aswin1906/github-advisory-2023 huggingface dataset:
Jenkins Build Failure Analyzer Plugin Cross-Site Request Forgery vulnerability (GHSA-2wwh-qgh8-w9xw)
Aliases: CVE-2023-43502
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.2'}]}]}]

Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not require POST requests for an HTTP endpoint, resulting in cross-site request forgery (CSRF) vulnerabilities.

This vulnerability allows attackers to delete Failure Causes.

Build Failure Analyzer Plugin 2.4.2 requires POST requests for the affected HTTP endpoint.
OpenStack Heat information leak vulnerability (GHSA-5836-grcc-8j89)
Aliases: CVE-2023-1625
Published: 2023-09-24T03:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'openstack-heat'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '20.0.0'}]}]}]

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
File Upload vulnerability in Dolibarr ERP CRM (GHSA-g8h7-mcp6-pf47)
Aliases: CVE-2023-38887
Published: 2023-09-20T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dolibarr/dolibarr'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '17.0.1'}]}]}]

File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
Subrion CMS XSS in /panel/configuration/financial/ (GHSA-q832-2275-rfqh)
Aliases: CVE-2023-43830
Published: 2023-09-27T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'intelliants/subrion'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.2.1'}]}]}]

A Cross-site scripting (XSS) vulnerability in /panel/configuration/financial/ of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into several fields: 'Minimum deposit', 'Maximum deposit' and/or 'Maximum balance'.
quill-mention Cross-site Scripting vulnerability (GHSA-jgw5-rp4p-qhp6)
Aliases: CVE-2023-26149
Published: 2023-09-28T06:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'quill-mention'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, via the renderList function. 

**Note:**

If the mentions list is sourced from unsafe (user-sourced) data, this might allow an injection attack when a Quill user hits @.
LibreNMS Cross-site Scripting vulnerability (GHSA-qxrq-376q-p39h)
Aliases: CVE-2023-4980
Published: 2023-09-15T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.0'}]}]}]

Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.
Tungstenite allows remote attackers to cause a denial of service (GHSA-9mcr-873m-xcxp)
Aliases: CVE-2023-43669
Published: 2023-09-21T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'tungstenite'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.20.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.20.0'}}]

The Tungstenite crate through 0.20.0 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).
Jenkins Cross-site Scripting vulnerability (GHSA-5j46-5hwq-gwh7)
Aliases: CVE-2023-43495
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.50'}, {'fixed': '2.414.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.415'}, {'fixed': '2.424'}]}]}]

`ExpandableDetailsNote` allows annotating build log content with additional information that can be revealed when interacted with.

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the `caption` constructor parameter of `ExpandableDetailsNote`.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide `caption` parameter values.

As of publication, the related API is not used within Jenkins (core), and the Jenkins security team is not aware of any affected plugins.
Jenkins 2.424, LTS 2.414.2 escapes `caption` constructor parameter values.
gix-transport code execution vulnerability (GHSA-rrjw-j4m2-mf34)
Published: 2023-09-25T20:21:16Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'gix-transport'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.36.1'}]}]}]

The `gix-transport` crate prior to the patched version 0.36.1 would allow attackers to use malicious ssh clone URLs to pass arbitrary arguments to the `ssh` program, leading to arbitrary code execution.

PoC: `gix clone 'ssh://-oProxyCommand=open$IFS-aCalculator/foo'`

This will launch a calculator on OSX.

See https://secure.phabricator.com/T12961 for more details on similar vulnerabilities in `git`.
Sender can cause a receiver to overwrite files during ZIP extraction in Croc (GHSA-8c8w-f7wp-2jr2)
Aliases: CVE-2023-43616
Published: 2023-09-20T06:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/schollz/croc'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.6.5'}]}]}]

An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.
LibreNMS Code Injection vulnerability (GHSA-57m2-mpc7-gwgx)
Aliases: CVE-2023-4977
Published: 2023-09-15T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.0'}]}]}]

 Code Injection in GitHub repository librenms/librenms prior to 23.9.0.
SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced (GHSA-6xv5-86q9-7xr8)
Published: 2023-09-07T12:58:58Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cyphar/filepath-securejoin'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.4'}]}]}]

### Impact
For Windows users of `github.com/cyphar/filepath-securejoin`, until v0.2.4 it was possible for certain rootfs and path combinations (in particular, where a malicious Unix-style `/`-separated unsafe path was used with a Windows-style rootfs path) to result in generated paths that were outside of the provided rootfs.

