aswin1906/github-advisory-2023 huggingface dataset:
Apache Airflow Execution with Unnecessary Privileges (GHSA-269x-pg5c-5xgm)
Aliases: CVE-2023-39508
Published: 2023-08-05T09:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.0'}]}]}]

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0.

This issue affects Apache Airflow: before 2.6.0.
Privilege escalation via ApiTokensEndpoint (GHSA-9jcq-jf57-c62c)
Aliases: CVE-2023-39349
Published: 2023-08-08T20:46:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sentry'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '22.1.0'}, {'fixed': '23.7.2'}]}]}]

### Impact
An attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, including tokens with greater scopes, and use those tokens in other requests.

There is no evidence that the issue was exploited on https://sentry.io. For self-hosted users, it is advised to rotate user auth tokens via `https://your-self-hosted-sentry-installation/settings/account/api/auth-tokens/`.

### Patches
The issue was fixed in https://github.com/getsentry/sentry/pull/53850 and is available in the release 23.7.2 of [sentry](https://github.com/getsentry/sentry/releases/tag/23.7.2) and [self-hosted](https://github.com/getsentry/self-hosted/releases/tag/23.7.2).

### Workarounds
There are no known workarounds.
Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint (GHSA-v86x-5fm3-5p7j)
Aliases: CVE-2023-40577
Published: 2023-08-23T20:42:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/prometheus/alertmanager'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.25.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.25.0'}}]

### Impact

An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.

### Patches

Users can upgrade to Alertmanager v0.2.51.

### Workarounds

Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.

### References

N/A
Wallabag user can reset data unintentionally  (GHSA-p8gp-899c-jvq9)
Aliases: CVE-2023-4454
Published: 2023-08-21T20:28:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-alpha.1'}, {'fixed': '2.6.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.6.2'}}]

# Description

wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to `/reset/annotations`, `/reset/entries`, `/reset/tags`, `/reset/archived`.

This vulnerability has a CVSSv3.1 score of 4.3.

**You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration**.

# Resolution

These actions are now doable only via POST method, which ensures that we can't do them via a 3rd-party website. 

# Credits 

We would like to thank @zpbrent for reporting this issue through huntr.dev.

Reference: https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299/
pf4j vulnerable to remote code execution via loadpluginPath parameter (GHSA-rvm8-j2cp-j592)
Aliases: CVE-2023-40827
Published: 2023-08-29T00:32:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.pf4j:pf4j'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.9.0'}]}]}]

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluginPath parameter.
Jenkins Config File Provider Plugin improper credential masking vulnerability (GHSA-pv2g-vm98-vjxf)
Aliases: CVE-2023-40339
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:config-file-provider'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '953.v0432a'}]}]}]

Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they’re written to the build log.

Config File Provider Plugin 953.v0432a_802e4d2 masks credentials configured in configuration files if they appear in the build log.
Path traversal in Archive (GHSA-9v85-q87q-g4vg)
Aliases: CVE-2023-39139
Published: 2023-08-31T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Pub', 'name': 'archive'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.3.7'}}]

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.
1Panel O&M management panel has a background arbitrary file reading vulnerability (GHSA-pv7q-v9mv-9mh5)
Aliases: CVE-2023-39964
Published: 2023-08-10T20:09:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/1Panel-dev/1Panel'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.3'}, {'fixed': '1.5.0'}]}], 'versions': ['1.4.3']}]

### Summary
Arbitrary file reads allow an attacker to read arbitrary important configuration files on the server.

### Details
In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested path parameter[path]. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability
![picture1](https://user-images.githubusercontent.com/136411443/257109786-1b0af1e7-346f-4e92-9da2-d977f2f7fe6a.jpg)

### PoC
Request /api/v1/files/loadfile, carry /etc/passwd data to read, as shown below:
![微信图片_20230731112833](https://user-images.githubusercontent.com/136411443/257109931-108fc16f-e180-4d1e-996c-d9da5f76559f.png)


### Impact
1Panel v1.4.3
Jenkins Folders Plugin cross-site request forgery vulnerability (GHSA-4vqp-pcm3-73xp)
Aliases: CVE-2023-40336
Published: 2023-08-16T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:cloudbees-folder'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.848.ve3b'}]}]}]

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to copy an item, which could potentially automatically approve unsandboxed scripts and allow the execution of unsafe scripts.

