aswin1906/github-advisory-2023 huggingface dataset:
Vyper: reversed order of side effects for some operations (GHSA-g2xh-c426-v8mf)
Aliases: CVE-2023-40015
Published: 2023-09-04T16:39:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.3.9'}]}]}]

### Impact

For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right.

```
- unsafe_add
- unsafe_sub
- unsafe_mul
- unsafe_div
- pow_mod256
- |, &, ^ (bitwise operators)
- bitwise_or (deprecated)
- bitwise_and (deprecated)
- bitwise_xor (deprecated)
- raw_call
- <, >, <=, >=, ==, !=
- in, not in (when lhs and rhs are enums)
```

This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect:

- state modifying external call 
- state modifying internal call
- `raw_call`
- `pop()` when used on a Dynamic Array stored in the storage
- `create_minimal_proxy_to`
- `create_copy_of`
- `create_from_blueprint`

For example:

```Vyper
f:uint256

@internal
def side_effect() -> uint256:
    self.f = 12
    return 1

@external
def foo() -> uint256:
    return unsafe_add(self.f,self.side_effect()) # returns 13 instead of 1
```

```Vyper
a:DynArray[uint256, 12]
@external
def bar() -> bool:
    self.a = [1,2,3]
    return len(self.a) == self.a.pop() # return false instead of true
```

### Patches
not yet patched, will address in a future release. tracking in https://github.com/vyperlang/vyper/issues/3604.

### Workarounds

When using expressions from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

### References
_Are there any links users can visit to find out more?_
Improper Control of Generation of Code ('Code Injection') in jai-ext (GHSA-v92f-jx6p-73rx)
Aliases: CVE-2022-24816
Published: 2023-09-19T20:35:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'it.geosolutions.jaiext.jiffle:jt-jiffle'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.22'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'it.geosolutions.jaiext.jiffle:jt-jiffle-language'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.22'}]}]}]

### Impact
Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project.

### Patches
Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script.

### Workarounds
Negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

### References
None.
Composer Remote Code Execution vulnerability via web-accessible composer.phar (GHSA-jm6m-4632-36hf)
Aliases: CVE-2023-43655
Published: 2023-09-29T20:39:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'composer/composer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.10.27'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'composer/composer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.2.22'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'composer/composer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.6.4'}]}]}]

### Impact

Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has `register_argc_argv` enabled in php.ini.

### Patches

2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.

### Workarounds

Make sure `register_argc_argv` is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.
Salt vulnerable to denial of service (GHSA-vpjg-wmf8-29h9)
Aliases: CVE-2023-20897
Published: 2023-09-05T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'salt'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3005.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'salt'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3006.0rc1'}, {'fixed': '3006.2'}]}]}]

Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
Electron context isolation bypass via nested unserializable return value (GHSA-p7v2-p9m8-qqg7)
Aliases: CVE-2023-29198
Published: 2023-09-06T19:50:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '22.3.6'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.0.0-alpha.1'}, {'fixed': '23.2.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0-alpha.1'}, {'fixed': '24.0.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '25.0.0-alpha.1'}, {'fixed': '25.0.0-alpha.2'}]}]}]

### Impact
Apps using `contextIsolation` and `contextBridge` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
This issue is exploitable under either of two conditions:
* If an API exposed to the main world via `contextBridge` can return an object or array that contains a JS object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`.
* If an API exposed to the main world via `contextBridge` has a return value that throws a user-generated exception while being sent over the bridge, for instance a dynamic getter property on an object that throws an error when being computed.

The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are [supported](https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support) and that any objects returned from functions do not have dynamic getters that can throw exceptions.

Auditing your exposed API is likely to be quite difficult so we strongly recommend you update to a patched version of Electron.

