aswin1906/github-advisory-2023 huggingface dataset:
snyk Code Injection vulnerability (GHSA-4vrv-93c7-m92j)
Aliases: CVE-2022-24441
Published: 2023-07-06T19:24:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'snyk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1064.0'}]}]}]

The package snyk before 1.1064.0 is vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable.

**NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well.

The affected IDE plugins and versions are: 
- VS Code - Affected: <=1.8.0, Fixed: 1.9.0 
- IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 
- Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 
- Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions 
- Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Apache Johnzon Deserialization of Untrusted Data vulnerability (GHSA-crqg-jrpj-fc84)
Aliases: CVE-2023-33008
Published: 2023-07-07T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.johnzon:johnzon-mapper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.21'}]}]}]

A malicious attacker can craft up some JSON input that uses large numbers (numbers such as 1e20000000) that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion (Denial of service risk). Apache Johnzon 1.2.21 mitigates this by setting a scale limit of 1000 (by default) to the BigDecimal. 


This issue affects Apache Johnzon through 1.2.20.
Fides Webserver Vulnerable to SVG Bomb File Uploads (GHSA-3rw2-wfc8-wmj5)
Aliases: CVE-2023-37481
Published: 2023-07-18T19:23:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ethyca-fides'}, 'ecosystem_specific': {'affected_functions': ['fides.api.service.connectors.saas.connector_registry_service.CustomConnectorTemplateLoader.save_template']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.11.0'}, {'fixed': '2.16.0'}]}]}]

### Impact
The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit this vulnerability to upload zip files containing malicious SVG bombs (similar to a billion laughs attack), causing resource exhaustion in Admin UI browser tabs and creating a persistent denial of service of the 'new connector' page (`datastore-connection/new`).

This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role.

### Patches
The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.

### Workarounds
There is no known workaround to remediate this vulnerability without upgrading.
Artesãos SEOTools Open Redirect vulnerability (GHSA-wjg8-pxqj-c3c7)
Aliases: CVE-2020-36663
Published: 2023-07-06T19:24:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'artesaos/seotools'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.2'}]}]}]

A vulnerability, which was classified as problematic, was found in Artesãos SEOTools up to and including version 0.17.1. This affects the function makeTag of the file OpenGraph.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The name of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component.
CometBFT may duplicate transactions in the mempool's data structures (GHSA-w24w-wp77-qffm)
Aliases: CVE-2023-34451
Published: 2023-07-05T21:34:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cometbft/cometbft'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.34.29'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cometbft/cometbft'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.37.0'}, {'fixed': '0.37.2'}]}]}]

### Impact

The mempool maintains two data structures to keep track of outstanding transactions: a list and a map.
These two data structures are supposed to be in sync all the time in the sense that the map tracks the index (if any) of the transaction in the list. 

Unfortunately, it is possible to have them out of sync. When this happens, the list may contain several copies of the same transaction.
Because the map tracks a single index, it is then no longer possible to remove all the copies of the transaction from the list.
This happens  even if the duplicated transaction is later committed in a block.
The only way to remove the transaction is by restarting the node.

These are the steps to cause the above duplication problem. Everything should happen within one height, that is no `FinalizeBlock` or `BeginBlock` ABCI calls should happen while these steps are reproduced:

1. send transaction tx1 to the target full node via RPC
2. send N more different transactions to the target full node, where N should be higher than the node's configured value for `cache_size` in `config.toml`
3. send transaction tx1 again to the target full node

One of the copies of tx1 is now _stuck_ in the mempool's data structures. Effectively causing a memory leak, and having that node gossiping that transaction to its peers forever.

The above problem can be repeated on and on until a sizable number of transactions are stuck in the mempool, in order to try to bring down the target node.

This problem is present in releases: `v0.37.0`, and `v0.37.1`, as well as in `v0.34.28`, and all previous releases of the CometBFT repo. It will be fixed in releases `v0.34.29` and `v0.37.2`.

### Patches

The PR containing the fix is [here](https://github.com/cometbft/cometbft/pull/890).


### Workarounds

* Increasing the value of `cache_size` in `config.toml` makes it very difficult to effectively attack a full node.
* Not exposing the transaction submission RPC's would mitigate the probability of a successful attack, as the attacker would then have to create a modified (byzantine) full node to be able to perform the attack via p2p.

