aswin1906/github-advisory-2023 huggingface dataset:
Mattermost Incorrect Authorization vulnerability (GHSA-h8wh-f7gw-fwpr)
Aliases: CVE-2023-5193
Published: 2023-09-29T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.1.1'}]}], 'versions': ['8.1.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.10'}]}]}]

Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to read the posts of a DM conversation.
Apache Superset Deserialization of Untrusted Data vulnerability (GHSA-fj4x-m62j-wvwg)
Aliases: CVE-2023-37941
Published: 2023-09-06T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '2.1.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.1.0'}}]

If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges. This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
Cros secrets may be disclosed to untrusted relay (GHSA-hp56-xvf4-g6wr)
Aliases: CVE-2023-43617
Published: 2023-09-20T06:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/schollz/croc/v9'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.6.5'}]}]}]

An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.
graphql Uncontrolled Resource Consumption vulnerability (GHSA-9pv7-vfvm-6vr7)
Aliases: CVE-2023-26144
Published: 2023-09-20T06:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'graphql'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.3.0'}, {'fixed': '16.8.1'}]}]}]

Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the OverlappingFieldsCanBeMergedRule.ts file when parsing large queries. This vulnerability allows an attacker to degrade system performance.

**Note:** It was not proven that this vulnerability can crash the process.
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again) (GHSA-92jh-gwch-jq38)
Published: 2023-09-14T17:10:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.3.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.3.0'}}, {'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.23.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.23.0'}}]

### Impact
An attacker could crash the server by sending malformed JWT JSON in `LoginPacket` due to a security vulnerability in [`netresearch/jsonmapper`](https://github.com/cweiske/JsonMapper), due to accepting `NULL` values in arrays whose types do not expect `NULL`.

### Patches
This problem was fixed in 5.3.1 and 4.23.1 by updating JsonMapper to include the following commit: pmmp/netresearch-jsonmapper@4f90e8dab1c9df331fad7d3d89823404e882668c

### Workarounds
A plugin may handle `DataPacketReceiveEvent` for `LoginPacket` and check that none of the input arrays contain `NULL` where it's not expected, but this is rather cumbersome.
PocketMine-MP server crash due to incorrect EC curve used for LoginPacket identityPublicKey (GHSA-79rc-jjh6-rc89)
Published: 2023-09-14T17:10:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.2.0'}, {'fixed': '5.3.1'}]}]}]

### Impact
The server uses ECDH to calculate a shared secret for the symmetric encryption key used to encrypt network packets after logging in. ECDH requires that the keys used must both belong to the same elliptic curve. In Minecraft: Bedrock Edition, the curve used is `secp384r1`.

Using any other curve (for example `secp256r1`) to sign the `LoginPacket` JWTs would lead to successfully verifying the login chain, but would later crash due to an uncaught exception during ECDH key derivation due to the client-provided key belonging to a different curve than the server's key. It's also theoretically possible that a non-EC key could be used (e.g. RSA or DH), which would also pass login verification as long as SHA384 hashing algorithm was used for the JWT signatures, and also lead to a crash.

### Patches
The problem was fixed in 4.23.1 and 5.3.1 in the following commit: 4e646d19a4a1e0d082bd4d1f5a58ae0182a268d9
While 4.x would not have crashed when this was encountered, the faulty validation code has also been corrected there.

### Workarounds
A plugin could handle `LoginPacket` and check that all of the `identityPublicKey`s provided in the JWT bodies actually belong to `secp384r1`. This can be checked by verifying that `openssl_pkey_get_details($key)["ec"]["curve_name"]` is set and equal to `secp384r1`. Beware that this element may not exist if the key is not an EC key at all.
Mattermost Uncontrolled Resource Consumption vulnerability (GHSA-33r7-wjfc-7w98)
Aliases: CVE-2023-5196
Published: 2023-09-29T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.1.1'}]}], 'versions': ['8.1.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.10'}]}]}]

Mattermost fails to enforce character limits in all possible notification props allowing an attacker to send a really long value for a notification_prop resulting in the server consuming an abnormal quantity of computing resources and possibly becoming temporarily unavailable for its users.
phonenumber panics on parsing crafted RF3966 inputs (GHSA-whhr-7f2w-qqj2)
Aliases: CVE-2023-42444
Published: 2023-09-21T17:10:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'phonenumber'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.5'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'phonenumber'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.0'}, {'fixed': '0.3.3'}]}]}]

### Impact
The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string.

In a typical deployment of `rust-phonenumber`, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string `.;phone-context=`.

