/browse/XWIKI-19804
  * https://github.com/xwiki/xwiki-platform/commit/0b732f2ef0224e2aaf10e2e1ef48dbd3fb6e10cd

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Insufficient Session Expiration in librenms/librenms
Advisory: GHSA-x93j-3hh3-6x23
Aliases: CVE-2022-4070
Published: 2022-11-20T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0.
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
Advisory: GHSA-5j7g-cf6r-g2h7
Aliases: CVE-2022-41931
Published: 2022-11-21T22:36:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

### Impact
Any user with view rights on commonly accessible documents including the icon picker macro can execute arbitrary Groovy, Python or Velocity code in XWiki due to improper neutralization of the macro parameters of the icon picker macro.

The URL `<server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%252F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7BiconPicker%20id%3D%22'%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerId%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%20class%3D%22'%3C%2Fscript%3E%7B%7B%2Fhtml%7D%7D%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dprintln(%2FHellofromIconPickerClass%2F)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D%22%2F%7D%7D` demonstrates the issue (replace `<server>` by the URL to your XWiki installation). If the output `HellofromIconPickerId` or `HellofromIconPickerClass` is visible, the XWiki installation is vulnerable (normally, all output should be contained in a script-tag and thus invisible).

### Patches

The problem has been patched in XWiki 13.10.7, 14.5 and 14.4.2.

### Workarounds

The [patch](https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01) can be manually applied by editing `IconThemesCode.IconPickerMacro` in the object editor. The whole document can also be replaced by the current version by importing the document from the XAR archive of a fixed version as the only changes to the document have been security fixes and small formatting changes.

### References
* https://github.com/xwiki/xwiki-platform/commit/47eb8a5fba550f477944eb6da8ca91b87eaf1d01
* https://jira.xwiki.org/browse/XWIKI-19805

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Snyk plugins vulnerable to Command Injection
Advisory: GHSA-4x6g-3cmx-w76r
Aliases: CVE-2022-22984
Published: 2022-11-30T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin before 5.6.5; the package @snyk/snyk-hex-plugin before 1.1.6 are vulnerable to Command Injection due to an incomplete fix for [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342). A successful exploit allows attackers to run arbitrary commands on the host system where the Snyk CLI is installed by passing in crafted command line flags. In order to exploit this vulnerability, a user would have to execute the snyk test command on untrusted files. In most cases, an attacker positioned to control the command line arguments to the Snyk CLI would already be positioned to execute arbitrary commands. However, this could be abused in specific scenarios, such as continuous integration pipelines, where developers can control the arguments passed to the Snyk CLI to leverage this component as part of a wider attack against an integration/build pipeline. This issue has been addressed in the latest Snyk Docker images available at https://hub.docker.com/r/snyk/snyk as of 2022-11-29. Images downloaded and built prior to that date should be updated. The issue has also been addressed in the Snyk TeamCity CI/CD plugin as of version v20221130.093605.
Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack
Advisory: GHSA-5r3h-c3r7-9w4h
Aliases: CVE-2022-33684
Published: 2022-11-04T19:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when `tlsAllowInsecureConnection` is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or modify the GET request that is sent to the `ClientCredentialFlow` "issuer url". The intercepted credentials can be used to acquire authentication data from the OAuth2.0 server to then authenticate with an Apache Pulsar cluster. An attacker can only take advantage of this vulnerability by taking control of a machine "between" the client and the server. The attacker must then actively manipulate traffic to perform the attack. The Apache Pulsar Python Client wraps the C++ client, so it is also vulnerable in the same way. 

This issue affects Apache Pulsar C++ Client and Python Client versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0 to 2.10.1; 2.6.4 and earlier. 