### References

* [PR](https://github.com/tendermint/tendermint/pull/2778) that introduced the map to track transactions in the mempool.
* [PR](https://github.com/cometbft/cometbft/pull/890) containing the fix.
Alkacon OpenCMS arbitrary file upload vulnerability (GHSA-ghg2-3w9x-9599)
Aliases: CVE-2023-37602
Published: 2023-07-20T21:30:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opencms:opencms-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '15.0'}]}]}]

An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
Float point exception (FPE) in paddlepaddle (GHSA-cv2j-922j-hr56)
Aliases: CVE-2023-38672
Published: 2023-07-26T12:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'paddlepaddle'}, 'ecosystem_specific': {'affected_functions': ['paddle.linalg.matrix_power']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.0'}]}]}]

FPE in paddle.linalg.matrix_power in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service.
Apache InLong SQL Injection vulnerability (GHSA-cqr6-3x3f-9wr3)
Aliases: CVE-2023-30465
Published: 2023-07-06T19:24:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.6.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.6.0'}]}]}]

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.5.0. By manipulating the "orderType" parameter and the ordering of the returned content using an SQL injection attack, an attacker can extract the username of the   user with ID 1 from the "user" table, one character at a time.  Users are advised to upgrade to Apache InLong's 1.6.0 or cherry-pick PR #7530 to solve it.
langchain vulnerable to arbitrary code execution (GHSA-57fc-8q82-gfp3)
Aliases: CVE-2023-36188
Published: 2023-07-06T15:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['langchain.chains.PALChain']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.236'}]}]}]

An issue in langchain allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.
xalpha vulnerable to Remote Code Execution (GHSA-jx3q-5rgf-vrrr)
Aliases: CVE-2023-37659
Published: 2023-07-11T15:31:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'xalpha'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.11.4'}, {'fixed': '0.11.9'}]}]}]

xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).
Jenkins AbsInt a³ Plugin XML External Entity Reference vulnerability (GHSA-wf8m-qr47-xc9m)
Aliases: CVE-2023-28685
Published: 2023-07-06T19:24:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:absint-a3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.0'}]}]}]

Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control `Project File (APX)` contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
KubePi may leak password hash of any user (GHSA-87f6-8gr7-pc6h)
Aliases: CVE-2023-37916
Published: 2023-07-21T20:18:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/KubeOperator/kubepi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.5'}]}]}]

### Summary
http://kube.pi/kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password of any user (including admin). This leads to password crack attack


### PoC
https://drive.google.com/file/d/1ksdawJ1vShRJyT3wAgpqVmz-Ls6hMA7M/preview

### Impact
- Leaking confidential information.
- Can lead to password cracking attacks
Pygments vulnerable to ReDoS (GHSA-mrwq-x4v8-fh7p)
Aliases: CVE-2022-40896
Published: 2023-07-19T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Pygments'}, 'ecosystem_specific': {'affected_functions': ['pygments.lexers.templates.SqlJinjaLexer.analyse_text', 'pygments.lexers.smithy.SmithyLexer', 'pygments.lexers.configs.PropertiesLexer']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.15.0'}]}]}]

A ReDoS issue was discovered in `pygments/lexers/smithy.py` in Pygments until 2.15.0 via SmithyLexer.
langchain SQL Injection vulnerability (GHSA-7q94-qpjr-xpgm)
Aliases: CVE-2023-36189
Published: 2023-07-06T15:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.225'}]}]}]

SQL injection vulnerability in langchain allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration (GHSA-2rx4-9f5h-9gjf)
Aliases: CVE-2023-33234
Published: 2023-07-06T21:15:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-cncf-kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '7.0.0'}]}]}]

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.

In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
Artesãos SEOTools Open Redirect vulnerability (GHSA-w2x5-hpmg-j98h)
Aliases: CVE-2020-36665
Published: 2023-07-06T19:24:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'artesaos/seotools'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.2'}]}]}]

A vulnerability was found in Artesãos SEOTools up to and including version 0.17.1. This issue affects the function eachValue of the file TwitterCards.php. The manipulation of the argument value leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The name of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component.
SQL injection in jeecg-boot (GHSA-wp6c-29r3-jqw9)
Aliases: CVE-2023-38992
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-common'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.3'}]}]}]

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
Code injection in webmagic-core (GHSA-grvq-vjqr-x8vm)
Aliases: CVE-2023-39015
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'us.codecraft:webmagic-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9.0'}]}]}]

webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloader.PhantomJSDownloader.
@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability (GHSA-gm68-572p-q28r)
Published: 2023-07-06T15:30:51Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@vendure/admin-ui-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.3'}]}]}]

### Impact
Vendure provides an authorization system with different levels of privileges. For example, an administrator cannot create another administrator.

