aswin1906/github-advisory-2023 huggingface dataset:
XWiki Platform vulnerable to code injection in display method used in user profiles (GHSA-x764-ff8r-9hpx)
Aliases: CVE-2023-29523
Published: 2023-04-20T22:16:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.3-milestone-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.2'}]}]}]

### Impact

Any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The following syntax, to be put, e.g., in the about section of the user profile, demonstrates a proof of concept:

```
{{html wiki="true"}}~{~{~/~h~t~m~l~}~}~ ~{~{~c~a~c~h~e~}~}~{~{~g~r~o~o~v~y~}~}~p~r~i~n~t~l~n~(~1~)~{~{~/~g~r~o~o~v~y~}~}~{~{~/~c~a~c~h~e~}~}~{{/html}}
```

While it would be expected that the above code is displayed just without the `~`, in fact just "1" is displayed, followed by a lot of raw HTML code. The same vulnerability can also be exploited in other contexts where the `display` method on a document is used to display a field with wiki syntax, for example in applications created using [App Within Minutes](https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application).

### Patches
This has been patched in XWiki 13.10.11, 14.4.8, 14.10.2 and 15.0RC1.

### Workarounds
There is no workaround apart from upgrading.

### References
* https://jira.xwiki.org/browse/XWIKI-20327
* https://github.com/xwiki/xwiki-platform/commit/0d547181389f7941e53291af940966413823f61c

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability (GHSA-c885-89fw-55qr)
Aliases: CVE-2023-29202
Published: 2023-04-12T20:38:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-core-rendering-macro-rss'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'last_affected': '3.0.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-macro-rss'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.6-rc-1'}]}]}]

### Impact
The [RSS macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/RSS%20Macro) that is bundled in XWiki included the content of the feed items without any cleaning in the HTML output when the parameter `content` was set to `true`. This allowed arbitrary HTML and in particular also JavaScript injection and thus cross-site scripting (XSS) by specifying an RSS feed with malicious content. With the interaction of a user with programming rights, this could be used to execute arbitrary actions in the wiki, including privilege escalation, remote code execution, information disclosure, modifying or deleting content and sabotaging the wiki.

The issue can be reproduced by inserting the following XWiki syntax in any wiki page like the user account:

```javascript
{{rss feed="https://xssrss.blogspot.com/feeds/posts/default?alt=rss" content="true" /}}
```

If an alert is displayed when viewing the page, the wiki is vulnerable.

### Patches
The issue has been patched in XWiki 14.6 RC1, the content of the feed is now properly cleaned before being displayed.

### Workarounds
If the RSS macro isn't used in the wiki, the macro can be uninstalled by deleting `WEB-INF/lib/xwiki-platform-rendering-macro-rss-XX.jar`, where `XX` is XWiki's version, in the web application's directory.

### References
* https://github.com/xwiki/xwiki-platform/commit/5c7ebe47c2897e92d8f04fe2e15027e84dc3ec03
* https://jira.xwiki.org/browse/XWIKI-19671

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
pimcore is vulnerable to cross-site scripting in Composite indices key field (GHSA-4f25-2x2c-vg6v)
Aliases: CVE-2023-1703
Published: 2023-04-04T15:21:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

### Impact
Pimcore is vulnerable to Cross site scripting vulnerability in classes module.

### Patches
Update to version 10.5.20.

### Workarounds
Apply the patch https://github.com/pimcore/pimcore/commit/765832f0dc5f6cfb296a82e089b701066f27bcef.patch manually.
Jenkins Report Portal Plugin missing permissions check (GHSA-c9jf-rhvg-p65r)
Aliases: CVE-2023-30526
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:reportportal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.5'}]}]}]

Jenkins Report Portal Plugin 0.5 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Arbitrary javascript injection in Apache Jena (GHSA-xgh5-gwq5-rpx8)
Aliases: CVE-2023-22665
Published: 2023-04-25T09:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.jena:jena'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.8.0'}]}]}]

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.
Cross site scripting (XSS) in wwbn/avideo (GHSA-2fch-hv74-fgw9)
Published: 2023-04-26T19:42:30Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wwbn/avideo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.4'}]}]}]

Description:

While making an account in demo.avideo.com I found a parameter "?success=" which did not sanitize any symbol character properly which leads to XSS attack.