### Patches
Patches will be published as version `0.3.3+8.13.9` and backported as `0.2.5+8.11.3`.

### Workarounds
n.a.

### References
n.a.
@napi-rs/image affected by libwebp CVE (GHSA-4vjr-crvh-383h)
Published: 2023-09-27T20:17:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@napi-rs/image'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.0'}]}]}]

### Impact
Heap buffer overflow in `libwebp` allows a remote attacker to perform an out of bounds memory write via a crafted webp image.

### References
- https://github.com/advisories/GHSA-j7hp-h8jx-5ppr
- https://blog.isosceles.com/the-webp-0day/
Consensys gnark-crypto allows Signature Malleability (GHSA-9xfq-8j3r-xp5g)
Aliases: CVE-2023-44273
Published: 2023-09-28T06:30:20Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/Consensys/gnark-crypto'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.0'}]}]}]

Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.
Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability (GHSA-58rq-69jp-xc23)
Aliases: CVE-2023-43500
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.2'}]}]}]

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a permission check in a connection test HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Build Failure Analyzer Plugin 2.4.2 requires POST requests and Overall/Administer permission for the affected HTTP endpoint.
CefSharp affected by heap buffer overflow in WebP (GHSA-j646-gj5p-p45g)
Published: 2023-09-21T17:11:42Z
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'CefSharp.Common'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '116.0.230'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'CefSharp.Common.NETCore'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '116.0.230'}]}]}]

**Google is aware that an exploit for [CVE-2023-4863](https://www.cve.org/CVERecord?id=CVE-2023-4863) exists in the wild.**

### Description

Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

### References

- https://www.cve.org/CVERecord?id=CVE-2023-4863
- https://nvd.nist.gov/vuln/detail/CVE-2023-4863
- https://www.techtarget.com/searchsecurity/news/366551978/Browser-companies-patch-critical-zero-day-vulnerability
PrestaShop allows employee without any access rights to list all installed modules (GHSA-gvrg-62jp-rf7j)
Aliases: CVE-2023-43664
Published: 2023-09-28T16:26:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.2'}]}]}]

### Impact
In BO, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights

### Patches
Fixed on 8.1.2

### Workarounds

### References
Croc sender may send dangerous new files to receiver (GHSA-ppjh-xp5v-46wc)
Aliases: CVE-2023-43619
Published: 2023-09-20T06:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/schollz/croc/v9'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.6.5'}]}]}]

An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a `.ssh/authorized_keys` file.
Mattermost Incorrect Authorization vulnerability (GHSA-9hwp-cj7m-wjw4)
Aliases: CVE-2023-5195
Published: 2023-09-29T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.1.1'}]}], 'versions': ['8.1.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.10'}]}]}]

Mattermost fails to properly validate the permissions when soft deleting a team allowing a team member to soft delete other teams that they are not part of
blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API (GHSA-6f9p-g466-f8v8)
Aliases: CVE-2023-26143
Published: 2023-09-19T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'blamer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}]}]

Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. The library does not sanitize for user input or validate the given file path conforms to a specific schema, nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options.
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled (GHSA-gxh7-wv9q-fwfr)
Aliases: CVE-2023-23623
Published: 2023-09-06T18:42:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '22.0.0-beta.1'}, {'fixed': '22.0.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['https://github.com/electron/electron/commit/9e7fbc7021d8d716c43782249a552e55289c35db']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.0.0-alpha.1'}, {'fixed': '23.0.0-alpha.2'}]}]}]

### Impact
A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox and contextIsolation disabled.  i.e. `sandbox: false` and `contextIsolation: false` in the `webPreferences` object.

This resulted in incorrectly allowing usage of methods like `eval()` and `new Function`, which can result in an expanded attack surface.

