aswin1906/github-advisory-2023 huggingface dataset:
Symbiote Seed Open Redirect vulnerability (GHSA-wm32-3r4m-jvcc)
Aliases: CVE-2017-20164
Published: 2023-01-07T21:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'symbiote/silverstripe-seed'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.3'}]}]}]

A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function `onBeforeSecurityLogin` of the file `code/extensions/SecurityLoginExtension.php` of the component `Login`. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 can address this issue. The name of the patch is b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.
Apache Dubbo vulnerable to remote code execution via Telnet Handler (GHSA-fprr-rrm8-4534)
Aliases: CVE-2021-32824
Published: 2023-01-03T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.dubbo:dubbo-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.dubbo:dubbo-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.10'}]}]}]

Apache Dubbo is a Java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-authorization remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods to collect information about the providers and methods exposed by the service and it can even allow to shutdown the service. This endpoint is unprotected. 

Additionally, a provider method can be invoked using the `invoke` handler. This handler uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with `PojoUtils.realize` which can be used to instantiate arbitrary classes and invoke its setters. Even though FastJson is properly protected with a default blocklist, `PojoUtils.realize` is not, and an attacker can leverage that to achieve remote code execution. 

Versions 2.6.10 and 2.7.10 contain fixes for this issue.
Remote code execution in simple-git (GHSA-9w5j-4mwv-2wj8)
Aliases: CVE-2022-25860
Published: 2023-01-26T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'simple-git'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.16.0'}]}]}]

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.
dompurify vulnerable to Cross-site Scripting (GHSA-pgjv-jrg2-gq3v)
Published: 2023-01-11T23:47:05Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'dompurify'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.2'}]}]}]

dompurify prior to version 2.2.2 is vulnerable to cross-site scripting when converting from SVG namespace.
Remote Code Execution in com.bstek.uflo:uflo-core (GHSA-8m9f-c5p9-wqch)
Aliases: CVE-2022-25894
Published: 2023-01-26T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.bstek.uflo:uflo-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.5'}]}]}]

All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.
Apache IoTDB contains Improper Authentication (GHSA-pp4w-9x82-6r47)
Aliases: CVE-2023-24830
Published: 2023-01-30T18:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.iotdb:iotdb-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.13.0'}, {'fixed': '0.13.3'}]}]}]

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 before 0.13.3.
Open redirect vulnerability in Jenkins OpenID Plugin  (GHSA-mj62-m63x-mh84)
Aliases: CVE-2023-24445
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:openid'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4'}]}]}]

Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.
Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (GHSA-m3g7-wrrq-v5c8)
Aliases: CVE-2023-0055
Published: 2023-01-05T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev32'}]}]}]

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session. This issue is patched in version 0.5.0b3.dev32.
Cross-site request forgery in Jenkins Gerrit Trigger Plugin (GHSA-95jq-24cr-pgrq)
Aliases: CVE-2023-24423
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.38.1'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous builds triggered by Gerrit.
CakePHP vulnerable to Remote File Inclusion through View template name manipulation (GHSA-p76f-wr22-4rv6)
Published: 2023-01-20T23:35:01Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.4.0'}, {'fixed': '2.4.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.5.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.15'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.1.4'}]}]}]

CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.
django-ucamlookup Cross-site Scripting vulnerability (GHSA-pjx4-3f3p-29v3)
Aliases: CVE-2016-15010
Published: 2023-01-05T09:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'django-ucamlookup'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.2'}]}]}]

A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this vulnerability is an unknown functionality of the component Lookup Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.9.2 can address this issue. The name of the patch is 5e25e4765637ea4b9e0bf5fcd5e9a922abee7eb3. It is recommended to upgrade the affected component. The identifier VDB-217441 was assigned to this vulnerability.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
phpMyFAQ Reflected Cross-site Scripting vulnerability (GHSA-m9xr-8cx7-53pj)
Aliases: CVE-2023-0314
Published: 2023-01-16T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Command Injection in create-choo-electron (GHSA-j8wr-fwf2-vvr9)
Aliases: CVE-2022-25908
Published: 2023-01-26T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'create-choo-electron'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.0'}]}]}]

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin (GHSA-r3gm-jwf4-xgv2)
Aliases: CVE-2023-24437
Published: 2023-01-26T21:30:18Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:jira-steps'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.165.v8846cf59f3db'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Flarum notifications can leak restricted content (GHSA-8gcg-vwmw-rxj4)
Aliases: CVE-2023-22488
Published: 2023-01-10T22:27:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'flarum/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.3'}]}]}]

Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content.