Any users running affected versions of the C++ Client or the Python Client should rotate vulnerable OAuth2.0 credentials, including `client_id` and `client_secret`. 
- 2.7 C++ and Python Client users should upgrade to 2.7.5 and rotate vulnerable OAuth2.0 credentials. 
- 2.8 C++ and Python Client users should upgrade to 2.8.4 and rotate vulnerable OAuth2.0 credentials. 
- 2.9 C++ and Python Client users should upgrade to 2.9.3 and rotate vulnerable OAuth2.0 credentials. 
- 2.10 C++ and Python Client users should upgrade to 2.10.2 and rotate vulnerable OAuth2.0 credentials. 3.0 C++ users are unaffected and 3.0 Python Client users will be unaffected when it is released. 
- Any users running the C++ and Python Client for 2.6 or less should upgrade to one of the above patched versions.
KubeVela VelaUX APIserver has SSRF vulnerability 
Advisory: GHSA-m5xf-x7q6-3rm7
Aliases: CVE-2022-39383
Published: 2022-11-18T17:14:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

### Impact
Users using the VelaUX APIServer could be affected by this vulnerability.

When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability.

This issue is patched in 1.5.9 and 1.6.2.

### References
Fix by: #5000 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeVela repo](https://github.com/kubevela/kubevela)
* Email us at [here](https://github.com/kubevela/kubevela#contact-us)
SSL/TLS certificate validation unconditionally disabled by Jenkins NS-ND Integration Performance Publisher Plugin
Advisory: GHSA-vj5r-mmp4-3hrx
Aliases: CVE-2022-38666
Published: 2022-11-16T12:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features. Currently, there are no known workarounds or patches.
eZ Platform users with the Company admin role can assign any role to any user
Advisory: GHSA-99r3-xmmq-7q7g
Published: 2022-11-10T23:59:24Z

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Apache Airflow subject to Exposure of Sensitive Information
Advisory: GHSA-fvw2-2pf7-77vw
Aliases: CVE-2022-27949
Published: 2022-11-14T12:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.
phpCAS vulnerable to Service Hostname Discovery Exploitation
Advisory: GHSA-8q72-6qq8-xv64
Aliases: CVE-2022-39369
Published: 2022-11-01T18:11:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

### Impact

The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. 
Depending on the settings of the CAS server service registry in worst case this may be any other service URL (if the allowed URLs are configured to "^(https)://.*") or may be strictly limited to known and authorized services in the same SSO federation if proper URL service validation is applied.

This vulnerability may allow an attacker to gain access to a victim's account on a vulnerable CASified service without victim's knowledge, when the victim visits attacker's website while being logged in to the same CAS server. 

### Patch

phpCAS 1.6.0 is a major version upgrade that starts enforcing service URL discovery validation, because there is unfortunately no 100% safe default config to use in PHP. Starting this version, it is required to pass in an additional service base URL argument when constructing the client class.

For more information, please refer to the upgrading doc.

### Workarounds

This vulnerability only impacts the CAS client that the phpCAS library protects against. The problematic service URL discovery behavior in phpCAS < 1.6.0 will only be disabled, and thus you are not impacted from it, if the phpCAS configuration has the following setup:

1. `phpCAS::setUrl()` is called (a reminder that you have to pass in the full URL of the current page, rather than your service base URL), and
2. `phpCAS::setCallbackURL()` is called, only when the proxy mode is enabled.
3. Alternatively, if your PHP's HTTP header input `X-Forwarded-Host`, `X-Forwarded-Server`, `Host`, `X-Forwarded-Proto`, `X-Forwarded-Protocol` is sanitized before reaching PHP (by a reverse proxy, for example), you will not be impacted by this vulnerability.

Otherwise, you should upgrade the library to get the safe service discovery behavior.

If your CAS server service registry is configured to only allow known and trusted service URLs, the severity of the vulnerability is reduced substantially since an attacker must be in control of another authorized service.

### Acknowledgement

We would like to thank Filip Hejsek for discovering this vulnerability, responsibly reporting it to the developers, and helping harden the patch.