It is unclear to what extent this has a practical impact on real users, but given the possible severity of the issue we have released an emergency patch release that resolves this issue.

Thanks to  @pjbgf for discovering, debugging, and fixing this issue (as well as writing some tests for it).

### Patches
c121231e1276e11049547bee5ce68d5a2cfe2d9b is the patch fixing this issue. v0.2.4 contains the fix.

### Workarounds
Users could use `filepath.FromSlash()` on all unsafe paths before passing them to `filepath-securejoin`.

### References
See #9.
hutool Buffer Overflow vulnerability (GHSA-7p8c-crfr-q93p)
Aliases: CVE-2023-42277
Published: 2023-09-09T00:30:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.21'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-json'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.21'}]}]}]

hutool v5.8.21 was discovered to contain a buffer overflow via the component `jsonObject.putByPath`.
NATS nats-server allows directory traversal via unintended path to a management action  (GHSA-vpjc-4jcv-jc29)
Aliases: CVE-2022-28357
Published: 2023-09-19T03:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/nats-io/nats-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.7.4'}]}]}]

NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management account.
sidekiq Denial of Service vulnerability (GHSA-3qc2-v3hp-6cv8)
Aliases: CVE-2023-26141
Published: 2023-09-14T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'sidekiq'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.1.3'}]}]}]

Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.js file. An attacker can exploit this vulnerability by manipulating the localStorage value which will cause excessive polling requests.
Minio vulnerable to Privilege Escalation on Windows via Path separator manipulation (GHSA-w23q-4hw3-2pp6)
Aliases: CVE-2023-28433
Published: 2023-09-06T18:43:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/minio/minio'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-202303200735'}]}]}]

### Impact
All users on Windows are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across
buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user.

### Patches
There are two patches that fix this problem comprehensively

```
commit b3c54ec81e0a06392abfb3a1ffcdc80c6fbf6ebc
Author: Harshavardhana <harsha@minio.io>
Date:   Mon Mar 20 13:16:00 2023 -0700

    reject object names with '\' on windows (#16856)
```

```
commit 8d6558b23649f613414c8527b58973fbdfa4d1b8
Author: Harshavardhana <harsha@minio.io>
Date:   Mon Mar 20 00:35:25 2023 -0700

    fix: convert '\' to '/' on windows (#16852)
```

### Workarounds
There are no known workarounds

### References
The vulnerable code:
```go
// minio/cmd/generic-handlers.go
// Check if the incoming path has bad path components,
// such as ".." and "."
// SlashSeparator -> /
// dotdotComponent -> ..
// dotComponent -> .
func hasBadPathComponent(path string) bool {
  path = strings.TrimSpace(path)
  for _, p := range strings.Split(path, SlashSeparator) {
    switch strings.TrimSpace(p) {
    case dotdotComponent:
      return true
    case dotComponent:
      return true
    }
  }
  return false
}
```
Apache Commons Compress denial of service vulnerability (GHSA-cgwf-w82q-5jrr)
Aliases: CVE-2023-42503
Published: 2023-09-14T09:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.commons:commons-compress'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.22'}, {'fixed': '1.24.0'}]}]}]

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0.

Users are recommended to upgrade to version 1.24.0, which fixes the issue.

A third party can create a malformed TAR file by manipulating file modification times headers, which when parsed with Apache Commons Compress, will cause a denial of service issue via CPU consumption.

In version 1.22 of Apache Commons Compress, support was added for file modification times with higher precision (issue # COMPRESS-612 [1]). The format for the PAX extended headers carrying this data consists of two numbers separated by a period [2], indicating seconds and subsecond precision (for example “1647221103.5998539”). The impacted fields are “atime”, “ctime”, “mtime” and “LIBARCHIVE.creationtime”. No input validation is performed prior to the parsing of header values.