In the admin UI, there are a couple of places with description inputs, such as inventory/collection catalog, shipping methods, promotions, and more.

While the WYSIWYG editor allows limited customization, altering the request data (not in the ui) saves and returns arbitrary HTML with no sanitization. Causing an XSS when viewing the page.

The impact of this XSS is privilege escalation. A user that can write any type of description can trigger the attack. Then any other user that visits the vulnerable page is prone to arbitrary Javascript code execution, giving the attacker ability to execute actions on behalf of this user.

### Patches
in progress

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox (GHSA-jpgw-2r9m-8qfw)
Aliases: CVE-2023-36809
Published: 2023-07-05T22:40:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.5'}]}]}]

### Impact

Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced
changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly! 

The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed. 

Additionally file upload validators and parts of the HTML rendering code have been found to require additional sanitation and improvements.

### Patches

- Updated Nginx content type configuration
- Improved file upload validation code to prevent more potentially dangerous uploads
- Sanitization of test plan names used in the `tree_view_html()` function

### References

Disclosed by [M Nadeem Qazi](https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8/) and
[Mahshooq Zubair](https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d689223/).
llhttp vulnerable to HTTP request smuggling (GHSA-cggh-pq45-6h9x)
Aliases: CVE-2023-30589
Published: 2023-07-01T00:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'llhttp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.1'}]}]}]

The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20
Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE (GHSA-4q66-g4mm-8rg5)
Published: 2023-07-31T22:02:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/admin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.13.6'}]}]}]

TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting `silverstripe/admin`.

Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4 to use a more recent release of TinyMCE without introducing breaking changes. Instead, the security patches that shipped in later releases of TinyMCE have been backported to the TinyMCE version bundled in `silverstripe/admin`.

Silverstripe CMS 5 is not affected by those vulnerabilities because it uses TinyMCE 6.

You can find more information about the underlying vulnerabilities in those GitHub security advisories:

- [GHSA-5h9g-x5rv-25wg Cross-site scripting vulnerability in TinyMCE](https://github.com/advisories/GHSA-5h9g-x5rv-25wg)
- [GHSA-w7jx-j77m-wp65 Cross-site scripting vulnerability in TinyMCE](https://github.com/advisories/GHSA-w7jx-j77m-wp65)
ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor (GHSA-q9w4-w667-qqj4)
Aliases: CVE-2023-37905
Published: 2023-07-10T21:54:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ckeditor-wordcount-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.17.12'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.17.11'}}]

### Problem

It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is susceptible to cross-site scripting when switching to the source code mode.

### Solution

Update to version 1.17.12 of the `ckeditor-wordcount-plugin` plugin.

### Credits

* @sypets for reporting this finding to the TYPO3 Security Team
* @ohader for fixing the issue on behalf of the TYPO3 Security Team
Silverstripe Framework: Members with no password can be created and bypass custom login forms (GHSA-36xx-7vf6-7mv3)
Aliases: CVE-2023-32302
Published: 2023-07-31T22:00:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/framework'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '4.13.14'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/framework'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.13'}]}]}]

When a new `Member` record was created in the cms it was possible to set a blank password. If an attacker knows the email address of the user with the blank password then they can attempt to log in using an empty password. The default member authenticator, login form and basic auth all require a non-empty password, however if a custom authentication method is used it may allow a successful login with the empty password. Starting with this release, blank passwords are no no longer allowed when members are created in the CMS. Programatically created `Member` records, such as those used in unit tests, still allow blank passwords. You may have some `Member` records in your system already which have empty passwords. To detect these, you can loop over all `Member` records with `Member::get()` and pass each record into the below method. It might be sensible to create a [`BuildTask`](https://api.silverstripe.org/5/SilverStripe/Dev/BuildTask.html) for this purpose.
  ```php
    private function memberHasBlankPassword(Member $member): bool
    {
        // skip default admin as this is created programatically
        if ($member->isDefaultAdmin()) {
            return false;
        }
        // return true if a blank password is valid for this member
        $authenticator = new MemberAuthenticator();
        return $authenticator->checkPassword($member, '')->isValid();
    }
  ```
  Once you have identified the records with empty passwords, it's up to you how to handle this. The most sensible way to resolve this is probably to generate a new secure password for each of these members, mark it as immediately expired, and email each affected member (assuming they have a valid email address in the system).