The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through their different channels. The alerts do not leak data despite this as they are listed based on a visibility check, however, emails are still sent out.

This means that, for extensions which restrict access to posts, any actor can bypass the restriction by subscribing to the discussion if the [*Subscriptions*](https://extiverse.com/extension/flarum/subscriptions) extension is enabled.

### Impact
The attack allows the leaking of some posts in the forum database, including posts awaiting approval, posts in tags the user has no access to if they could subscribe to a discussion before it becomes private, and posts restricted by third-party extensions.

Other leaks could also happen for different notification subjects if some features allowed to receive specific types of notifications for restricted content.

All Flarum versions prior to v1.6.3 are affected.

### Patches
The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible to v1.6.3 using:

```
composer update --prefer-dist --no-dev -a -W
```
You can then confirm you run the latest version using:

```
composer show flarum/core
```

### Workarounds
Disable the Flarum Subscriptions extension or disable email notifications altogether.

**There is no other supported workaround for this issue for Flarum versions below 1.6.3.**

### For more information
For any questions or comments on this vulnerability please visit https://discuss.flarum.org/

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.
scs-library-client may leak user credentials to third-party service via HTTP redirect (GHSA-7p8m-22h4-9pj7)
Aliases: CVE-2022-23538
Published: 2023-01-20T22:38:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/sylabs/scs-library-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.4.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/sylabs/scs-library-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.4'}]}]}]

### Impact

When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download.

Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user.

The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow.

Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow.

We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise.

### Patches

The security issue was identified after the integration of a bug-fix commit 68ac4ca into the previously released scs-library-client 1.3.4. This commit fixes the security issue in the 1.3 series.

scs-library-client 1.4.2 contains a fix for the same vulnerability in the 1.4 series, as commit eebd7ca.

### Workarounds

There is no workaround available at this time.

As above, access to Singularity Enterprise 2.x, or Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow.

### References

https://cwe.mitre.org/data/definitions/522.html
Field-level security issue with .keyword fields in OpenSearch (GHSA-v3cg-7r9h-r2g6)
Aliases: CVE-2023-23613
Published: 2023-01-24T20:54:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opensearch:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.opensearch:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.5.0'}]}]}]

### Advisory title: Field-level security issue with .keyword fields

### Affected versions:
OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1

### Patched versions:
OpenSearch 1.3.8 and 2.5.0

### Impact:
There is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields.

This issue is only present for authenticated users with read access to the indexes containing the restricted fields.

### Workaround:
FLS rules that use explicit exclusions can be written to grant explicit access instead. Policies authored in this way are not subject to this issue.

### Patches:
OpenSearch versions 1.3.8 and 2.5.0 contain a fix for this issue.

### For more information:
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
RSSHub SSRF vulnerability (GHSA-64wp-jh9p-5cg2)
Aliases: CVE-2023-22493
Published: 2023-01-11T22:04:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'rsshub'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-master.a66cbcf'}]}]}]

## Summary

RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network.

## Description

An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. For example, if an attacker controls the `ATTACKER.HOST` domain, they can send a request to affected routes with the value set to `ATTACKER.HOST%2F%23`.
The `%2F` and `%23` characters are URL-encoded versions of the forward-slash (`/`) and pound (`#`) characters, respectively. In this context, an attacker could use those characters to append the base URL (i.e. `https://${input}.defined.host`) to be modified to `https://ATTACKER.HOST/#.defined.host`. This will cause the server to send a request to the attacker-controlled domain, allowing the attacker to potentially gain access to sensitive information or perform further attacks on the server. 