Impact:

Since there's an Admin account on demo.avideo.com attacker can use this attack to Takeover the admin's account

Step to Reproduce:

1. Click the link below

[https://demo.avideo.com/user?success="><img](https://demo.avideo.com/user?success=%22%3E%3Cimg) src=x onerror=alert(document.cookie)>

2. Then XSS will be executed
Duplicate Advisory: Arbitrary code execution in jfinal CMS (GHSA-gh24-c683-79r2)
Aliases: CVE-2023-26812
Published: 2023-04-28T21:30:19Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.jflyfox:jflyfox_jfinal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.1.0'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8qhm-ch8h-xgjr. This link is maintained to preserve external references.

## Original Description
Command execution vulnerability in the ActionEnter Class ins jfinal CMS version 5.1.0 allows attackers to execute arbitrary code via a created json file to the ueditor route.
`chainId` may be outdated if user changes chains as part of connection in @web3-react (GHSA-8pf3-6fgr-3g3g)
Aliases: CVE-2023-30543
Published: 2023-04-18T22:29:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@web3-react/coinbase-wallet'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '8.0.35-beta.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@web3-react/eip1193'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '8.0.27-beta'}]}], 'database_specific': {'last_known_affected_version_range': '< 8.0.27-beta.0'}}, {'package': {'ecosystem': 'npm', 'name': '@web3-react/metamask'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '8.0.30-beta.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@web3-react/walletconnect'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '8.0.37-beta.0'}]}]}]

### Impact
`chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may be incorrect. In an application, this means that any data derived from `chainId` could be incorrect.

For example, if a swapping application derives a wrapped token contract address from the `chainId` *and* a user has changed chains as part of their connection flow the application could cause the user to send funds to the incorrect address when wrapping. This is a common approach when using other foundational libraries like [`ethers`](https://github.com/ethers-io/ethers.js), and most users of v8 will want to upgrade past the affected versions.

### Patches
Patched in https://github.com/Uniswap/web3-react/pull/749.
Users of web3-react@8.0.x-beta.0 should upgrade to at least:
 - @web3-react/coinbase-wallet@^8.0.35-beta.0
 - @web3-react/eip1193@^8.0.27-beta.0
 - @web3-react/metamask@^8.0.30-beta.0
 - @web3-react/walletconnect@^8.0.37-beta.0

### Workarounds
N/A

### References
N/A
Answer vulnerable to Insertion of Sensitive Information Into Sent Data (GHSA-65v8-6pvw-jwvq)
Aliases: CVE-2023-1975
Published: 2023-04-11T12:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.8'}]}]}]

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 does not strip EXIF geolocation data from user-uploaded logos. As a result, anyone can get sensitive information like a user's device ID, geolocation, system information, system version, etc.
PowerJob vulnerable to remote code execution (GHSA-9mh9-44q3-v79x)
Aliases: CVE-2023-29926
Published: 2023-04-20T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'tech.powerjob:powerjob'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.2'}]}]}]

PowerJob V4.3.2 has unauthorized interface that causes remote code execution.
Withdrawn: SQL injection in Yii 2 (GHSA-gq63-p39p-jrjf)
Aliases: CVE-2023-26750
Published: 2023-04-04T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'yiisoft/yii2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.47'}]}]}]

## Withdrawn Advisory
This advisory has been withdrawn because the issue originates from a product built on Yii2, not the Yii2 Framework itself. This link is maintained to preserve external references.

## Original Description
SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code via the runAction function.
AzuraCast/AzuraCast vulnerable to cross-site scripting  (GHSA-q55c-hmpf-6h2g)
Aliases: CVE-2023-2191
Published: 2023-04-20T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'azuracast/azuracast'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.18.0'}]}]}]

AzuraCast/AzuraCast prior to version 0.18.0 is vulnerable to stored cross-site scripting. An issue was identified where a user who already had an AzuraCast account could update their display name to inject malicious JavaScript into the header menu of the site. In a majority of cases, this menu is only visible to the current logged-in user (pages like the `Administer Users` page are unaffected by this vulnerability), but if a higher-privileged administrator uses the `Log In As` feature to masquerade as a user, then the JavaScript injection could exfiltrate certain data. Anonymous members of the public cannot exploit this vulnerability in an AzuraCast installation, so it is primarily of concern for multi-tenant installations (i.e. resellers).
OpenFeature Operator vulnerable to Cluster-level Privilege Escalation (GHSA-cwf6-xj49-wp83)
Aliases: CVE-2023-29018
Published: 2023-04-12T20:40:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/open-feature/open-feature-operator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.32'}]}]}]

### Impact

On a node controlled by an attacker or malicious user, the lax permissions configured on `open-feature-operator-controller-manager` can be used to further escalate the privileges of any service account in the cluster.