### Fixed Versions
* `25.0.0-alpha.2`
* `24.0.1`
* `23.2.3`
* `22.3.6`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
Cross Site Scripting vulnerability in Dolibarr ERP CRM (GHSA-62wf-h26v-5m57)
Aliases: CVE-2023-38888
Published: 2023-09-20T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dolibarr/dolibarr'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '17.0.1'}]}]}]

Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
Gevent allows remote attacker to escalate privileges (GHSA-x7m3-jprg-wc5g)
Aliases: CVE-2023-41419
Published: 2023-09-25T12:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'gevent'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.1'}]}]}]

An issue in Gevent Gevent before version 23.9.1 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.
Gradio arbitrary file upload vulnerability (GHSA-v4q9-qgqf-7jwp)
Aliases: CVE-2023-41626
Published: 2023-09-16T00:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'gradio'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.27.0'}]}]}]

Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the `/upload` interface.
October Cross-site Scripting vulnerability (GHSA-2g8p-j2r6-vqpj)
Aliases: CVE-2023-43876
Published: 2023-09-28T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'october/cms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.4.16'}]}]}]

A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost field.
Jenkins does not exclude sensitive build variables from search (GHSA-279f-qwgh-h5mp)
Aliases: CVE-2023-43494
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.50'}, {'fixed': '2.414.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.415'}, {'fixed': '2.424'}]}]}]

Jenkins allows filtering builds in the build history widget by specifying an expression that searches for matching builds by name, description, parameter values, etc.

Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., password parameter values) from this search.

This allows attackers with Item/Read permission to obtain values of sensitive variables used in builds by iteratively testing different characters until the correct sequence is discovered.

Jenkins 2.424, LTS 2.414.2 excludes sensitive variables from this search.
Jeecg boot SQL Injection vulnerability (GHSA-m7vh-pgfq-v4rq)
Aliases: CVE-2023-42268
Published: 2023-09-08T21:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.3'}]}]}]

Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component `/jeecg-boot/jmreport/show`.
Undertow vulnerable to denial of service (GHSA-65h2-wf7m-q2v8)
Aliases: CVE-2023-3223
Published: 2023-09-27T15:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.undertow:undertow-parent'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.24.Final'}]}]}]

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
Economizzer user enumeration vulnerability (GHSA-h3qf-v68r-35jg)
Aliases: CVE-2023-38871
Published: 2023-09-28T06:30:20Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'gugoan/economizzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9-beta1'}]}]}]

The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an attacker to determine whether a user or email address is valid, or brute force valid usernames and email addresses.
Argo CD cluster secret might leak in cluster details page (GHSA-fwr2-64vr-xv9m)
Aliases: CVE-2023-40029
Published: 2023-09-11T12:59:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.6.15'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.14'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.3'}]}]}]

### Impact

Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. 

https://github.com/argoproj/argo-cd/pull/7139 introduced the ability to manage cluster labels and annotations. Since clusters are stored as secrets it also exposes the `kubectl.kubernetes.io/last-applied-configuration` annotation which includes full secret body. In order to view the cluster annotations via the Argo CD API, the user must have `clusters, get` RBAC access.

**Note:** In many cases, cluster secrets do not contain any actually-secret information. But sometimes, as in bearer-token auth, the contents might be very sensitive.

### Patches

The bug has been patched in the following versions:

* 2.8.3
* 2.7.14
* 2.6.15

### Workarounds

Update/Deploy cluster secret with `server-side-apply` flag which does not use or rely on `kubectl.kubernetes.io/last-applied-configuration` annotation. Note: annotation for existing secrets will require manual removal.

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
hson-java vulnerable to denial of service (GHSA-94w5-rf69-2h6c)
Aliases: CVE-2023-39685
Published: 2023-09-01T12:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.hjson:hjson'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.1'}]}]}]

An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string to string a `StringIndexOutOfBoundsException`.
LibreNMS Cross-site Scripting vulnerability (GHSA-m6jj-fgmh-3p8r)
Aliases: CVE-2023-4982
Published: 2023-09-15T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 23.9.0.
Default functions in VolatileMemory trait lack bounds checks, potentially leading to out-of-bounds memory accesses (GHSA-49hh-fprx-m68g)
Aliases: CVE-2023-41051
Published: 2023-09-04T16:35:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'vm-memory'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.2'}]}]}]

### Impact
An issue was discovered in the default implementations of the `VolatileMemory::{get_atomic_ref, aligned_as_ref, aligned_as_mut, get_ref, get_array_ref}` trait functions, which allows out-of-bounds memory access if the `VolatileMemory::get_slice` function returns a `VolatileSlice` whose length is less than the function’s `count` argument. No implementations of `get_slice` provided in `vm_memory` are affected. Users of custom `VolatileMemory` implementations may be impacted if the custom implementation does not adhere to `get_slice`'s documentation.