Users would need to opt-in to insecure behavior by using a configuration which allowed for empty passwords. These configurations are not expected and hence this advisory is primarily informational in nature.

Reported by: [Sabina Talipova](https://www.silverstripe.com/about-us/team/?member=sabina-talipova) from Silverstripe and [Christian Bünte](https://github.com/bimthebam)
Cross-Site Scripting in CKEditor4 WordCount Plugin (GHSA-m8fw-p3cr-6jqc)
Published: 2023-07-25T19:11:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'typo3/cms-rte-ckeditor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.5.0'}, {'fixed': '9.5.42'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'typo3/cms-rte-ckeditor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.4.39'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'typo3/cms-rte-ckeditor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '11.5.30'}]}]}]

> ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.4) 

### Problem
The [WordCount](https://ckeditor.com/cke4/addon/wordcount) plugin ([`npm:ckeditor-wordcount-plugin`](https://www.npmjs.com/package/ckeditor-wordcount-plugin)) for CKEditor4 is vulnerable to cross-site scripting when switching to the source code mode. This plugin is enabled via the `Full.yaml` configuration present, but is not active in the default configuration.

In default scenarios, exploiting this vulnerability requires a valid backend user account. However, if custom plugins are used on the website frontend, which accept and reflect rich-text content submitted by users, no authentication is required.

### Solution
Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30 that fix the problem described above.

### Credits
Thanks to Sybille Peters who reported this issue, and to TYPO3 core & security team member Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2023-004](https://typo3.org/security/advisory/typo3-core-sa-2023-004)
* https://github.com/w8tcha/CKEditor-WordCount-Plugin/security/advisories/GHSA-q9w4-w667-qqj4
CasaOS contains weak JWT secrets (GHSA-m5q5-8mfw-p2hr)
Aliases: CVE-2023-37266
Published: 2023-07-17T14:40:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/IceWhaleTech/CasaOS'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.4'}]}]}]

### Impact

Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances.

### Patches

The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4.

### Workarounds

Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

### References

- 705bf1f
Code injection in BoofCV (GHSA-99p5-qpqx-mhwc)
Aliases: CVE-2023-39010
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.boofcv:boofcv-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.43.1'}]}]}]

BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. This vulnerability is exploited by loading a crafted camera calibration file.
quarkus-core vulnerable to client driven TLS cipher downgrading (GHSA-3fhx-3vvg-2j84)
Aliases: CVE-2023-2974
Published: 2023-07-04T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.quarkus:quarkus-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.16.8.Final'}]}]}]

A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
vm2 Sandbox Escape vulnerability (GHSA-g644-9gfx-q4q4)
Aliases: CVE-2023-37903
Published: 2023-07-13T17:01:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vm2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.9.19'}]}]}]

In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.

### Impact
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.

### Patches
None.

### Workarounds
None.

### References
PoC is to be disclosed on or after the 5th of September.

### Similarity with [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466)
While this advisory might look similar to [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466), it is a completely different way of escaping the sandbox.

### For more information
If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.
1Panel command injection vulnerability in Firewall ip functionality (GHSA-p9xf-74xh-mhw5)
Aliases: CVE-2023-37477
Published: 2023-07-18T19:10:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/1Panel-dev/1Panel'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.4.2'}}]

### Summary
An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

### Details
1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands.

### PoC
the payload `; sleep 3 #` will lead server response in 3 seconds 
![image](https://user-images.githubusercontent.com/4935500/252299676-bc4a8b92-e475-40ee-a92a-fec9fad7a6c3.png)

the payload `; sleep 6 #` will lead server response in 6 seconds 
![image](https://user-images.githubusercontent.com/4935500/252299871-766cc411-69e5-4c6c-b4ff-7774fa974ea0.png)

### Impact
An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system.

### Patches

The vulnerability has been fixed in v1.4.3.

### Workarounds

It is recommended to upgrade the version to v1.4.3.