Parsing of these numbers uses the BigDecimal [3] class from the JDK which has a publicly known algorithmic complexity issue when doing operations on large numbers, causing denial of service (see issue # JDK-6560193 [4]). A third party can manipulate file time headers in a TAR file by placing a number with a very long fraction (300,000 digits) or a number with exponent notation (such as “9e9999999”) within a file modification time header, and the parsing of files with these headers will take hours instead of seconds, leading to a denial of service via exhaustion of CPU resources. This issue is similar to CVE-2012-2098 [5].

[1]:  https://issues.apache.org/jira/browse/COMPRESS-612 
[2]:  https://pubs.opengroup.org/onlinepubs/9699919799/utilities/pax.html#tag_20_92_13_05 
[3]:  https://docs.oracle.com/javase/8/docs/api/java/math/BigDecimal.html 
[4]:  https://bugs.openjdk.org/browse/JDK-6560193 
[5]:  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2098 

Only applications using CompressorStreamFactory class (with auto-detection of file types), TarArchiveInputStream and TarFile classes to parse TAR files are impacted. Since this code was introduced in v1.22, only that version and later versions are impacted.
Privilege Escalation on Linux/MacOS (GHSA-2pxw-r47w-4p8c)
Aliases: CVE-2023-28434
Published: 2023-09-05T15:45:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/minio/minio'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-202303200415'}]}]}]

### Impact
An attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.

### Patches
```
commit 67f4ba154a27a1b06e48bfabda38355a010dfca5
Author: Aditya Manthramurthy <donatello@users.noreply.github.com>
Date:   Sun Mar 19 21:15:20 2023 -0700

    fix: post policy request security bypass (#16849)
```

### Workarounds
Browser API access must be enabled turning off `MINIO_BROWSER=off` allows for this workaround.

### References
The vulnerable code:
```go
// minio/cmd/generic-handlers.go
func setRequestValidityHandler(h http.Handler) http.Handler {
  return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    // ...
    // For all other requests reject access to reserved buckets
    bucketName, _ := request2BucketObjectName(r)
    if isMinioReservedBucket(bucketName) || isMinioMetaBucket(bucketName) {
      if !guessIsRPCReq(r) && !guessIsBrowserReq(r) && !guessIsHealthCheckReq(r) && !guessIsMetricsReq(r) && !isAdminReq(r) && !isKMSReq(r) {
        if ok {
          tc.FuncName = "handler.ValidRequest"
          tc.ResponseRecorder.LogErrBody = true
        }
        writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrAllAccessDisabled), r.URL)
        return
      }
    }
    // ...
```
Cross site scripting in librenms (GHSA-2q8c-gqf4-mg3v)
Aliases: CVE-2023-5060
Published: 2023-09-19T03:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.1'}]}]}]

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.1.
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client (GHSA-vp4f-wxgw-7x8x)
Aliases: CVE-2023-41049
Published: 2023-09-04T16:36:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@dcl/single-sign-on-client'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.0'}]}]}]

### Impact
Improper input validation in the `init` function allows arbitrary javascript to be executed using  the `javascript:` prefix

```ts
    SSO.init('javascript:alert("javascript successfully injected")')
```

### Patches

This vulnerability was patched on version `0.1.0`

### Workarounds

This vulnerability can be prevented if user input correctly sanitized or there is no user input pass to the `init` function
Drools Core Deserialization of Untrusted Data vulnerability (GHSA-m5q8-58wh-xxq4)
Aliases: CVE-2022-1415
Published: 2023-09-11T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.drools:drools-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.69.0.Final'}]}]}]

A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
GeoNode vulnerable to SSRF Bypass to return internal host data (GHSA-pxg5-h34r-7q8p)
Aliases: CVE-2023-42439
Published: 2023-09-20T23:04:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'GeoNode'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.0'}, {'fixed': '4.1.3.post1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.1.2'}}]

A SSRF vulnerability exists, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network.

the application is using a whitelist, but the whitelist can be bypassed with @ and encoded value of @ (%40) GET /proxy/?url=http://development.demo.geonode.org%40geoserver:8080/geoserver/web 
This will trick the application that the first host is a whitelisted address, but the browser will use @ or %40 as a credential to the host geoserver on port 8080, this will return the data to that host on the response.

![image](https://user-images.githubusercontent.com/35967437/264379628-8cecbc56-be6c-49dc-abe8-0baf8b8695cc.png)
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait (GHSA-hc5c-r8m5-2gfh)
Published: 2023-09-21T17:16:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'plone.restapi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.43.3'}]}]}]

### Impact
There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits.

Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait.