The increased privileges could be used to modify cluster state, leading to DoS, or read sensitive data, including secrets.

### Patches

The patch mitigates this issue by restricting the resources the `open-feature-operator-controller-manager` can modify.
Remote code execution in broccoli-compass (GHSA-wq8f-xmq3-5vq9)
Aliases: CVE-2023-27848
Published: 2023-04-24T18:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'broccoli-compass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.2.4'}]}]}]

broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
Firefly III vulnerable to improper input validation (GHSA-mwxw-hxvp-4r2r)
Aliases: CVE-2023-1789
Published: 2023-04-01T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'grumpydictator/firefly-iii'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.0'}]}]}]

Firefly III versions prior to 6.0.0 are vulnerable to improper input validation.
Stored cross site scripting in RSS displayer (GHSA-fgxj-g7x3-85cq)
Aliases: CVE-2023-28820
Published: 2023-04-28T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.1.0'}]}]}]

Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element input was not sanitized.
XWiki Platform vulnerable to privilege escalation from view right using Invitation.InvitationCommon (GHSA-px54-3w5j-qjg9)
Aliases: CVE-2023-29518
Published: 2023-04-20T22:04:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5-m-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.1'}]}]}]

### Impact
Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Invitation.InvitationCommon`. This page is installed by default.

See https://jira.xwiki.org/browse/XWIKI-20283 for the reproduction steps.

### Patches
The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.

### Workarounds
The issue can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/3d055a0a5ec42fdebce4d71ee98f94553fdbfebf) on `Invitation.InvitationCommon`.

### References
- https://github.com/xwiki/xwiki-platform/commit/3d055a0a5ec42fdebce4d71ee98f94553fdbfebf
- https://jira.xwiki.org/browse/XWIKI-20283

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
SQL Injection in AssetController (GHSA-4x35-vr82-xvj6)
Aliases: CVE-2023-2338
Published: 2023-04-27T17:15:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
SQL injections in AssetController due to unsanitized concatenating strings in where clause. The attacker can dump database, alter data or perform dos on the backend database.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520.patch manually.

### References
https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462/
Strapi does not verify the access or ID tokens issued during the OAuth flow (GHSA-583x-23h9-f5w7)
Aliases: CVE-2023-22893
Published: 2023-04-19T18:33:22Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@strapi/plugin-users-permissions'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.1'}, {'fixed': '4.6.0'}]}]}]

Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
HTTP Multiline Header Termination (GHSA-xv3h-4844-9h36)
Aliases: CVE-2023-29530
Published: 2023-04-24T22:42:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.18.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.19.0'}, {'fixed': '2.19.1'}]}], 'versions': ['2.19.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.20.0'}, {'fixed': '2.20.1'}]}], 'versions': ['2.20.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.21.0'}, {'fixed': '2.21.1'}]}], 'versions': ['2.21.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.22.0'}, {'fixed': '2.22.1'}]}], 'versions': ['2.22.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.23.0'}, {'fixed': '2.23.1'}]}], 'versions': ['2.23.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.24.0'}, {'fixed': '2.24.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'laminas/laminas-diactoros'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.25.0'}, {'fixed': '2.25.2'}]}]}]

### Impact

Affected versions of Laminas Diactoros accepted a single line feed (LF / `\n` ) character at the end of a header name. When serializing such a header name containing a line-feed into the on-the-wire representation of a HTTP/1.x message, the resulting message would be syntactically invalid, due to the header line being terminated too early. An attacker that is able to control the header names that are passed to Laminas Diactoros would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.

### Patches

The problem has been patched in the following versions:

- 2.18.1
- 2.19.1
- 2.20.1
- 2.21.1
- 2.22.1
- 2.23.1
- 2.24.2
- 2.25.2

### Workarounds

Validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling `withHeader()`.

### References

- CVE-2023-29197
- GHSA-wxmh-65f7-jcvw
OutOfMemoryError for large multipart without filename in Eclipse Jetty (GHSA-qw69-rqj8-6qw8)
Aliases: CVE-2023-26048
Published: 2023-04-19T18:15:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.4.51.v20230217'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.0.14'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '11.0.14'}]}]}]

### Impact
Servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and a very large content.

This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk.