### Patches
This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes:

- 22.0.1
- 23.0.0-alpha.2

We recommend all apps upgrade to the latest stable version of Electron, especially if they use `sandbox: false` or `contextIsolation: false`.

### Workarounds
If upgrading isn't possible, this issue can be addressed without upgrading by enabling at least one of `sandbox: true` or `contextIsolation: true` on all renderers.

```js
const mainWindow = new BrowserWindow({
  webPreferences: {
    sandbox: true,
  }
});
```

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).

### Credit
Thanks to user @andreasdj for reporting this issue.
Improper Input Validation in nocodb (GHSA-xrpm-hccg-28x7)
Aliases: CVE-2023-5104
Published: 2023-09-21T09:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'nocodb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.96.0'}]}]}]

Improper Input Validation in GitHub repository nocodb/nocodb prior to 0.96.0.
Vulnerable OpenSSL included in cryptography wheels (GHSA-v8gr-m533-ghj9)
Published: 2023-09-21T17:07:01Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'cryptography'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5'}, {'fixed': '41.0.4'}]}]}]

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
pretix allows Pillow to parse EPS files (GHSA-9jvx-p6mq-fw4v)
Aliases: CVE-2023-44464
Published: 2023-09-29T06:30:29Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pretix'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2023.7.2'}]}]}]

pretix before 2023.7.2 allows Pillow to parse EPS files.
pgAdmin failed to properly control the server code  (GHSA-ghp8-52vx-77j4)
Aliases: CVE-2023-5002
Published: 2023-09-22T15:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pgadmin4'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.7'}]}]}]

A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.7 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
systeminformation SSID Command Injection Vulnerability (GHSA-gx6r-qc2v-3p3v)
Aliases: CVE-2023-42810
Published: 2023-09-21T17:15:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'systeminformation'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.21.7'}]}]}]

### Impact
SSID Command Injection Vulnerability

### Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.21.7, Version 4 was not affected

### Workarounds
If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to wifiConnections(), wifiNetworks() (string only)

### References
See also https://systeminformation.io/security.html
Jenkins temporary uploaded file created with insecure permissions (GHSA-hq87-h4jg-vxfw)
Aliases: CVE-2023-43498
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.50'}, {'fixed': '2.414.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.415'}, {'fixed': '2.424'}]}]}]

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API `MultipartFormDataParser` create temporary files in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, attackers with access to the system temporary directory may be able to read and write the file before it is used.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.
Jenkins 2.424, LTS 2.414.2 creates the temporary files in a subdirectory with more restrictive permissions.

As a workaround, you can change your default temporary-file directory using the Java system property `java.io.tmpdir`, if you’re concerned about this issue but unable to immediately update Jenkins.
Mattermost Incorrect Authorization vulnerability (GHSA-h69v-mvh9-hfrq)
Aliases: CVE-2023-5194
Published: 2023-09-29T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.1.1'}]}], 'versions': ['8.1.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.10'}]}]}]

Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager
PrestaShop allows users to uninstall modules from backoffice, even with low rights (GHSA-6jmf-2pfc-q9m7)
Aliases: CVE-2023-43663
Published: 2023-09-28T16:27:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.2'}]}]}]

### Impact
Any module can be disabled or uninstalled from back office, even with low user right.

### Patches
8.1.2

### Workarounds
none

### References
Cilium vulnerable to bypass of namespace restrictions in CiliumNetworkPolicy  (GHSA-4xp2-w642-7mcx)
Aliases: CVE-2023-41333
Published: 2023-09-27T00:35:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.14.0'}, {'fixed': '1.14.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.7'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.12.14'}]}]}]

### Impact

An attacker with the ability to create or modify CiliumNetworkPolicy objects in a particular namespace is able to affect traffic on an entire Cilium cluster, potentially bypassing policy enforcement in other namespaces.

By using a crafted `endpointSelector` that uses the `DoesNotExist` operator on the `reserved:init` label, the attacker can create policies that bypass namespace restrictions and affect the entire Cilium cluster. This includes potentially allowing or denying all traffic.

This attack requires API server access, as described in the [Kubernetes API Server Attacker](https://docs.cilium.io/en/stable/security/threat-model/#kubernetes-api-server-attacker) section of the Cilium Threat Model.