Folders Plugin 6.848.ve3b_fd7839a_81 requires POST requests for the affected HTTP endpoint.
1Panel Arbitrary File Download vulnerability (GHSA-85cf-gj29-f555)
Aliases: CVE-2023-39965
Published: 2023-08-10T20:09:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/1Panel-dev/1Panel'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.3'}, {'fixed': '1.5.0'}]}], 'versions': ['1.4.3']}]

### Summary
Any file downloading vulnerability exists in 1Panel backend.

### Details
Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.
![image](https://user-images.githubusercontent.com/116613486/257246024-d0e35800-5fd8-4907-8b1b-504afaad859e.png)

### PoC
payload:

POST /api/v1/files/download/bypath HTTP/1.1
Host: ip
Content-Type: application/json

{"path":"/etc/passwd"}

![f77959349e96543436eea18283fa75c](https://user-images.githubusercontent.com/116613486/257245459-13f2f31b-fcfe-4a27-ba52-e2f1e5d4d749.png)


### Impact
Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.
Wallabag user can delete own API client unintentionally (GHSA-gjvc-55fw-v6vq)
Aliases: CVE-2023-4455
Published: 2023-08-21T20:28:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-alpha.1'}, {'fixed': '2.6.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.6.2'}}]

# Description
wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete API key via `/developer/client/delete/{id}` 

This vulnerability has a CVSSv3.1 score of 6.5.

**You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration**.

# Resolution

This action is now doable only via POST method, which ensures that we can't do it via a 3rd-party website. 

# Credits 

We would like to thank @tht1997 for reporting this issue through huntr.dev.

Reference: https://huntr.dev/bounties/5ab1b206-5fe8-4737-b275-d705e76f193a/
PrestaShop file access through path traversal (GHSA-hpf4-v7v2-95p2)
Aliases: CVE-2023-39528
Published: 2023-08-09T14:38:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 8.1.0'}}]

### Impact
`displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured.

This vulnerability can be exacerbated when coupled with [CWE-502](https://cwe.mitre.org/data/definitions/502.html), which pertains to the Deserialization of Untrusted Data. Such a combination could potentially lead to a Remote Code Execution (RCE) vulnerability

### Patches
8.1.1

### Found by
Aleksey Solovev (Positive Technologies)

### Workarounds

### References
Keylime's registrar vulnerable to Denial-of-service attack via a single open connection (GHSA-pg75-v6fp-8q59)
Aliases: CVE-2023-38200
Published: 2023-08-01T20:16:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'keylime'}, 'ecosystem_specific': {'affected_functions': ['keylime.registrar_common.start', 'keylime.registrar_common.ProtectedHandler']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.4.0'}]}]}]

### Impact
Keylime `registrar` is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port (by default, port `8891`) blocking further, legitimate connections. As long as the connection is open, the `registrar` is blocked and cannot serve any further clients (`agents` and `tenants`), which prevents normal operation. The problem does not affect the `verifier`.

### Patches
Users should upgrade to release 7.4.0
@simonsmith/cypress-image-snapshothas fix for insecure snapshot file names (GHSA-vxjg-hchx-cc4g)
Aliases: CVE-2023-38695
Published: 2023-08-01T16:59:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@simonsmith/cypress-image-snapshot'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.0.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 8.0.1'}}]

### Impact
It's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example:

```js
  cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')
```
The above will create an `ignore-relative-dirs.png` three levels up

### Patches
Fixed in `8.0.2`

### Workarounds
Validate all the existing uses of `matchImageSnapshot` to ensure correct use of the filename argument. Example:

```js
    // snapshot name will be the test title
    cy.matchImageSnapshot();

    // snapshot name will be the name passed in
    cy.matchImageSnapshot('login');
```

### References
https://github.com/simonsmith/cypress-image-snapshot/issues/15
Mattermost fails to correctly delete attachments (GHSA-g3v6-r8p9-wxg9)
Aliases: CVE-2023-4105
Published: 2023-08-11T09:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.9.0'}, {'fixed': '7.9.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.9.5'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.10.0'}, {'fixed': '7.10.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.10.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.8.7'}}]

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message
xuxueli xxl-job Cross-Site Request Forgery Vulnerability (GHSA-jp5r-4x9q-4vcf)
Aliases: CVE-2020-24922
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.xuxueli:xxl-job'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.0'}]}]}]