### References

If you have any questions or comments about this advisory:

Open an issue in https://github.com/1Panel-dev/1Panel
Email us at wanghe@fit2cloud.com
Kubernetes mountable secrets policy bypass (GHSA-cgcv-5272-97pr)
Aliases: CVE-2023-2728
Published: 2023-07-03T21:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.27.0'}, {'fixed': '1.27.3'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.26.0'}, {'fixed': '1.26.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.25.0'}, {'fixed': '1.25.11'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.24.15'}]}]}]

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module (GHSA-4hpj-8rhv-9x87)
Aliases: CVE-2023-36814
Published: 2023-07-05T22:42:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Products.CMFCore'}, 'ecosystem_specific': {'affected_functions': ['Products.CMFCore.PortalFolder.PortalFolderBase.encodeFolderFilter', 'Products.CMFCore.PortalFolder.PortalFolderBase.decodeFolderFilter']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0'}, {'fixed': '3.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Products.CMFCore'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.1'}]}]}]

### Impact
The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable.

### Patches
The code has been fixed in `Products.CMFCore` version 3.2.

### Workarounds
Users can make the affected `decodeFolderFilter` method unreachable by editing the `PortalFolder.py` module in `Products.CMFCore` by hand and then restarting Zope. Go to line 233 of `PortalFolder.py` and remove both the `@security.public` decorator for `decodeFolderFilter` as well as the method's entire docstring. This is safe because the method is not actually used by current code.

### References
- Products.CMFCore security advisory [GHSA-4hpj-8rhv-9x87](https://github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87)

### Credits
Thanks go to Nicolas VERDIER from onepoint.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in the [Products.CMFCore issue tracker](https://github.com/zopefoundation/Products.CMFCore/issues)
- Email us at [security@plone.org](mailto:security@plone.org)
Apache Tomcat - Fix for CVE-2023-24998 was incomplete (GHSA-cx6h-86xw-9x34)
Aliases: CVE-2023-28709
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0-M2'}, {'fixed': '11.0.0-M5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.1.5'}, {'fixed': '10.1.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.71'}, {'fixed': '9.0.74'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.85'}, {'fixed': '8.5.88'}]}]}]

The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.
Duplicate Advisory: @fastify/oauth2 Oauth2 state parameter reuse (GHSA-hgxv-3497-3hhj)
Published: 2023-07-04T18:30:58Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@fastify/oauth2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.2.0'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-g8x5-p9qc-cf95. This link is maintained to preserve external references.

## Original Description
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it.

v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.
Unsoundness in `intern` methods on `intaglio` symbol interners (GHSA-gch5-hwqf-mxhp)
Published: 2023-07-27T19:29:41Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'intaglio'}, 'ecosystem_specific': {'affected_functions': ['intaglio::SymbolTable::intern', 'intaglio::bytes::SymbolTable::intern', 'intaglio::cstr::SymbolTable::intern', 'intaglio::osstr::SymbolTable::intern', 'intaglio::path::SymbolTable::intern']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.0'}]}]}]

Affected versions of this crate have a stacked borrows violation when creating
references to interned contents. All interner types are affected.

The flaw was corrected in version 1.9.0 by reordering move and borrowing
operations and storing interned contents by raw pointer instead of as a `Box`.
Jenkins Test Results Aggregator Plugin vulnerable to Cross Site Request Forgery (GHSA-8gc7-whph-rx5q)
Aliases: CVE-2023-37955
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:test-results-aggregator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.13'}]}]}]

Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
TeamPass information exposure vulnerability (GHSA-2rhg-hqq9-8xjh)
Aliases: CVE-2023-3553
Published: 2023-07-08T09:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.10'}]}]}]

TeamPass prior to 3.0.10 allows unauthenticated actors to view application-specific and user data and files by viewing an endpoint directory listing.
Apache Pulsar Incorrect Authorization vulnerability (GHSA-g9cv-v3v4-3h8r)
Aliases: CVE-2023-30429
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.10.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.11.0'}, {'fixed': '2.11.1'}]}], 'versions': ['2.11.0']}]

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar.

This issue affects Apache Pulsar: before 2.10.4, and 2.11.0.

When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incorrectly performs authorization by using the Proxy's role for authorization instead of the client's role, which can lead to privilege escalation, especially if the proxy is configured with a superuser role.

The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version.