### Patches
The issue started in version 0.1.0 but was fixed in version 0.12.2 by inserting a check that verifies that the `VolatileSlice` returned by `get_slice` is of the correct length.

### Workarounds
Not Required

### References
https://github.com/rust-vmm/vm-memory/commit/aff1dd4a5259f7deba56692840f7a2d9ca34c9c8
https://crates.io/crates/vm-memory/0.12.2
Zope vulnerable to Stored Cross Site Scripting with SVG images (GHSA-wm8q-9975-xh5v)
Aliases: CVE-2023-42458
Published: 2023-09-21T17:04:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Zope'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.8.10'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.8.9'}}, {'package': {'ecosystem': 'PyPI', 'name': 'Zope'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.8.0'}, {'fixed': '5.8.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.8.4'}}]

### Impact
There is a stored cross site scripting vulnerability for SVG images.

Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link.

All versions of Zope are impacted on sites that allow untrusted users to upload images.


### Patches
Patches will be released in Zope 4.8.10 and 5.8.5.

### Workarounds
Make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default only the Manager has this permission.
Answer Missing Authentication for Critical Function (GHSA-pj2h-85jq-g5vg)
Aliases: CVE-2023-4815
Published: 2023-09-07T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.3'}]}]}]

Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3.
Denial of Service issue in quinn-proto (GHSA-q8wc-j5m9-27w3)
Aliases: CVE-2023-42805
Published: 2023-09-21T17:16:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'quinn-proto'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.9.5'}]}]}]

### Impact

Receiving unknown QUIC frames in a QUIC packet could result in a panic.

### Patches

The problem has been fixed in 0.9.5 and 0.10.5 maintenance releases.

### References

Fixed in https://github.com/quinn-rs/quinn/pull/1667, backported in https://github.com/quinn-rs/quinn/pull/1668 and https://github.com/quinn-rs/quinn/pull/1669.
SQLpage vulnerable to public exposure of database credentials (GHSA-v5wf-jg37-r9m5)
Aliases: CVE-2023-42454
Published: 2023-09-21T17:10:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'sqlpage'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.11.1'}]}]}]

### Impact

If
 - you are using a SQLPage version older than v0.11.1 
 - your SQLPage instance is exposed publicly
 - the database connection string is specified in the `sqlpage/sqlpage.json` configuration file (not in an environment variable)
 - the web_root is the current working directory (the default)
 - your database is exposed publicly

then an attacker could retrieve the database connection information from SQLPage and use it to connect to your database directly.

### Patches

Upgrade to [v0.11.1](https://github.com/lovasoa/SQLpage/releases/tag/v0.11.1) as soon as possible.

### Workarounds

If you cannot upgrade immediately:

 - Using an environment variable instead of the configuration file to specify the database connection string prevents exposing it on vulnerable versions.
 - Using a different [web root](https://github.com/lovasoa/SQLpage/blob/main/configuration.md) (that is not a parent of the SQLPage configuration directory) fixes the issue.
 - And in any case, you should generally avoid exposing your database publicly 

### References

https://github.com/lovasoa/SQLpage/issues/89
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA (GHSA-r87q-fq37-pvr6)
Aliases: CVE-2023-33831
Published: 2023-09-18T21:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@frangoteam/fuxa'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.13'}]}]}]

A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
Apache Airflow information exposure vulnerability (GHSA-mjqh-v5f2-g2mw)
Aliases: CVE-2023-40712
Published: 2023-09-12T19:25:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.1'}]}]}]

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI.

Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.
Yii2 allows attackers to execute any local .php file via a relative path in the view parameter (GHSA-7cfq-72w2-24q4)
Aliases: CVE-2015-5467
Published: 2023-09-21T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'yiisoft/yii2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.5'}]}]}]

web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter.
FUXA vulnerable to Local File Inclusion (GHSA-45c3-c4c3-8rqg)
Aliases: CVE-2023-31716
Published: 2023-09-22T00:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@frangoteam/fuxa'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.12'}]}]}]

FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
hutool Buffer Overflow vulnerability (GHSA-rr66-qh5m-w6mx)
Aliases: CVE-2023-42278
Published: 2023-09-09T00:30:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.21'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-json'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.21'}]}]}]

hutool v5.8.21 was discovered to contain a buffer overflow via the component `JSONUtil.parse()`.
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images (GHSA-jj7c-jrv4-c65x)
Aliases: CVE-2023-41048
Published: 2023-09-21T17:14:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'plone.namedfile'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.6.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'plone.namedfile'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'plone.namedfile'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'plone.namedfile'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2.0'}, {'fixed': '6.2.1'}]}]}]

### Impact
There is a stored cross site scripting vulnerability for SVG images. A [security hotfix from 2021](https://github.com/plone/Products.PloneHotfix20210518) already partially fixed this,  by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images.

Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link.

All versions of `plone.namedfile` are impacted.

### Patches
Patches will be released in various `plone.namedfile` releases:

* 5.6.1 (for Plone 5.2)
* 6.0.3 (for Plone 6.0.0-6.0.4)
* 6.1.3 (for Plone 6.0.5-6.0.6)
* 6.2.1 (for Plone 6.0.7)

### Workarounds
There is no workaround.
LibreNMS Cross-site Scripting vulnerability (GHSA-5jjm-qp48-qp86)
Aliases: CVE-2023-4981
Published: 2023-09-15T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.0'}]}]}]

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
Jeecg boot arbitrary file read vulnerability (GHSA-pm8v-ppx7-8hr4)
Aliases: CVE-2023-41578
Published: 2023-09-08T21:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.3'}]}]}]

Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface `/testConnection`.
Froala Editor Cross-site Scripting vulnerability (GHSA-hvpq-7vcc-5hj5)
Aliases: CVE-2023-41592
Published: 2023-09-15T00:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froala/wysiwyg-editor'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.1'}, {'fixed': '4.1.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.1.1'}}]

Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.
Apache Superset Server Side Request Forgery vulnerability (GHSA-4fg9-5w46-xmrj)
Aliases: CVE-2023-36388
Published: 2023-09-06T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.0'}]}]}]

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
FUXA SQL Injection vulnerability (GHSA-v9q5-9crp-92f9)
Aliases: CVE-2023-31717
Published: 2023-09-22T00:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'fuxa-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.12'}]}]}]

A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
matrix-media-repo: Unsafe media served inline on download endpoints (GHSA-5crw-6j7v-xc72)
Aliases: CVE-2023-41318
Published: 2023-09-08T13:18:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/turt2live/matrix-media-repo'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.0'}]}]}]

### Impact
A malicious user can upload an SVG image containing JavaScript to their server. When matrix-media-repo is asked to serve that media via the `/_matrix/media/(r0|v3)/download` endpoint, it would be served with a `Content-Disposition` of `inline`. This can allow JavaScript to run in the browser if a client links to the `/download` endpoint directly.

Server operators which do not share a domain between matrix-media-repo and other services are not affected, but are encouraged to upgrade regardless.

### Patches
https://github.com/turt2live/matrix-media-repo/commit/77ec2354e8f46d5ef149d1dcaf25f51c04149137 and https://github.com/turt2live/matrix-media-repo/commit/bf8abdd7a5371118e280c65a8e0ec2b2e9bdaf59 fix the issue. Operators should upgrade to v1.3.0 as soon as possible.

### Workarounds
The `Content-Disposition` header can be overridden by the reverse proxy in front of matrix-media-repo to always use `attachment`, defeating this issue at the cost of "worse" user experience when clicking download links.