Henry Pan and Joachim Fritschi helped with the patch and release effort as phpCAS developers.
Apache Airflow Open Redirect vulnerability
Advisory: GHSA-f9fq-78ch-4wmj
Aliases: CVE-2022-43985
Published: 2022-11-02T19:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
Command injection in Apache DolphinScheduler Alert Plugins
Advisory: GHSA-wqg7-mx6p-2rw3
Aliases: CVE-2022-45462
Published: 2022-11-23T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher.
Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion
Advisory: GHSA-298r-5c48-7q2r
Aliases: CVE-2022-45380
Published: 2022-11-16T12:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links.

This is done in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

JUnit Plugin 1160.vf1f01a_a_ea_b_7f no longer converts URLs to clickable links.
Free5gc vulnerable to uncontrolled resource consumption
Advisory: GHSA-m74x-fxjh-3qh9
Aliases: CVE-2022-38871
Published: 2022-11-19T00:30:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.
Incorrect Default Permissions in Liferay Portal
Advisory: GHSA-mxvq-cv4x-p3jw
Aliases: CVE-2022-42130
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, and 7.4 GA does not properly check permission of form entries, which allows remote authenticated users to view and access all form entries.
PyTorch vulnerable to arbitrary code execution
Advisory: GHSA-47fc-vmwq-366v
Aliases: CVE-2022-45907
Published: 2022-11-26T03:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. The fix for this issue is available in version 1.13.1. There is a release checker in [issue #89855](https://github.com/pytorch/pytorch/issues/89855).
github.com/russellhaering/gosaml2 is vulnerable to NULL Pointer Dereference
Advisory: GHSA-prjq-f4q3-fvfr
Aliases: CVE-2020-7731
Published: 2022-11-15T19:05:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
In versions prior to v0.7.0 it was possible for an attacker to supply an invalid assertion which would trigger a panic due to a nil-pointer dereference.

### Patches
The issue was patched in v0.7.0, released on March 2, 2022.

### Workarounds
Callers to `gosaml2` can use `recover()` to handle panics to mitigate a potential DoS.

### References
See issue [#59](https://github.com/russellhaering/gosaml2/issues/59) for details.
Deserialization of Untrusted Data in librenms/librenms
Advisory: GHSA-cv9g-h8mm-xx5h
Aliases: CVE-2022-3525
Published: 2022-11-20T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.
Tailscale Windows daemon is vulnerable to RCE via CSRF
Advisory: GHSA-vqp6-rc3h-83cp
Aliases: CVE-2022-41924
Published: 2022-11-21T22:34:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:H

A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used to remotely execute code.

**Affected platforms:** Windows
**Patched Tailscale client versions:** v1.32.3 or later, v1.33.257 or later (unstable)

### What happened?
In the Tailscale Windows client, the local API was bound to a local TCP socket, and communicated with the Windows client GUI in cleartext with no Host header verification. This allowed an attacker-controlled website visited by the node to rebind DNS to an attacker-controlled DNS server, and then make local API requests in the client, including changing the coordination server to an attacker-controlled coordination server.

### Who is affected?
All Windows clients prior to version v.1.32.3 are affected.

### What should I do?
If you are running Tailscale on Windows, upgrade to v1.32.3 or later to remediate the issue.

### What is the impact?
An attacker-controlled coordination server can send malicious URL responses to the client, including pushing executables or installing an SMB share. These allow the attacker to remotely execute code on the node.

Reviewing all logs confirms this vulnerability was not triggered or exploited. 

### Credits
We would like to thank [Emily Trau](https://github.com/emilytrau) and [Jamie McClymont (CyberCX)](https://twitter.com/JJJollyjim) for reporting this issue. Further detail is available in [their blog post](https://emily.id.au/tailscale).