### Patches

This issue was patched in https://github.com/cilium/cilium/pull/28007

This issue affects:

- Cilium <= v1.14.1
- Cilium <= v1.13.6
- Cilium <= v1.12.13

This issue has been resolved in:

- Cilium v1.14.2
- Cilium v1.13.7
- Cilium v1.12.14

### Workarounds

An admission webhook can be used to prevent the use of `endpointSelector`s that use the `DoesNotExist` operator on the `reserved:init` label in CiliumNetworkPolicies.

### Acknowledgements
The Cilium community has worked together with members of Palantir and Isovalent to prepare these mitigations. Special thanks to @odinuge for reporting this issue and @joestringer for the fix.

### For more information
If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

If you think you have found a vulnerability in Cilium, we strongly encourage you to report it to our private security mailing list at [security@cilium.io](mailto:security@cilium.io) first, before disclosing it in any public forum. This is a private mailing list for Cilium's internal security team, and your report will be treated as top priority.
Craft CMS Remote Code Execution vulnerability (GHSA-4w8r-3xrw-v25g)
Aliases: CVE-2023-41892
Published: 2023-09-13T15:44:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-RC1'}, {'fixed': '4.4.15'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.4.14'}}]

### Impact

This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. 

### Mitigations

* This has been fixed in Craft 4.4.15. You should ensure you’re running at least that version.
* Refresh your security key in case it has already been captured. You can do that by running the `php craft setup/security-key` command and copying the updated `CRAFT_SECURITY_KEY` environment variable to all production environments.
* If you have any other private keys stored as environment variables (e.g., S3 or Stripe), refresh those as well.
* Out of an abundance of caution, you may want to force all your users to reset their passwords in case your database was compromised. You can do that by running `php craft resave/users --set passwordResetRequired --to "fn() => true"`.

### References

https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476

https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857

https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e

https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical
matrix-synapse vulnerable to temporary storage of plaintext passwords during password changes (GHSA-4f74-84v3-j9q5)
Aliases: CVE-2023-41335
Published: 2023-09-26T18:55:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'matrix-synapse'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.66.0'}, {'fixed': '1.93.0'}]}]}]

### Impact

When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration.

These temporarily stored passwords are automatically erased after a 48-hour window.

### Patches
https://github.com/matrix-org/synapse/pull/16272

### References

This bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.
BER/CER/DER decoder panics on invalid input (GHSA-6jmw-6mxw-w4jc)
Aliases: CVE-2023-39914
Published: 2023-09-13T15:31:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'bcder'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.7.3'}]}]}]

NLnet Labs’ bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding.
Users vulnerable to unaligned read of `*const *const c_char` pointer (GHSA-jcr6-4frq-9gjj)
Published: 2023-09-11T20:43:31Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'users'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.11.0'}]}]}]

Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior.

In some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in some other way, including the possibility of working correctly in some architectures.

The crate is not currently maintained, so a patched version is not available.

## Recommended alternatives
- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)
- [`sysinfo`](https://crates.io/crates/sysinfo)
sudo-rs Session File Relative Path Traversal vulnerability (GHSA-2r3c-m6v7-9354)
Aliases: CVE-2023-42456
Published: 2023-09-21T17:07:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'sudo-rs'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.2.0'}}]

### Background

Sudo-rs allows users to not have to enter authentication at every sudo attempt, but instead only requiring authentication every once in a while in every terminal or process group. Only once a configurable timeout has passed will the user have to re-authenticate themselves. Supporting this functionality is a set of session files (timestamps) for each user, stored in `/var/run/sudo-rs/ts`. These files are named according to the username from which the sudo attempt is made (the origin user).

### Impact

An issue was discovered where usernames containing the `.` and `/` characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For example we could add a user to the system containing the username `../../../../bin/cp`. When logged in as a user with that name, that user could run `sudo -K` to clear their session record file. The session code then constructs the path to the session file by concatenating the username to the session file storage directory, resulting in a resolved path of `/bin/cp`. The code then clears that file, resulting in the `cp` binary effectively being removed from the system.