### Patches
A patch will be released in `plone.restapi` 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3.

In `plone.restapi` 7 or earlier there was no `@portrait` endpoint yet, so there is nothing to fix in that version. It is still vulnerable to this attack, and needs a [fix in Zope 4](https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v). These two vulnerabilities share the same CVE: CVE-2023-42458.

### Workarounds
You could remove the portrait field from the member data schema, and possibly remove all portraits that are already in the database, but this seems a bit drastic.
HashiCorp Vault Improper Input Validation vulnerability (GHSA-v84f-6r39-cpfc)
Aliases: CVE-2023-4680
Published: 2023-09-15T00:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.6.0'}, {'fixed': '1.12.11'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.7'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.14.0'}, {'fixed': '1.14.3'}]}]}]

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.
incorrect order of evaluation of side effects for some builtins (GHSA-4hg4-9mf5-wxxq)
Aliases: CVE-2023-41052
Published: 2023-09-04T16:39:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.10'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.3.9'}}]

### Impact
The order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order.
• For `uint256_addmod(a,b,c)` and `uint256_mulmod(a,b,c)`, the order is `c,a,b`.
• For `ecadd(a,b)` and `ecmul(a,b)`, the order is `b,a`.

Note that this behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. 

### Patches
https://github.com/vyperlang/vyper/pull/3583

### Workarounds
When using builtins from the list above, make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

### References
_Are there any links users can visit to find out more?_
Microweber Cross-site Scripting vulnerability (GHSA-rgf9-j7gv-rq22)
Aliases: CVE-2023-5244
Published: 2023-09-28T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.4'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber 1.3.4 and prior. A patch is available and anticipated to be part of the 2.x branch.
Apache Avro Java SDK vulnerable to Improper Input Validation (GHSA-rhrv-645h-fjfh)
Aliases: CVE-2023-39410
Published: 2023-09-29T18:30:22Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.avro:avro'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.3'}]}]}]

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.
OpenStack Barbican credential leak flaw (GHSA-6qqp-4vm3-359v)
Aliases: CVE-2023-1633
Published: 2023-09-24T03:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'barbican'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '16.0.0'}]}]}]

A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.
Pimcore Demo Allows GraphQL Introspection (GHSA-p76j-h4m8-hx5c)
Aliases: CVE-2023-5192
Published: 2023-09-27T15:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/demo'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.3.0'}]}]}]

Introspection is enabled on `demo.pimcore.fun`. The demo site has graphql as a feature for users, but allows users to run instropection queries, which presents a potential schema information disclosure vulnerability.
Economizzer Insecure Direct Object Reference vulnerability (GHSA-896v-ph5w-379h)
Aliases: CVE-2023-38872
Published: 2023-09-28T06:30:20Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'gugoan/economizzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9-beta1'}]}]}]

An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.
usememos/memos vulnerable to privilege escalation (GHSA-5j6p-59cj-j6cp)
Aliases: CVE-2023-4697
Published: 2023-09-01T03:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.13.2'}]}]}]

Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2.
Prevent injection of invalid entity ids for "autocomplete" fields (GHSA-4cpv-669c-r79x)
Aliases: CVE-2023-41336
Published: 2023-09-11T14:43:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'symfony/ux-autocomplete'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.2'}]}]}]

### Impact
Under certain circumstances, an attacker could successfully submit an entity id for an `EntityType` that is *not* part of the valid choices.

Affected applications are any that use:

* A custom `query_builder` option to limit the valid results;
AND
* An `EntityType` with `'autocomplete' => true` or a custom [AsEntityAutocompleteField](https://symfony.com/bundles/ux-autocomplete/current/index.html#usage-in-a-form-with-ajax).

Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with `query_builder`.

### Patches

The problem has been fixed in `symfony/ux-autocomplete` version 2.11.2.