### References
https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script
Jenkins Build Failure Analyzer Plugin missing permission check (GHSA-55q6-r3hm-7ff4)
Aliases: CVE-2023-43501
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.2'}]}]}]

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not perform a permission check in a connection test HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Build Failure Analyzer Plugin 2.4.2 requires POST requests and Overall/Administer permission for the affected HTTP endpoint.
OpenCart Path Traversal vulnerability (GHSA-v4j2-cwmm-xg89)
Aliases: CVE-2023-2315
Published: 2023-09-27T15:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'opencart/opencart'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0.0'}, {'fixed': '4.0.2.3'}]}]}]

Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server
Remote Code Execution in Custom Integration Upload (GHSA-p6p2-qq95-vq5h)
Aliases: CVE-2023-41319
Published: 2023-09-07T12:59:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ethyca-fides'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.11.0'}, {'fixed': '2.19.0'}]}]}]

### Impact
The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the inclusion of custom Python code in it. The custom code is executed in a restricted, sandboxed environment, but the sandbox can be bypassed to execute any arbitrary code.

The vulnerability allows the execution of arbitrary code on the target system within the context of the webserver python process owner on the webserver container, which by default is `root`, and leverage that access to attack underlying infrastructure and integrated systems.

This vulnerability affects Fides versions `2.11.0` through `2.18.0`.

Exploitation is limited to API clients with the `CONNECTOR_TEMPLATE_REGISTER` authorization scope. In the Fides Admin UI this scope is restricted to highly privileged users, specifically root users and users with the owner role. 

Exploitation is only possible if the security configuration parameter `allow_custom_connector_functions` is enabled by the user deploying the Fides webserver container, either in `fides.toml` or by setting the env var `FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS=True`. By default this configuration parameter is disabled.

### Patches
The vulnerability has been patched in Fides version `2.19.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.

### Workarounds
Ensure that `allow_custom_connector_functions` in `fides.toml` and the `FIDES__SECURITY__ALLOW_CUSTOM_CONNECTOR_FUNCTIONS` are both either unset or explicit set to `False`.
Neos CMS Cross Site Scripting vulnerability (GHSA-6qjf-7g3j-qx25)
Aliases: CVE-2023-37611
Published: 2023-09-19T00:30:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'neos/neos-ui'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '8.3.3'}]}]}]

Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVG file uploaded to the `neos/management/media` component. To make use of this attack vector, the attacker must either be able to upload a maliciously crafted file or coerce someone with the needed access to upload said file to Neos. Even if such a file is uploaded and subsequently delivered, it is possible to use CSP to protect against attacks being executed from such a file.
Economizzer remote code execution vulnerability (GHSA-pq98-6hf6-3rj3)
Aliases: CVE-2023-38874
Published: 2023-09-28T06:30:20Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'gugoan/economizzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9-beta1'}]}]}]

A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards, the attacker may visit the web shell and execute arbitrary commands.
usememos/memos vulnerable to improper input validation (GHSA-96gq-6ch5-mm54)
Aliases: CVE-2023-4698
Published: 2023-09-01T03:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}]}], 'database_specific': {'last_known_affected_version_range': '< 0.13.2'}}]

Improper Input Validation in GitHub repository usememos/memos prior to 0.13.2.
Foreman Transpilation Enables OS Command Injection (GHSA-9jfq-54vc-9rr2)
Aliases: CVE-2022-3874
Published: 2023-09-22T15:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'foreman'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.8.0'}]}]}]

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
Salt can cause Git Providers to get wrong data (GHSA-qvh6-3j7x-3hq7)
Aliases: CVE-2023-20898
Published: 2023-09-05T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'salt'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3005.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'salt'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3006.0rc1'}, {'fixed': '3006.2'}]}]}]

Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
Kiali content spoofing vulnerability (GHSA-6f4m-j56w-55c3)
Aliases: CVE-2022-3962
Published: 2023-09-23T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kiali/kiali'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.57.4'}]}]}]

A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
Apache Superset vulnerable to improper data authorization (GHSA-v594-2c97-hx38)
Aliases: CVE-2023-27523
Published: 2023-09-06T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.0'}]}]}]

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.
Vyper has incorrect re-entrancy lock when key is empty string (GHSA-3hg2-r75x-g69m)
Aliases: CVE-2023-42441
Published: 2023-09-18T19:20:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.9'}, {'fixed': '0.3.10'}]}]}]

### Impact

Locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime.

```Vyper
@nonreentrant("") # unprotected
@external
def bar():
    pass

@nonreentrant("lock") # protected
@external
def foo():
    pass
```
### Patches

Patched in #3605

### Workarounds

The lock name should be a non-empty string.