An attacker needs to be able to login as a user with a constructed username. Given that such a username is unlikely to exist on an existing system, they will also need to be able to create the users with the constructed usernames.

### Patches
The bug is fixed in version 0.2.1 of sudo-rs. Sudo-rs now uses the uid for the user instead of their username for determining the filename. Note that an upgrade to this version will result in existing session files being ignored and users will be forced to re-authenticate. It also fully eliminates any possibility of path traversal, given that uids are always integer values.

### Workarounds
The `sudo -K` and `sudo -k` commands can run, even if a user has no sudo access. Make sure that your system does not contain any users with a specially crafted username. While this is the case and while untrusted users do not have the ability to create arbitrary users on your system you should not be able to exploit this issue.
Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64 (GHSA-gw5p-q8mj-p7gh)
Aliases: CVE-2023-41880
Published: 2023-09-14T19:33:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'wasmtime'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.0.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'wasmtime'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '11.0.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'wasmtime'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.0.0'}, {'fixed': '12.0.2'}]}]}]

### Impact

Wasmtime versions from 10.0.0 to 12.0.1 contain a miscompilation of the WebAssembly `i64x2.shr_s` instruction on x86_64 platforms when the shift amount is a constant value that is larger than 32. Only x86_64 is affected so all other targets are not affected by this. The miscompilation results in the instruction producing an incorrect result, namely the low 32-bits of the second lane of the vector are derived from the low 32-bits of the second lane of the input vector instead of the high 32-bits. The primary impact of this issue is that any WebAssembly program using the `i64x2.shr_s` with a constant shift amount larger than 32 may produce an incorrect result.

This issue is not an escape from the WebAssembly sandbox. Execution of WebAssembly guest programs will still behave correctly with respect to memory sandboxing and isolation from the host. Wasmtime considers non-spec-compliant behavior as a security issue nonetheless.

This issue was discovered through fuzzing of Wasmtime's code generator Cranelift.

### Patches

Wasmtime versions 10.0.2, 11.0.2, and 12.0.2 are all patched to no longer have this miscompilation.

### Workarounds

This issue only affects x86_64 hosts and the only workaround is to either scan for this pattern in wasm modules which is nontrivial or to [disable the SIMD proposal for WebAssembly](https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.wasm_simd). Users prior to 10.0.0 are unaffected by this vulnerability.

### References

* [PR which introduced this bug to Wasmtime](https://github.com/bytecodealliance/wasmtime/pull/6372)
* [Mailing list announcement](https://groups.google.com/a/bytecodealliance.org/g/sec-announce/c/B8PJgg6bEdg)
Jodit Editor vulnerable to cross-site scripting (GHSA-95xr-cq6h-vwr3)
Aliases: CVE-2023-42399
Published: 2023-09-19T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'jodit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'versions': ['4.0.0-beta.86']}]

Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via the rich text editor component.
kube-apiserver authentication bypass vulnerability (GHSA-92hx-3mh6-hc49)
Aliases: CVE-2023-1260
Published: 2023-09-24T03:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/openshift/apiserver-library-go'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20230621'}]}]}]

An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
plone.rest vulnerable to Denial of Service when ++api++ is used many times (GHSA-h6rp-mprm-xgcq)
Aliases: CVE-2023-42457
Published: 2023-09-21T17:06:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'plone.rest'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0a1'}, {'fixed': '2.0.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'plone.rest'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.1'}]}], 'versions': ['3.0.0']}]

### Impact
When the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.

### Patches
Patches will be released in `plone.rest` 2.0.1 and 3.0.1.  Series 1.x is not affected.

### Workarounds
In your frontend web server (nginx, Apache) you can redirect `/++api++/++api++` to `/++api++`.
Rdiffweb Allocation of Resources Without Limits or Throttling vulnerability (GHSA-c4rv-2j6x-pq7x)
Aliases: CVE-2023-5289
Published: 2023-09-29T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'rdiffweb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.4'}]}]}]

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.4.
Apache Superset may expose internal traces on REST API endpoints (GHSA-cpvx-2365-466c)
Aliases: CVE-2023-39264
Published: 2023-09-06T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.0'}]}]}]