## Impact

An attacker could use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack.

## Reference

Fixing PR: https://github.com/DIYgod/RSSHub/pull/11588
nodebatis SQL Injection vulnerability (GHSA-8ph8-9q2j-c3rq)
Aliases: CVE-2018-25066
Published: 2023-01-06T12:31:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'nodebatis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.0'}]}]}]

A vulnerability was found in PeterMu nodebatis up to 2.1.x. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql injection. Upgrading to version 2.2.0 can address this issue. The name of the patch is 6629ff5b7e3d62ad8319007a54589ec1f62c7c35. It is recommended to upgrade the affected component. VDB-217554 is the identifier assigned to this vulnerability.
DoS vulnerability in MaliciousCode filter (GHSA-3p73-mm7v-4f6m)
Aliases: CVE-2023-23617
Published: 2023-01-27T00:55:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.22'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0.0'}, {'fixed': '20.0.19'}]}]}]

### Impact
Infinite loop in malicious code filter in certain conditions.

### Workarounds

None
usememos/memos vulnerable to stored Cross-site Scripting (GHSA-9h7x-9pmh-7gg8)
Aliases: CVE-2023-0112
Published: 2023-01-07T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Cross Site Scripting in simplesamlphp-module-openidprovider (GHSA-chgc-rqjr-46gg)
Aliases: CVE-2010-10008
Published: 2023-01-17T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'simplesamlphp/simplesamlphp-module-openidprovider'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.9.0'}]}]}]

A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file templates/trust.tpl.php. The manipulation of the argument StateID leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.9.0 is able to address this issue. The name of the patch is 8365d48c863cf06ccf1465cc0a161cefae29d69d. It is recommended to upgrade the affected component. The identifier VDB-218473 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Cross-Site Request Forgery in modoboa (GHSA-g298-59pg-93h7)
Aliases: CVE-2023-0406
Published: 2023-01-19T18:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.4'}]}]}]

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
usememos/memos vulnerable to stored Cross-site Scripting (GHSA-fpjc-cxr6-w6h8)
Aliases: CVE-2023-0108
Published: 2023-01-07T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
ReDoS based DoS vulnerability in Action Dispatch (GHSA-8xww-x3g3-6jcv)
Aliases: CVE-2023-22795
Published: 2023-01-18T18:20:51Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.7.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.1'}]}]}]

There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1

Impact

A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious If-None-Match headers before they reach the application.

Users on Ruby 3.2.0 or greater are not affected by this vulnerability.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 6.1 series
    7-0-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
symfont/process typosquatting malware spoofs symfony/process (GHSA-g3j5-mpp2-2fqm)
Published: 2023-01-26T19:53:11Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'symfont/process'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}]}]}]

In September 2021, security researchers discovered a malicious Composer package called `symfont/process`, a typosquat targeting users of `symfony/process`. The malicious package has since been removed from Packagist.
Publify Core does not strip metadata from images (GHSA-79wq-g4v9-gfj4)
Aliases: CVE-2022-2815
Published: 2023-01-14T15:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'publify_core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.10'}]}]}]

Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10.
git2-rs fails to verify SSH keys by default (GHSA-m4ch-rfv5-x5g3)
Published: 2023-01-20T23:36:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'libgit2-sys'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.14.0'}, {'fixed': '0.14.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'libgit2-sys'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.13.5'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'git2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.1'}]}]}]

The git2 and libgit2-sys crates are Rust wrappers around the [libgit2](https://libgit2.org/) C library. It was discovered that libgit2 1.5.0 and below did not verify SSH host keys when establishing an SSH connection, exposing users of the library to Man-In-the-Middle attacks.

The libgit2 team assigned [CVE-2023-22742](https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq) to this vulnerability. The following versions of the libgit2-sys Rust crate have been released:

* libgit2-sys 0.14.2, updating the underlying libgit2 C library to version 1.5.1.
* libgit2-sys 0.13.5, updating the underlying libgit2 C library to version 1.4.5.