Cross Site Request Forgery (CSRF) vulnerability in `xxl-job-admin/user/add` in xuxueli xxl-job version 2.2.0 allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.
Improper log output when using GitHub Status Notifications in spinnaker (GHSA-rq5c-hvw6-8pr7)
Aliases: CVE-2023-39348
Published: 2023-08-29T17:35:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/spinnaker/spinnaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}]}], 'database_specific': {'last_known_affected_version_range': '< 1.28.8'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/spinnaker/spinnaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.29.0'}]}], 'database_specific': {'last_known_affected_version_range': '< 1.29.6'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/spinnaker/spinnaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.30.0'}]}], 'database_specific': {'last_known_affected_version_range': '< 1.30.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/spinnaker/spinnaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.31.0'}]}], 'database_specific': {'last_known_affected_version_range': '< 1.31.1'}}]

### Impact
ONLY IMPACTS those use GitHub Status Notifications

Log output when updating GitHub status is improperly set to FULL always.  It's recommended to apply the patch and rotate the GitHub token used for github status notifications.  Given that this would output github tokens to a log system, the risk is slightly higher than a "low" since token exposure could grant elevated access to repositories outside of control.  If using READ restricted tokens, the exposure is such that the token itself could be used to access resources otherwise restricted from reads.

### Patches
Patch is in progress.  https://github.com/spinnaker/echo/pull/1316

### Workarounds
Disable GH Status Notifications.  Filter your logs for Echo log data.  Use read-only tokens that are limited in scope.

### References
sig-security in slack: https://spinnakerteam.slack.com/archives/CFN8F5UR2
Minimal `basti` IAM Policy Allows Shell Access (GHSA-q4pp-j36h-3gqg)
Published: 2023-08-24T12:53:06Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'basti-cdk'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.1'}]}]}]

### Summary

The provided Minimal IAM Policy for `bastic connect` does not include `ssm:SessionDocumentAccessCheck`. This results in the ability to get a shell session on the bastion, not just the intended access for Port Forwarding.

### Details

`basti connect` is designed to "securely connect to your RDS/Aurora/Elasticache/EC2 instances", using a bastion instance "with [AWS Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) port forwarding capability to make the target available on your localhost."

The [Minimal IAM Policy](https://github.com/BohdanPetryshyn/basti#minimal-iam-permissions) allows port forwarding via the following statement:

```   
 {
      "Effect": "Allow",
      "Action": "ssm:StartSession",
      "Resource": [
        "arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost",
        "arn:aws:ec2:<your-region>:<your-account-id>:instance/<your-basti-instance-id>"
      ]
    }
```

This statement does not include the following condition:

```
"Condition": {
    "BoolIfExists": {
        "ssm:SessionDocumentAccessCheck": "true"
    }
}
```

As a result, the `basti connect` minimal policy is logically identical to:

```
 {
      "Effect": "Allow",
      "Action": "ssm:StartSession",
      "Resource": [
        "arn:aws:ssm:*:*:document/AWS-StartPortForwardingSessionToRemoteHost",
        "arn:aws:ssm:*:*:document/SSM-SessionManagerRunShell",
        "arn:aws:ec2:<your-region>:<your-account-id>:instance/<your-basti-instance-id>"
      ]
    }
```

A `basti` admin would expect users under the minimal policy to be able to port forward. However, they could also get a shell on the bastion.

For more details on this footgun, see: https://ramimac.me/ssm-iam

### PoC
_Complete instructions, including specific configuration details, to reproduce the vulnerability._

### Impact

Impact would depend on configuration/hardening of the bastion. I've seen examples where bastions have credentials to downstream systems in configuration or memory that would be exposed.
Airflow Sqoop Provider RCE Vulnerability (GHSA-g3m9-pr5m-4cvp)
Aliases: CVE-2023-27604
Published: 2023-08-28T09:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-sqoop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections.

 It is recommended to upgrade to a version that is not affected.
This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.
Horizon Web Dashboard Open Redirect vulnerability (GHSA-5pv6-rprw-82wv)
Aliases: CVE-2022-45582
Published: 2023-08-22T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'horizon'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.0'}]}]}]

Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.
Duplicate Advisory: weaviate denial of service vulnerability (GHSA-ch6w-mc6c-g65g)
Published: 2023-08-21T18:31:23Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/weaviate/weaviate'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.20.0'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8697-479h-5mfp. This link is maintained to preserve external references.