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Strapi may leak sensitive user information, user reset password, tokens via content-manager views (GHSA-v8gg-4mq2-88q4)
Aliases: CVE-2023-36472
Published: 2023-09-13T16:31:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@strapi/plugin-content-manager'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.11.7'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@strapi/admin'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.11.7'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@strapi/utils'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.11.7'}]}]}]

### Summary
I can get access to user  reset password tokens if I have the configure view permissions
![b37a6fd9eae06027e7d91266f1908a3d](https://user-images.githubusercontent.com/34578426/246782921-fbc007d3-ffec-45de-a1f1-a4287cd507ac.png)
![6c1da5b3bfbb3bca97c8d064be0ecb05](https://user-images.githubusercontent.com/34578426/246783044-7d716dde-6f27-4d01-9521-42720c6ce92e.gif)

### Details
/content-manager/relations route does not remove private fields or ensure that they can't be selected

### PoC
Install fresh strapi instance
start up strapi and create an account
create a new content-type
give the content-type a relation with admin users and save
go to Admin panel roles Author and then plugins.
Enable for content-manager collection types the configure view
In the collection time now only give them access to the collection you created for this.
Create a new admin user account with the Author role
Log out and request a password reset for the main admin user.
Login on the newly created account
go to the collection type you created for this test and click the create new entry button,
click in the create new entry view on configure view.
select the admin user relation we created click on resetPasswordToken
Now go back to the create an entry view and when selection the relation we created we now see the reset tokken

### Impact
Impact is that the none admin user now has the reset token of the admin users account and can resets its password using that to escalate his privilege's

Still you need the configure view permission to be able to escalate your privilege's
Pow Mnesia cache doesn't invalidate all expired keys on startup (GHSA-3cjh-p6pw-jhv9)
Aliases: CVE-2023-42446
Published: 2023-09-19T17:00:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Hex', 'name': 'pow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.14'}, {'fixed': '1.0.34'}]}]}]

Use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than the keys' remaining TTL and the expired key won't be invalidated on startups.

### Workarounds

The expired keys, including all expired sessions, can be manually invalidated by running:

```elixir
:mnesia.sync_transaction(fn ->
  Enum.each(:mnesia.dirty_select(Pow.Store.Backend.MnesiaCache, [{{Pow.Store.Backend.MnesiaCache, :_, :_}, [], [:"$_"]}]), fn {_, key,  {_value, expire}} ->
    ttl = expire - :os.system_time(:millisecond)
    if ttl < 0, do: :mnesia.delete({Pow.Store.Backend.MnesiaCache, key})
  end)
end)
```

### References
https://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17
https://github.com/pow-auth/pow/issues/713
https://github.com/pow-auth/pow/pull/714
Croc requires senders to provide local IP addresses in cleartext (GHSA-7mp6-929p-pqhj)
Aliases: CVE-2023-43618
Published: 2023-09-20T06:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/schollz/croc/v9'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.6.5'}]}]}]

An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an `ips?` message.
DataEase vulnerable to SQL injection (GHSA-8rv7-g772-pp3j)
Aliases: CVE-2023-40771
Published: 2023-09-01T18:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.dataease:dataease-plugin-common'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.18.9'}]}]}]

SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function.
pydash Command Injection vulnerability (GHSA-8mjr-6c96-39w8)
Aliases: CVE-2023-26145
Published: 2023-09-28T06:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pydash'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.0'}]}]}]

This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.

**Note:**

The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:

1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)

2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)


The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
codehaus-plexus vulnerable to XML injection (GHSA-jcwr-x25h-x5fh)
Aliases: CVE-2022-4245
Published: 2023-09-25T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.codehaus.plexus:plexus-utils'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.24'}]}]}]

A flaw was found in codehaus-plexus. The `org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment` fails to sanitize comments for a `-->` sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection.
Apache Superset Improper Input Validation vulnerability (GHSA-fm4q-j8g4-c9j4)
Aliases: CVE-2023-39265
Published: 2023-09-06T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.0'}]}]}]

Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for production use) it could result in more severe vulnerabilities related to confidentiality and integrity. This vulnerability exists in Apache Superset versions up to and including 2.1.0.