### References
_Are there any links users can visit to find out more?_
Apache Superset has improper default REST API permission for Gamma users (GHSA-9832-mgg4-3gr6)
Aliases: CVE-2023-36387
Published: 2023-09-06T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.0'}]}]}]

An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.
Inventory fails to prohibit standard library access prior to initialization of Rust standard library runtime (GHSA-ghc8-5cgm-5rpf)
Published: 2023-09-11T20:43:17Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'inventory'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.0'}]}]}]

Affected versions allow arbitrary caller-provided code to execute before the lifetime of `main`.

If the caller-provided code accesses particular pieces of the standard library that require an initialized Rust runtime, such as `std::io` or `std::thread`, these may not behave as documented. Panics are likely; UB is possible.

The flaw was corrected by enforcing that only code written within the `inventory` crate, which is guaranteed not to access runtime-dependent parts of the standard library, runs before `main`. Caller-provided code is restricted to running at compile time.
Vyper's `_abi_decode` input not validated in complex expressions (GHSA-cx2q-hfxr-rj97)
Aliases: CVE-2023-42460
Published: 2023-09-26T19:34:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.4'}, {'fixed': '0.3.10'}]}]}]

### Impact
`_abi_decode()` does not validate input when it is nested in an expression. the following example gets correctly validated (bounds checked):
```vyper
x: int128 = _abi_decode(slice(msg.data, 4, 32), int128)
```

however, the following example is not bounds checked
```vyper
@external
def abi_decode(x: uint256) -> uint256:
    a: uint256 = convert(_abi_decode(slice(msg.data, 4, 32), (uint8)), uint256) + 1
    return a  # abi_decode(256) returns: 257
```

the issue can be triggered by constructing an example where the output of `_abi_decode` is not internally passed to `make_setter` (an internal codegen routine) or other input validating routine.

### Patches
https://github.com/vyperlang/vyper/pull/3626

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_
Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server (GHSA-6jqw-jwf5-rp8h)
Aliases: CVE-2023-40026
Published: 2023-09-27T20:14:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.8.7'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.0'}]}]}]

### Impact
In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but likely in any version using Helm before 2.3), using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was possible because Helm paths were predictable. 

The vulnerability worked by adding a Helm chart that referenced Helm resources from predictable paths. Because the paths of Helm charts were predictable and available on an instance of repo-server, it was possible to reference and then render the values and resources from other existing Helm charts regardless of permissions. While generally, secrets are not stored in these files, it was nevertheless possible to reference any values from these charts. 

### Patches
This issue was fixed in Argo CD 2.3 and subsequent versions by randomizing Helm paths.

### Workarounds
User's still using Argo CD 2.3 or below are advised to update to a [supported version](https://argo-cd.readthedocs.io/en/stable/operator-manual/installation/#supported-versions). If this is not possible, disabling Helm chart rendering, or using an additional repo-server for each Helm chart would prevent possible exploitation.  

### References
https://github.com/argoproj/argo-cd/security/advisories/GHSA-63qx-x74g-jcr7

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Economizzer host header injection vulnerability (GHSA-hqp9-mrjw-7qq2)
Aliases: CVE-2023-38877
Published: 2023-09-28T06:30:20Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'gugoan/economizzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9-beta1'}]}]}]

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.
pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations (GHSA-m988-7375-7g2c)
Aliases: CVE-2023-42817
Published: 2023-09-25T17:34:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/admin-ui-classic-bundle'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.2'}]}]}]

### Impact
The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user.

The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box.

### Patches
https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch

### Workarounds
Update to version 1.1.2 or apply this patches manually
https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c.patch