## Original Description
An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the `handleUnbatchedGraphQLRequest` function.
pf4j vulnerable to remote code execution via expandIfZip method in the extract function (GHSA-cj8w-v588-p8wx)
Aliases: CVE-2023-40828
Published: 2023-08-29T00:32:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.pf4j:pf4j'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.9.0'}]}]}]

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIfZip method in the extract function.
Shescape on Windows escaping may be bypassed in threaded context (GHSA-j55r-787p-m549)
Aliases: CVE-2023-40185
Published: 2023-08-22T18:00:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'shescape'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.4'}]}]}]

### Impact

This may impact users that use Shescape on Windows in a threaded context (e.g. using [Worker threads](https://nodejs.org/api/worker_threads.html)). The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers to bypass protections depending on the combination of expected and used shell.

This snippet demonstrates a vulnerable use of Shescape:

```javascript
// vulnerable.js

import { exec } from "node:child_process";
import { Worker, isMainThread } from 'node:worker_threads';

import * as shescape from "shescape";

if (isMainThread) {
  // 1. Something like a worker thread must be used. The reason being that they
  // unexpectedly change environment variable names on Windows.
  new Worker("./vulnerable.js");
} else {
  // 2. Example configuration that's problematic. In this setup example the
  // expected default system shell is CMD. We configure the use of PowerShell.
  // Shescape will fail to look up PowerShell and default to escaping for CMD
  // instead, resulting in the vulnerability.
  const options = {
    shell: "powershell",
    interpolation: true,
  };

  // 3. Using shescape to protect against attacks, this is correct.
  const escaped = shescape.escape("&& ls", options);

  // 4. Invoking a command with the escaped user input, this is vulnerable in
  // this case.
  exec(`echo Hello ${escaped}`, options, (error, stdout) => {
    if (error) {
      console.error(`An error occurred: ${error}`);
    } else {
      console.log(stdout);
    }
  });
}
```

### Patches

This bug has been patched in [v1.7.4](https://github.com/ericcornelissen/shescape/releases/tag/v1.7.4) which you can upgrade to now. No further changes are required.

### Workarounds

If you are impacted there is no workaround possible.

### References

- Shescape Pull Request [#1142](https://github.com/ericcornelissen/shescape/pull/1142)
- Shescape commit [`0b976da`](https://github.com/ericcornelissen/shescape/commit/0b976dab645abf45ffd85e74a8c6e51ee2f42d63)
- Shescape release [v1.7.4](https://github.com/ericcornelissen/shescape/releases/tag/v1.7.4)

### For more information

- Comment on Pull Request [#1142](https://github.com/ericcornelissen/shescape/pull/1142)
- Comment on commit [`0b976da`](https://github.com/ericcornelissen/shescape/commit/0b976dab645abf45ffd85e74a8c6e51ee2f42d63)
- Open an issue at [https://github.com/ericcornelissen/shescape/issues](https://github.com/ericcornelissen/shescape/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc) (New issue > Question > Get started)
GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments (GHSA-pr76-5cm5-w9cj)
Aliases: CVE-2023-40267
Published: 2023-08-11T09:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'GitPython'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.32'}]}]}]

GitPython before 3.1.32 does not block insecure non-multi options in `clone` and `clone_from`, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
Duplicate Advisory: @excalidraw/excalidraw Cross-site Scripting vulnerability (GHSA-fr9g-2m2h-c27j)
Published: 2023-08-16T06:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@excalidraw/excalidraw'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.15.3'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v7v8-gjv7-ffmr. This link is maintained to preserve external references.

## Original Description
Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.
pyca/cryptography's wheels include vulnerable OpenSSL (GHSA-jm77-qphf-c4w8)
Published: 2023-08-01T22:34:41Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'cryptography'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8'}, {'fixed': '41.0.3'}]}]}]

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8-41.0.2 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230731.txt, https://www.openssl.org/news/secadv/20230719.txt, and https://www.openssl.org/news/secadv/20230714.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Cockpit Cross-site Scripting vulnerability (GHSA-w3qm-93vf-5hrw)
Aliases: CVE-2023-4196
Published: 2023-08-06T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. For any role that has permission to execute function assets, an attacker can upload a html file and that leads to XSS.
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms (GHSA-c7hh-3v6c-fj4q)
Aliases: CVE-2023-38700
Published: 2023-08-04T17:26:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-appservice-irc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.0.0'}}]

### Impact

It was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target.