2.10 Pulsar Function Worker users should upgrade to at least 2.10.4.
2.11 Pulsar Function Worker users should upgrade to at least 2.11.1.
3.0 Pulsar Function Worker users are unaffected.
Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.
HtmlUnit Code Injection vulnerability (GHSA-3xrr-7m6p-p7xh)
Aliases: CVE-2023-26119
Published: 2023-07-06T19:24:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.sourceforge.htmlunit:htmlunit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0'}]}]}]

Versions of the package `net.sourceforge.htmlunit:htmlunit` from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.
Use after free in PaddlePaddle (GHSA-8wfh-qxxv-3q8c)
Aliases: CVE-2023-38669
Published: 2023-07-26T12:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'paddlepaddle'}, 'ecosystem_specific': {'affected_functions': ['paddle.diagonal']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.0'}]}]}]

Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. This resulted in a potentially exploitable condition.
langchain arbitrary code execution vulnerability (GHSA-2qmj-7962-cjq8)
Aliases: CVE-2023-36258
Published: 2023-07-03T21:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['langchain.chains.PALChain']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.222'}]}]}]

An issue in langchain allows an attacker to execute arbitrary code via the PALChain in the python exec method.
iprange may panic when parsing ranges with invalid masks (GHSA-f99h-w337-mv56)
Published: 2023-07-12T17:29:24Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/malfunkt/iprange'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9.0'}]}]}]

Parsing a range with a mask larger than 32 bits causes a panic.
Jenkins ElasticBox CI Plugin missing permission check (GHSA-gg44-xm5p-x9cm)
Aliases: CVE-2023-37965
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:elasticbox'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.0.3'}]}]}]

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Credential leakage in Jenkins Plug-in for ServiceNow  (GHSA-rchx-rvh2-vx5j)
Aliases: CVE-2023-3414
Published: 2023-07-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:servicenow-devops'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.38.1'}]}]}]

A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server.  No changes are required on your instances of the Now Platform.
Easy!Appointments Improper Access Control vulnerability (GHSA-8c6q-26w6-qwhg)
Aliases: CVE-2023-3700
Published: 2023-07-17T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'alextselegidis/easyappointments'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.4.3'}}]

Easy!Appointments 1.4.3 and prior has an Improper Access Control vulnerability. This issue is patched at commit b37b46019553089db4f22eb2fe998bca84b2cb64 and anticipated to be part of version 1.5.0.
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API (GHSA-6xxr-648m-gch6)
Aliases: CVE-2023-37277
Published: 2023-07-10T21:53:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rest-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '14.10.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.xpn.xwiki.platform:xwiki-core-rest-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '14.10.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.xpn.xwiki.platform:xwiki-rest'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '14.10.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rest-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.2'}]}]}]

### Impact

The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-urlencoded` as content types which can be sent via regular HTML forms, thus allowing cross-site request forgery. With the interaction of a user with programming rights, this allows remote code execution through script macros and thus impacts the integrity, availability and confidentiality of the whole XWiki installation.

For regular cookie-based authentication, the vulnerability is mitigated by SameSite cookie restrictions but as of March 2023, these are not enabled by default in Firefox and Safari.

### Patches
The vulnerability has been patched in XWiki 14.10.8 and 15.2 by requiring a CSRF token header for certain request types that are susceptible to CSRF attacks.

### Workarounds

It is possible to check for the `Origin` header in a reverse proxy to protect the REST endpoint from CSRF attacks, see [the Jira issue](https://jira.xwiki.org/browse/XWIKI-20135) for an example configuration.

### References

* https://jira.xwiki.org/browse/XWIKI-20135
* https://github.com/xwiki/xwiki-platform/commit/4c175405faa0e62437df397811c7526dfc0fbae7
CSRF vulnerability in Bazaar Plugin  (GHSA-6f4q-f5fj-q6fc)
Aliases: CVE-2023-39156
Published: 2023-07-26T15:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:bazaar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.22'}]}]}]

Jenkins Bazaar Plugin 1.22 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to delete previously created Bazaar SCM tags.
sweetalert2 v11.6.14 and above contains potentially undesirable behavior (GHSA-mrr8-v49w-3333)
Published: 2023-07-10T19:08:10Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'sweetalert2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.6.14'}]}]}]

`sweetalert2` versions 11.6.14 and above have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on the project's readme