### Workarounds
Upgrade to version 2.11.2 or greater of `symfony/ux-autocomplete` or perform extra validation after submit to verify the selected option is valid.
Mattermost Incorrect Authorization vulnerability (GHSA-rp65-jpc7-8h8p)
Aliases: CVE-2023-5159
Published: 2023-09-29T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.1.1'}]}], 'versions': ['8.1.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost/server/v8'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.10'}]}]}]

Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots.
Croc may expose secret to local users (GHSA-7g3v-4ggr-xvjf)
Aliases: CVE-2023-43621
Published: 2023-09-20T06:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/schollz/croc/v9'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.6.5'}]}]}]

An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.
x/net/html Vulnerable to DoS During HTML Parsing (GHSA-vfw5-hrgq-h5wf)
Aliases: CVE-2018-17846
Published: 2023-09-25T17:33:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'golang.org/x/net'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20190125091013-d26f9f9a57f3'}]}]}]

The html package (aka x/net/html) through 2018-09-25 in Go mishandles `<table><math><select><mi><select></table>`, leading to an infinite loop during an `html.Parse` call because `inSelectIM` and `inSelectInTableIM` do not comply with a specification.
Jenkins temporary plugin file created with insecure permissions  (GHSA-55wp-3pq4-w8p9)
Aliases: CVE-2023-43496
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.50'}, {'fixed': '2.414.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.415'}, {'fixed': '2.424'}]}]}]

Jenkins creates a temporary file when a plugin is deployed directly from a URL.

Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.

This issue complements SECURITY-2823, which affected plugins uploaded from an administrator’s computer.
Jenkins 2.424, LTS 2.414.2 creates the temporary file in a subdirectory with more restrictive permissions.

As a workaround, you can change your default temporary-file directory using the Java system property java.io.tmpdir, if you’re concerned about this issue but unable to immediately update Jenkins.
Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library (GHSA-f73w-4m7g-ch9x)
Aliases: CVE-2023-39631
Published: 2023-09-01T18:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.245'}]}]}]

An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.
OpenRefine Remote Code execution in project import with mysql jdbc url attack (GHSA-p3r5-x3hr-gpg5)
Aliases: CVE-2023-41887
Published: 2023-09-12T13:52:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openrefine:database'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.7.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.7.4'}}]

### Summary
An remote Code exec vulnerability allows any unauthenticated user to exec code on the server.

### Details
Hi,Team,
i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can get rce on the server through the mysql userializable If the mysql-connector-java version used on the server side is less than 8.20.
In order for the server to enable deserialization we need to set the `autoDeserialize` and `queryInterceptors` parameters in the connection string,As same with https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m, since the concatenation string is a direct concatenation, it is possible to inject the required parameters after the other parameters.
![image](https://user-images.githubusercontent.com/24366795/262581108-e98dfe16-ee67-463f-8c49-7c318bf0d6f3.png)

And there is a commons-beanutils dependency library on the server side, which contains an RCE-capable deserialization exploit chain

### PoC
env:
centos 7
openrefine 3.7.4
jdk11
mysql-connector-java version 8.14.0
you can use the tool https://github.com/4ra1n/mysql-fake-server to running a malicious mysql server.    
for example use the CB 1.9 Gadget to exec command `touch /tmp/hacked`.  
![image](https://user-images.githubusercontent.com/24366795/262583287-7351a00a-32bf-4cb3-8d86-65ff0a112360.png)  
set the `user` to `base64ZGVzZXJfQ0JfdG91Y2ggL3RtcC9oYWNrZWQ=`(`touch /tmp/hacked` base64 encode),`dataBaseName` to `test?autoDeserialize=true&queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor#`.  
![image](https://user-images.githubusercontent.com/24366795/262583657-9cfb9caa-02ed-4f6b-b110-650108803172.png)
![image](https://user-images.githubusercontent.com/24366795/262583815-a17d5530-bae8-4b4f-9392-4ea41b328c7d.png)  
 command `touch /tmp/hacked` is executed.  
![image](https://user-images.githubusercontent.com/24366795/262583979-823d5843-578f-4af6-b84f-a1422aa1b863.png)

### Impact
An remote Code exec vulnerability allows any unauthenticated user to exec code on the server.
Cecil Cross-site Scripting vulnerability (GHSA-p9q8-7x22-5x77)
Aliases: CVE-2023-4913
Published: 2023-09-12T15:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cecil/cecil'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.47.1'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository cecilapp/cecil prior to 7.47.1.
blurhash panics on parsing crafted inputs (GHSA-cxvp-82cq-57h2)
Aliases: CVE-2023-42447
Published: 2023-09-21T17:10:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'blurhash'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.1'}, {'fixed': '0.2.0'}]}], 'versions': ['0.1.1']}]

### Impact
The blurhash parsing code may panic due to multiple panic-guarded out-of-bounds accesses on untrusted input.

In a typical deployment, this may get triggered by feeding a maliciously crafted blurhashes over the network. These may include:
- UTF-8 compliant strings containing multi-byte UTF-8 characters

### Patches
The patches will be released under version 0.2.0, which requires user intervention because of slight API churn.