### Patches

Please upgrade to 1.0.1.

### Workarounds

You can set the `matrixHandler.eventCacheSize` config value to `0` to workaround this bug. However, this may impact performance.

### Credits

Discovered and reported by [Val Lorentz](https://valentin-lorentz.fr/).

### For more information

If you have any questions or comments about this advisory email us at [security@matrix.org](mailto:security@matrix.org).
OpenNMS privilege escalation vulnerability (GHSA-hf5p-f83x-5q2g)
Aliases: CVE-2023-40315
Published: 2023-08-17T21:30:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-webapp-rest'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '31.0.8'}, {'fixed': '32.0.2'}]}]}]

In OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. The solution is to upgrade to Meridian 2023.1.5 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Erik Wynter for reporting this issue.
PrestaShop file deletion via attachment API (GHSA-2rf5-3fw8-qm47)
Aliases: CVE-2023-39529
Published: 2023-08-09T14:38:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 8.1.0'}}]

### Impact
It is possible to delete a file from the server by using the Attachments controller and the Attachments API.

### Patches
8.1.1

### Found by
Kto94 (via Yeswehack)

### Workarounds
none

### References
none
Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields (GHSA-599v-h3q5-g6r9)
Aliases: CVE-2023-4453
Published: 2023-08-21T20:41:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.6.8'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.6.8 or apply this patch manually https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e.patch manually.

### References
https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993/
LangChain vulnerable to arbitrary code execution (GHSA-fj32-q626-pjjc)
Aliases: CVE-2023-38860
Published: 2023-08-15T18:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.231'}]}]}]

An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.
DDFFileParser is vulnerable to XXE Attacks (GHSA-wc9j-gc65-3cm7)
Aliases: CVE-2023-41034
Published: 2023-08-31T21:47:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.leshan:leshan-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.leshan:leshan-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-M1'}, {'fixed': '2.0.0-M13'}]}]}]

### Impact
`DDFFileParser` and `DefaultDDFFileValidator` (and so `ObjectLoader`) are vulnerable to [XXE Attacks](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing).

[DDF file](https://github.com/eclipse-leshan/leshan/wiki/Adding-new-objects#the-lwm2m-model) is a LWM2M format used to store LWM2M object description.   
Leshan users are impacted only if they parse untrusted DDF files (e.g. if they let external users provide their own model), in that case they MUST upgrade to fixed version.
If you parse only trusted DDF file and validate only with trusted xml schema, upgrading is not mandatory. 

### Patches
This is fixed in **v1.5.0** and **2.0.0-M13**.

### Workarounds
No easy way. Eventually writing your own `DDFFileParser`/`DefaultDDFFileValidator` (and so `ObjectLoader`) creating a `DocumentBuilderFactory` with : 
```java
// For DDFFileParser
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); // Disable DTDs
factory.setXIncludeAware(false); // Disable XML Inclusions
factory.setExpandEntityReferences(false); // disable expand entity reference nodes

// For DefaultDDFFileValidator
SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
``` 

### References
- https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
- https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
- https://semgrep.dev/docs/cheat-sheets/java-xxe/
- https://community.veracode.com/s/article/Java-Remediation-Guidance-for-XXE
pimcore/customer-management-framework-bundle Cross-site Scripting vulnerability in Segment name (GHSA-735f-w79p-282x)
Aliases: CVE-2023-4145
Published: 2023-08-03T16:32:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/customer-management-framework-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.2'}]}]}]

### Impact
As HTML injection works in email an attacker can trick a victim to click on such hyperlinks to redirect him to any malicious site and also can host a XSS page. All this will surely cause some damage to the victim. This could lead to users being tricked into giving logins away to malicious attackers.

### Patches
Update to version 3.4.2 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch

### Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/72f45dd537a706954e7a71c99fbe318640e846a2.patch manually.

### References
https://huntr.dev/bounties/ce852777-2994-40b4-bb4e-c4d10023eeb0/
Sentry vulnerable to incorrect credential validation on OAuth token requests (GHSA-hgj4-h2x3-rfx4)
Aliases: CVE-2023-39531
Published: 2023-08-09T20:58:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sentry'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '23.7.2'}]}]}]

### Impact

An attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. 