An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`.
However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time.

A very large number of parts may cause the same problem.

### Patches
Patched in Jetty versions

* 9.4.51.v20230217 - via PR #9345
* 10.0.14 - via PR #9344
* 11.0.14 - via PR #9344

### Workarounds
Multipart parameter `maxRequestSize` must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).
Limiting multipart parameter `maxFileSize` won't be enough because an attacker can send a large number of parts that summed up will cause memory issues.

### References
* https://github.com/eclipse/jetty.project/issues/9076
* https://github.com/jakartaee/servlet/blob/6.0.0/spec/src/main/asciidoc/servlet-spec-body.adoc#32-file-upload
Spring Framework vulnerable to denial of service (GHSA-wxqc-pxw9-g2p8)
Aliases: CVE-2023-20863
Published: 2023-04-13T21:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.3.0'}, {'fixed': '5.3.27'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.2.24.RELEASE'}]}]}]

In Spring Framework versions prior to 5.2.24.release+ , 5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted Spring Expression Language (SpEL) expression that may cause a denial-of-service (DoS) condition.
Silverstripe Form Capture vulnerable to stored cross-site-scripting (GHSA-38h6-gmr2-j4wx)
Aliases: CVE-2023-28851
Published: 2023-04-03T21:06:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'bigfork/silverstripe-form-capture'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.1.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'andrewhaine/silverstripe-form-capture'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'fixed': '1.0.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.2.3'}}, {'package': {'ecosystem': 'Packagist', 'name': 'andrewhaine/silverstripe-form-capture'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.2.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'andrewhaine/silverstripe-form-capture'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.2'}]}]}]

### Impact
Improper escaping when presenting stored form submissions allowed for an attacker to perform a Cross-Site Scripting attack

### Patches
The vulnerability was initially patched in version 1.0.2, and version 1.1.0 includes this patch. The bug was then accidentally re-introduced during a merge error, and has been re-patched in versions 2.2.5 and 3.1.1.
thorsten/phpmyfaq vulnerable to business logic errors (GHSA-gx43-fqrx-6fcw)
Aliases: CVE-2023-1887
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 allows users with edit-only permissions to add and delete categories and add FAQs. This has been fixed in 3.1.12.
PowerJob vulnerable to incorrect access control (GHSA-c6mx-3fj9-9j7q)
Aliases: CVE-2023-29924
Published: 2023-04-21T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'tech.powerjob:powerjob'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.1'}]}]}]

PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.
Jenkins Report Portal Plugin configuration form does not mask tokens (GHSA-j55j-28wc-v338)
Aliases: CVE-2023-30524
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:reportportal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.5'}]}]}]

Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.
thorsten/phpmyfaq vulnerable to DOM cross-site scripting (XSS) via configuration privacy note URL parameter (GHSA-jph3-3j24-pg3j)
Aliases: CVE-2023-1882
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to DOM cross-site scripting (XSS) because it fails to sanitize user input in the configuration privacy note URL parameter. This has been fixed in 3.1.12.
Microweber vulnerable to command injection (GHSA-582p-2fpg-x226)
Aliases: CVE-2023-1877
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.3'}]}]}]

microweber/microweber prior to 1.3.3 is vulnerable to command injection in the "first name" field. This allows for server-side template injection, which can lead to arbitrary code execution.
Insufficient token expiration in Serenity (GHSA-2hp9-3xfr-r9w2)
Aliases: CVE-2023-31287
Published: 2023-04-27T03:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Serenity.Net.Core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.7.0'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Serenity.Net.Web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.7.0'}]}]}]

An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. Password reset links are sent by email. A link contains a token that is used to reset the password. This token remains valid even after the password reset and can be used a second time to change the password of the corresponding user. The token expires only 3 hours after issuance and is sent as a query parameter when resetting. An attacker with access to the browser history can thus use the token again to change the password in order to take over the account.
Pimcore Perspective Editor vulnerable to stored cross-site scripting (XSS) in perspective name (GHSA-fq8q-55v3-2986)
Aliases: CVE-2023-28850
Published: 2023-04-03T18:58:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/perspective-editor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.1'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 1.5.1.