### Workarounds
n.a.

### References
n.a.
FUXA SQL Injection vulnerability (GHSA-p46g-8c3q-89p2)
Aliases: CVE-2023-31719
Published: 2023-09-22T00:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'fuxa-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.12'}]}]}]

FUXA <= 1.1.12 is vulnerable to SQL Injection via `/api/signin`.
Cockpit CMS arbitrary file upload vulnerability (GHSA-38vf-35cg-m73w)
Aliases: CVE-2023-41564
Published: 2023-09-09T00:30:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6.3'}]}]}]

An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uploading a crafted `.shtml` file.
Information disclosure in AccessControl (GHSA-8xv7-89vj-q48c)
Aliases: CVE-2023-41050
Published: 2023-09-07T12:56:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'AccessControl'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.4'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Zope'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.8.9'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'AccessControl'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0'}, {'fixed': '5.8'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'AccessControl'}, 'ecosystem_specific': {'affected_functions': ['https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0'}, {'fixed': '6.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Zope'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.8.4'}]}]}]

### Impact
Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure.

`AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe.

Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it.

### Patches
A fix will be introduced in the versions 4.4, 5.8 and 6.2.

### Workarounds
There are no workarounds.

### References
https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for `RestrictedPython`.
Inventory exposes reference to non-Sync data to an arbitrary thread (GHSA-36xm-35qq-795w)
Published: 2023-09-11T20:43:41Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'inventory'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.0'}]}]}]

Affected versions do not enforce a `Sync` bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them.

A caller could use this flaw to submit thread-unsafe data into inventory, then access it as a reference simultaneously from multiple threads.

The flaw was corrected by enforcing that data submitted by the caller into inventory is `Sync`.
Apache Airflow Incorrect Authorization vulnerability (GHSA-wpg8-mf6h-gm92)
Aliases: CVE-2023-40611
Published: 2023-09-12T18:58:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.1'}]}]}]

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc.

Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
Go-Ethereum vulnerable to denial of service via malicious p2p message (GHSA-ppjg-v974-84cm)
Aliases: CVE-2023-40591
Published: 2023-09-06T19:49:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ethereum/go-ethereum'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.12.1-stable'}]}]}]

### Impact

A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node.

Details about this bug will be released within 4-8 weeks, as per our official [vulnerability disclosure policy](https://geth.ethereum.org/docs/developers/geth-developer/disclosures).
### Patches

The fix is included in geth version `1.12.1-stable`, i.e, `1.12.2-unstable` and onwards. 

### Workarounds

No known workarounds. 

### Credits

This bug was reported by Patrick McHardy and reported via [bounty@ethereum.org](mailto:bounty@ethereum.org). 

### References
Apache Superset users may incorrectly create resources using the import charts feature  (GHSA-9qc3-p9jq-2x27)
Aliases: CVE-2023-27526
Published: 2023-09-06T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.0'}]}]}]

A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.
Jenkins temporary uploaded file created with insecure permissions (GHSA-qv64-w99c-qcr9)
Aliases: CVE-2023-43497
Published: 2023-09-20T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.50'}, {'fixed': '2.414.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.415'}, {'fixed': '2.424'}]}]}]

In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API `MultipartFormDataParser` create temporary files in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, attackers with access to the system temporary directory may be able to read and write the file before it is used.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allow attackers to read the temporary file, but not write to it.
Jenkins 2.424, LTS 2.414.2 creates the temporary files in a subdirectory with more restrictive permissions.

As a workaround, you can change your default temporary-file directory using the Java system property `java.io.tmpdir`, if you’re concerned about this issue but unable to immediately update Jenkins.