### Remediation

- **Sentry SaaS** customers do not need to take any action. Those with the highest risk will be contacted directly by Sentry.
- **Self-hosted installations** should upgrade to version 23.7.2 or higher.

### Workarounds

There are no direct workarounds, but users should review applications authorized on their account (_User Settings > Authorized Applications_) and remove any that are no longer needed.
Spipu HTML2PDF vulnerable to cross-site scripting  (GHSA-99fg-2h75-m92h)
Aliases: CVE-2023-39062
Published: 2023-08-28T18:30:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'spipu/html2pdf'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.2.8'}]}]}]

Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script to the forms.php.
Jenkins Fortify Plugin cross-site request forgery vulnerability (GHSA-3fjv-8r82-6xm9)
Aliases: CVE-2023-4301
Published: 2023-08-22T00:31:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:fortify'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '22.2.39'}]}], 'database_specific': {'last_known_affected_version_range': '<= 22.1.38'}}]

Jenkins Fortify Plugin 22.1.38 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Fortify Plugin 22.2.39 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Apache Ivy External Entity Reference vulnerability (GHSA-2jc4-r94c-rp7h)
Aliases: CVE-2022-46751
Published: 2023-08-21T09:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.ivy:ivy'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.2'}]}]}]

Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.

When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used.

This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways.

Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed.

Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".
Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User (GHSA-826j-8wp2-4x6q)
Aliases: CVE-2023-32079
Published: 2023-08-25T18:42:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gravitl/netmaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/gravitl/netmaker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.18.0'}, {'fixed': '0.18.6'}]}]}]

### Impact
A Mass assignment vulnerability was found allowing a non-admin user to escalate privileges to admin user.

### Patches
Issue is patched in 0.17.1, and fixed in 0.18.6+.

If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users

If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.

### Workarounds
If using 0.17.1, can just pull the latest docker image of backend and restart server.

### References
Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery
Cockpit PHP Remote File Inclusion vulnerability (GHSA-xcq3-7pf3-5jvc)
Aliases: CVE-2023-4195
Published: 2023-08-06T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

PHP Remote File Inclusion in GitHub repository cockpit-hq/cockpit prior to 2.6.3. Users may upload php files through the system file upload utility to obtain remote code execution.
@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError (GHSA-vx8m-6fhw-pccw)
Aliases: CVE-2023-40178
Published: 2023-08-21T20:13:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@node-saml/node-saml'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.5'}]}]}]

### Summary

The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. 

### Details

It was noticed that in the validatePostRequestAsync() flow in saml.js, the current timestamp is never checked. This could present a vulnerability where a user who has an XML LogoutRequest could validated it if the IssueInstance and the NotOnOrAfter are valid along with valid credentials (signature, certificate etc.). 

### PoC

I was able to validate a sample valid LogoutRequest XML multiple times through postman by sending it to my endpoint regardless if the current present time was past the NotOnOrAfter time. After some further testing, it seems that only the IssueInstance is checked against NotOnOrAfter. Not sure if this was the intended behaviour but I believe having a never expiring valid LogoutRequest could be dangerous.

### Impact

This could impact the user where they would be logged out from an expired LogoutRequest. In bigger contexts, if LogoutRequests are sent out in mass to different SPs, this could impact many users on a large scale.
PowerJob incorrect access control vulnerability (GHSA-443m-3fr6-w8wj)
Aliases: CVE-2023-36106
Published: 2023-08-17T21:30:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'tech.powerjob:powerjob'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.2'}]}]}]

An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via `appId` parameter to `/container/list`.
PrestaShop boolean SQL injection (GHSA-75p5-jwx4-qw9h)
Aliases: CVE-2023-39524
Published: 2023-08-09T14:34:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 8.1.0'}}]

### Impact
SQL injection possible in product search field, in BO's product page

### Patches
8.1.1

### Found by
Aleksey Solovev (Positive Technologies)

### Workarounds
none

### References
none
Jenkins Delphix Plugin missing permission check (GHSA-3fqw-j7x8-g75j)
Aliases: CVE-2023-40344
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:delphix'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.3'}]}]}]

Jenkins Delphix Plugin 3.0.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Delphix Plugin 3.0.3 requires the appropriate permissions.