A new git2 crate version has also been released, 0.16.1. This version only bumps its libgit2-sys dependency to ensure no vulnerable libgit2-sys versions are used, but contains no code changes: if you update the libgit2-sys version there is no need to also update the git2 crate version.

[You can learn more about this vulnerability in libgit2's advisory](https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq)
Zitadel RefreshToken invalidation vulnerability (GHSA-6rrr-78xp-5jp8)
Aliases: CVE-2023-22492
Published: 2023-01-11T18:27:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/zitadel/zitadel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.17.0'}, {'fixed': '2.17.3'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/zitadel/zitadel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.16.4'}]}]}]

### Impact
RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI.

RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant.

When the locked or deactivated user’s session was already terminated (“logged out”) then it was not possible to create a new session. Renewal of access token through a refresh token grant is limited to the configured amount of time (RefreshTokenExpiration).

### Patches
2.x versions are fixed on >= [2.17.3](https://github.com/zitadel/zitadel/releases/tag/v2.17.3)
2.16.x versions are fixed on >= [2.16.4](https://github.com/zitadel/zitadel/releases/tag/v2.16.4)

ZITADEL recommends upgrading to the latest versions available in due course.

### Workarounds
Ensure the RefreshTokenExpiration in the OIDC settings of your instance is set according to your security requirements.

### References

https://zitadel.com/docs/guides/manage/console/instance-settings#oidc-token-lifetimes-and-expiration
org.neo4j.procedure:apoc Path Traversal Vulnerability (GHSA-5v8v-gwmw-qw97)
Aliases: CVE-2022-23532
Published: 2023-01-13T21:28:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.neo4j.procedure:apoc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.0.12'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.neo4j.procedure:apoc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.4.0.0'}, {'fixed': '4.4.0.12'}]}]}]

### Impact
A Path Traversal Vulnerability found in the apoc.export.* procedures of apoc plugins in Neo4j Graph database.
The issue allows a malicious actor to potentially break out of the expected directory. The vulnerability is such that files could only be created but not overwritten.

For the vulnerability to be exploited, an attacker would need access to execute an arbitrary query, either by having access to an authenticated Neo4j client, or a Cypher injection vulnerability in an application. The procedure would need to have been allow listed in the neo4j configuration as well as having the apoc config `apoc.export.file.enabled` set to true. 

On a UNIX based system the following query allows arbitrary write access to the tmp folder:

CALL apoc.export.csv.query('RETURN 1', 'file:///..//..//..//..//tmp/test.txt', {})

### Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability are 4.4.0.12 and 4.3.0.12.

### Workarounds
If you cannot upgrade the library, you can control the [allowlist of the ](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist)procedures that can be used in your system, and/or turn off local file access by setting apoc.export.file.enabled=false

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)
* Email us at [security@neo4j.com](mailto:security@neo4j.com)

### Credits
We want to publicly recognise the contribution Adam Reziouk - Airbus.
XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument (GHSA-7vcx-v65q-9wpg)
Published: 2023-01-11T23:53:34Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'phpxmlrpc/phpxmlrpc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.9.0'}]}]}]

In order for this weakness to be exploited, the following conditions have to apply, at the same time:

- method `Wrapper::buildClientWrapperCode`, or any methods which depend on it, such as `Wrapper::wrapXmlrpcServer`, `Wrapper::wrapXmlrpcMethod` or `Wrapper::buildWrapMethodSource` must be in use. Note that they are _not_ used by default in either the Client or Server classes provided by the library; the developer has to specifically make use of them in his/her own code
- the `$client` argument to either of those methods should have been built with malicious data, ie. data controlled by a 3rd party, passed to its constructor call

This is most likely an uncommon usage scenario, and as such the chances of exploitation may be low.

*NB* the graphical debugger which is shipped as part of the library is vulnerable to this, when used with the option "Generate stub for method call" selected. In that case, the debugger will _display_ but not _execute_ the malicious code, which would have to be provided via carefully crafted values for the "Address" and "Path" inputs.