### References
* [TS-2022-004](https://tailscale.com/security-bulletins/#ts-2022-004)
* [Researcher blog post](https://emily.id.au/tailscale)

### For more information
If you have any questions or comments about this advisory, [contact Tailscale support](https://tailscale.com/contact/support/).
`CHECK` fail via inputs in `SdcaOptimizer`
Advisory: GHSA-27rc-728f-x5w2
Aliases: CVE-2022-41899
Published: 2022-11-21T21:54:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

### Impact
Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in [`SdcaOptimizer`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sdca_internal.cc).

```python
import tensorflow as tf

tf.raw_ops.SdcaOptimizer(
    sparse_example_indices=4 * [tf.random.uniform([5,5,5,3], dtype=tf.dtypes.int64, maxval=100)],
    sparse_feature_indices=4 * [tf.random.uniform([5,5,5,3], dtype=tf.dtypes.int64, maxval=100)],
    sparse_feature_values=8 * [tf.random.uniform([5,5,5,3], dtype=tf.dtypes.float32, maxval=100)],
    dense_features=4 * [tf.random.uniform([5,5,5,3], dtype=tf.dtypes.float32, maxval=100)],
    example_weights=tf.random.uniform([5,5,5,3], dtype=tf.dtypes.float32, maxval=100),
    example_labels=tf.random.uniform([5,5,5,3], dtype=tf.dtypes.float32, maxval=100),
    sparse_indices=4 * [tf.random.uniform([5,5,5,3], dtype=tf.dtypes.int64, maxval=100)],
    sparse_weights=4 * [tf.random.uniform([5,5,5,3], dtype=tf.dtypes.float32, maxval=100)],
    dense_weights=4 * [tf.random.uniform([5,5,5,3], dtype=tf.dtypes.float32, maxval=100)],
    example_state_data=tf.random.uniform([5,5,5,3], dtype=tf.dtypes.float32, maxval=100),
    loss_type="squared_loss",
    l1=0.0,
    l2=0.0,
    num_loss_partitions=1,
    num_inner_iterations=1,
    adaptative=False,)
```

### Patches
We have patched the issue in GitHub commit [80ff197d03db2a70c6a111f97dcdacad1b0babfa](https://github.com/tensorflow/tensorflow/commit/80ff197d03db2a70c6a111f97dcdacad1b0babfa).

The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Zizhuang Deng of IIE, UCAS
Improper Certificate Validation in Liferay Portal
Advisory: GHSA-cx84-43xc-3gm2
Aliases: CVE-2022-42131
Published: 2022-11-15T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Portal 7.1.0 through 7.4.2 and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, and 7.3 before service pack 3.
eZ Platform users with the Company admin role can assign any role to any user
Advisory: GHSA-446q-xxg5-3vhh
Published: 2022-11-10T23:57:04Z

Critical severity. Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Lancet vulnerable to path traversal when unzipping files
Advisory: GHSA-pp3f-xrw5-q5j4
Aliases: CVE-2022-41920
Published: 2022-11-21T22:31:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact
_What kind of vulnerability is it? Who is impacted?_

ZipSlip issue when use fileutil package to unzip files.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

It will fixed in v2.1.10, Please upgrade version to v2.1.10 or above.
Users who use v1.x.x should upgrade v1.3.4 or above.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No, users have to upgrade version.
Froxlor vulnerable to code injection
Advisory: GHSA-6rjv-xxgr-v57x
Aliases: CVE-2022-3869
Published: 2022-11-05T19:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Code Injection in GitHub repository froxlor/froxlor prior to version 0.10.38.2. There are currently no known workarounds, please upgrade to version 0.10.38.2.
OS Command Injection in Apache Airflow
Advisory: GHSA-cm43-f2pv-6v68
Aliases: CVE-2022-41131
Published: 2022-11-22T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the HIve Provider version 4.1.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Hive Provider installed).
Authenticated OpenRedirect Vulnerability
Advisory: GHSA-r3qr-vwvg-43f7
Aliases: CVE-2022-41965
Published: 2022-11-30T21:22:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