### Workarounds
Apply the patch https://github.com/pimcore/perspective-editor/pull/121.patch manually.
Apache DolphinScheduler's python gateway suffered from improper authentication (GHSA-3jxw-cv35-2mmv)
Aliases: CVE-2023-25601
Published: 2023-04-20T18:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.dolphinscheduler:dolphinscheduler-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.1.2'}]}]}]

On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above.
froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type (GHSA-qwvp-g9j7-28f6)
Aliases: CVE-2023-2034
Published: 2023-04-14T03:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.14'}]}]}]

Image files uploaded in froxlor/froxlor prior to 2.0.14 were not properly validated which could result in remote code execution via path manipulation.
Stored cross site scripting via container name (GHSA-9h33-5fxw-r2xv)
Aliases: CVE-2023-28471
Published: 2023-04-28T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.0'}]}]}]

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS via a container name.
Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted (GHSA-96c7-fqxv-rmv7)
Aliases: CVE-2023-30530
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:consul-kv-builder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.13'}]}]}]

Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file `org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml` on the Jenkins controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it.
thorsten/phpmyfaq vulnerable to cross-site scripting (XSS) via stopword parameter (GHSA-gmjj-g2rm-xwm7)
Aliases: CVE-2023-1884
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to cross-site scripting (XSS) because it fails to sanitize user input in the `stopword` parameter. This has been fixed in 3.1.12.
Arbitrary File Read in Admin JS CSS files (GHSA-j5c3-r84f-9596)
Aliases: CVE-2023-30852
Published: 2023-04-27T23:10:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact

It was observed that the `/admin/misc/script-proxy` API endpoint accessible by an authenticated administrator user and is vulnerable arbitrary JavaScript, CSS file read via the "scriptPath" and "scripts" parameters. The "scriptPath" parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of "../" patterns to go out from the application webroot followed by path of the folder where the file is located in the "scriptPath" parameter and the file name in the "scripts" parameter. The JavaScript file is successfully read only if the web application has read access to it.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/1d128404eddf4beb560d434437347da7aea059eb.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/1d128404eddf4beb560d434437347da7aea059eb.patch manually.

### References
https://github.com/pimcore/pimcore/pull/14959
HTML injection in search results via plaintext message highlighting (GHSA-xv83-x443-7rmw)
Aliases: CVE-2023-30609
Published: 2023-04-25T19:48:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-react-sdk'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.71.0'}]}]}]

### Impact
Plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message containing an HTML injection payload.

Cross-site scripting is possible by including resources from `recaptcha.net` and `gstatic.com` which are included in the default CSP.

Thanks to [Cadence Ember](https://cadence.moe/) for finding the injection and to [S1m](https://github.com/p1gp1g/) for finding possible XSS vectors.

### Patches
Version 3.71.0 of the SDK fixes the issue.

### Workarounds
Restarting the client will clear the injection.
Insecure header validation in slim/psr7 (GHSA-q2qj-628g-vhfw)
Aliases: CVE-2023-30536
Published: 2023-04-18T22:20:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'slim/psr7'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.6'}, {'fixed': '1.6.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'slim/psr7'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5'}, {'fixed': '1.5.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'slim/psr7'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.1'}]}]}]

### Impact

An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`. An attacker that is able to control the header names that are passed to Slilm-Psr7 would be able to intentionally craft invalid messages, possibly causing application errors or invalid HTTP requests being sent out with an PSR-18 HTTP client. The latter might present a denial of service vector if a remote service’s web application firewall bans the application due to the receipt of malformed requests.

### Patches

The issue is patched in 1.6.1, 1.5.1, and 1.4.1.

### Workarounds

In Slim-Psr7 prior to 1.6.1, 1.5.1, and 1.4.1, validate HTTP header keys and/or values, and if using user-supplied values, filter them to strip off leading or trailing newline characters before calling withHeader().

### Acknowledgments

We are very grateful to and thank <a href="https://gjcampbell.co.uk/">Graham Campbell</a> for reporting and working with us on this issue.

### References

* Guzzle: CVE-2023-29197, with advisory GHSA-wxmh-65f7-jcvw
* Laminas Diactoros: CVE-2023-29530, with advisory GHSA-xv3h-4844-9h36
* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery (GHSA-wq3w-3rxh-vcxx)
Aliases: CVE-2023-28671
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkinsci.plugins:octoperf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.1'}]}]}]

OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier does not require POST requests for a connection test HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

OctoPerf Load Testing Plugin Plugin 4.5.1 requires POST requests for the affected connection test HTTP endpoint.
vm2 Sandbox Escape vulnerability (GHSA-ch3r-j5x3-6q2m)
Aliases: CVE-2023-30547
Published: 2023-04-20T14:37:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vm2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.17'}]}]}]

There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context.

### Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches
This vulnerability was patched in the release of version `3.9.17` of `vm2`.

### Workarounds
None.

### References
PoC - https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.
eslint-detailed-reporter vulnerable to cross-site scripting (GHSA-4xr4-89m5-46c7)
Aliases: CVE-2022-4942
Published: 2023-04-20T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'eslint-detailed-reporter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9.0'}]}]}]

A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in the library lib/template-generator.js. The manipulation of the argument message leads to cross site scripting. The attack may be launched remotely. The name of the patch is 505c190efd4905990db6207863bdcbd9b1d7e1bd. It is recommended to apply a patch to fix this issue. VDB-226310 is the identifier assigned to this vulnerability.
Jenkins Report Portal Plugin Cross-Site Request Forgery vulnerability (GHSA-c8ff-j5gm-6492)
Aliases: CVE-2023-30525
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:reportportal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.5'}]}]}]

Jenkins Report Portal Plugin 0.5 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified bearer token authentication. Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Prototype Pollution in vConsole (GHSA-f737-3fh6-jf6w)
Aliases: CVE-2023-30363
Published: 2023-04-26T21:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vconsole'}, 'ecosystem_specific': {'affected_functions': ['vConsole.setOption']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.15.1'}]}]}]

vConsole was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
Cross-site Scripting (XSS) in Admin Login too many attempts notice (GHSA-fq95-rx4q-qgg2)
Aliases: CVE-2023-2341
Published: 2023-04-27T17:12:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attacker can obtain a user's session cookie, they can then impersonate that user.

Furthermore, JavaScript can read and make arbitrary modifications to the contents of a page being displayed to a user. Therefore, XSS in conjunction with some clever social engineering opens up a lot of possibilities for an attacker.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11.patch manually.

### References
https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d/
Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files (GHSA-33pv-vcgh-jfg9)
Aliases: CVE-2023-28837
Published: 2023-04-03T19:18:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'wagtail'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2'}, {'fixed': '4.2.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'wagtail'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.4'}]}]}]

### Impact

A memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both images and documents, files are loaded into memory during upload for additional processing. A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. It can only be exploited by admin users with permission to upload images or documents.

Image uploads are [restricted to 10MB by default](https://docs.wagtail.org/en/stable/reference/settings.html#wagtailimages-max-upload-size), however this validation only happens on the frontend and on the backend after the vulnerable code. 

### Patches

Patched versions have been released as Wagtail 4.1.4 (for the LTS 4.1 branch) and Wagtail 4.2.2 (for the current 4.2 branch).

### Workarounds

Site owners who are unable to upgrade to the new versions are encouraged to add extra protections outside of Wagtail to limit the size of uploaded files. Exactly how this is done will vary based on your hosting environment, but here are a few references for common setups:

- Nginx: [`client_max_body_size`](https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size)
- Apache: [`LimitRequestBody`](https://httpd.apache.org/docs/2.4/mod/core.html#limitrequestbody)
- Cloudflare: Already [imposes a limit of 100MB - 500MB](https://developers.cloudflare.com/cache/about/default-cache-behavior#customization-options-and-limitations) depending on plan
- CloudFront: [`SizeConstraint`](https://docs.aws.amazon.com/waf/latest/APIReference/API_SizeConstraintStatement.html)
- Traefik: [`traefik.http.middlewares.limit.buffering.maxRequestBodyBytes`](https://doc.traefik.io/traefik/middlewares/http/buffering/#maxrequestbodybytes)

The changes themselves are deep inside Wagtail, making patching incredibly difficult.
Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connections (GHSA-p3w6-3f7f-pm98)
Aliases: CVE-2023-28675
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkinsci.plugins:octoperf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.5.2'}}]

Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials.

Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

OctoPerf Load Testing Plugin Plugin 4.5.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
pretalx allows path traversal in HTML export (GHSA-23fx-92m6-4f2g)
Aliases: CVE-2023-28458
Published: 2023-04-20T21:33:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pretalx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.2'}]}]}]

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.