**Description**
Prior to Opencast 12.5 Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users.

**Impact**
The vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues.

**Patches**
This issue is fixed in Opencast 12.5 and newer

**References**
[Patch fixing the issue](https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017)

**If you have any questions or comments about this advisory**:
Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
Email us at [security@opencast.org](mailto:security@opencast.org)
Apache Airflow vulnerable to OS Command Injection via example DAGs
Advisory: GHSA-6pw3-8h9w-32gc
Aliases: CVE-2022-40127
Published: 2022-11-14T12:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow versions prior to 2.4.0.
Insufficient Entropy in PHPServerMon PRNG
Advisory: GHSA-97w9-gcc7-vr8g
Aliases: CVE-2021-4240
Published: 2022-11-16T12:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability, which was classified as problematic, was found in phpservermon. This affects the function `generatePasswordResetToken` of the file `src/psm/Service/User.php`. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may be used. The name of the patch is 3daa804d5f56c55b3ae13bfac368bb84ec632193. It is recommended to apply a patch to fix this issue. The identifier VDB-213717 was assigned to this vulnerability.
GraphQL queries can expose password hashes
Advisory: GHSA-3p7g-wrgg-wq45
Published: 2022-11-10T21:35:49Z

### Impact
Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors.

### Patches
Affected versions: Ibexa DXP v3.3.\*, v4.2.\*, eZ Platform v2.5.\*
Resolving versions: Ibexa DXP v3.3.28, v4.2.3, eZ Platform v2.5.31

### Workarounds
Remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.

### References

This issue was reported to us by Philippe Tranca ("trancap") of the company Lexfo. We are very grateful for their research, and responsible disclosure to us of this critical vulnerability. 

### For more information
If you have any questions or comments about this advisory, please contact Support via your service portal.
sweetalert2 v8.19.1 and above contains hidden functionality
Advisory: GHSA-8jh9-wqpf-q52c
Published: 2022-11-23T15:49:51Z

`sweetalert2` versions 8.19.1 and up until 9.0.0 are vulnerable to hidden functionality that was introduced by the maintainer. The package outputs audio and/or video messages that do not pertain to the functionality of the package and is not included in versions below 8.19.1.

### Workaround
Use a version < 8.19.1 of the package until the maintainer releases a fix.
Cross-site Scripting in Zenario
Advisory: GHSA-j43m-4pxc-hmqj
Aliases: CVE-2022-44071
Published: 2022-11-16T19:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.
ghost vulnerable to unauthorized newsletter modification via improper access controls
Advisory: GHSA-9gh8-wp53-ccc6
Aliases: CVE-2022-41654
Published: 2022-11-28T22:06:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

### Impact

On sites where members is enabled (this is the default) it is possible for members (unprivileged users) to make changes to newsletter settings. This gives unprivileged users the ability to view and change settings they were not intended to have access to. They are not able to escalate their privileges permanently or get access to further information. This issue was caused by a gap in our API validation for nested objects.

Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.

Self-hosters are impacted if running Ghost a version between v4.46.0 and v4.48.7 or any version of v5 prior to v5.22.7. Immediate action should be taken to secure your site - see patches & workarounds below.

### Patches
-  v4.48.8 / v5.22.7 are patched for all known exploits.
-  v4.48.9 / v5.24.1 contain deeper fixes to the API to close the potential for this vulnerability to appear elsewhere or regress 

### Workarounds
The known exploit can be prevented by [disabling members](https://ghost.org/help/can-i-disable-memberships/) until an update can be performed.

### References
- [forum post](https://forum.ghost.org/t/security-update-available-for-ghost-4-x-and-4-x/34475)

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@ghost.org](mailto:security@ghost.org)

---

Credits: Dave McDaniel and other members of [Cisco Talos](https://talosintelligence.com/vulnerability_reports)
Concrete CMS vulnerable to Cross-site Scripting via multilingual report
Advisory: GHSA-vq39-q549-g786
Aliases: CVE-2022-43967
Published: 2022-11-15T12:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.