The attack scenario in this case is that a developer copies into his/her own source code the php snippet generated by the debugger, in a situation where the debugger is used with "Address"/"Path" input values supplied by a 3rd party.
The malicious payload in the "Address"/"Path" input values should be easily recognized as suspicious by any barely proficient developer, as it resembles a bog-standard injection attack.
It goes without saying that a responsible developer should not blindly copy and paste into his/her own code anything generated by a 3rd party tool, such as the phpxmlrpc debugger, without giving it at least a cursory scan.

Originally reported as issue #80
@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS) (GHSA-h857-2g56-468g)
Aliases: CVE-2023-22461
Published: 2023-01-05T12:18:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@mattkrick/sanitize-svg'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.3.1'}}]

### Impact
The *sanitize-svg* package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting (XSS). In doing so, literal `<script>`-tags and on-event handlers were detected:
```typescript
[...]
  const svgEl = div.firstElementChild!
  const attributes = Array.from(svgEl.attributes).map(({ name }) => name)
  const hasScriptAttr = !!attributes.find((attr) => attr.startsWith('on'))
  const scripts = svgEl.getElementsByTagName('script')
  return scripts.length === 0 && !hasScriptAttr ? svg : null
[...]
```

There are more ways to embed JavaScript in XML files.

**Anchor Tag** (requires user to click link):
```xml
<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg">
  <a href="javascript:alert(document.domain)">
    <text x="50" y="50" text-anchor="middle">Lauritz</text>
  </a>
</svg>
```

**Foreign Object Tag** (no user interaction required):
```xml
<svg width="500" height="500" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
        <text x="20" y="35">Lauritz</text>
        <foreignObject width="500" height="500">
                <iframe xmlns="http://www.w3.org/1999/xhtml" src="javascript:confirm(document.domain);" width="400" height="250"/>
        </foreignObject>
</svg>
```

As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to XSS. We are aware of at least one downstream project for which this vulnerability had security implications. 

### Patches
This vulnerability was addressed in v0.4.0.

### Workarounds
N/A
NYUCCL psiTurk IS vulnerable to Improper Neutralization of Special Elements (GHSA-9mq4-9556-6qxq)
Aliases: CVE-2021-4315
Published: 2023-01-29T00:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'psiTurk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.1'}]}]}]

A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676.
jruby-openssl gem for JRuby fails to do proper certificate validation (GHSA-xgv7-pqqh-h2w9)
Aliases: CVE-2009-4123
Published: 2023-01-19T17:51:27Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'jruby-openssl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6'}]}]}]

A security problem involving peer certificate verification was found where failed verification silently did nothing, making affected applications vulnerable to attackers. Attackers could lead a client application to believe that a secure connection to a rogue SSL server is legitimate. Attackers could also penetrate client-validated SSL server applications with a dummy certificate.
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys (GHSA-vjhf-8vqx-vqpq)
Aliases: CVE-2023-22463
Published: 2023-01-06T17:37:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/KubeOperator/kubepi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.6.2'}}]

### Summary
The jwt authentication function of kubepi <= v1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. 

### Details
[`session.go`](https://github.com/KubeOperator/KubePi/blob/da784f5532ea2495b92708cacb32703bff3a45a3/internal/api/v1/session/session.go#L35), the use of hard-coded JwtSigKey allows an attacker to use this value to forge jwt tokens arbitrarily. The JwtSigKey is confidential and should not be hard-coded in the code.

```golang
var JwtSigKey = []byte("signature_hmac_secret_shared_key")
var jwtMaxAge = 10 * time.Minute

type Handler struct {
	userService        user.Service
	roleService        role.Service
	clusterService     cluster.Service
	rolebindingService rolebinding.Service
	ldapService        ldap.Service
	jwtSigner          *jwt.Signer
}
```
### Affected Version
<= v1.6.2

### Patches
The vulnerability has been fixed in [v1.6.3](https://github.com/KubeOperator/KubePi/releases/tag/v1.6.3).

https://github.com/KubeOperator/KubePi/commit/3be58b8df5bc05d2343c30371dd5fcf6a9fbbf8b : JWT key can be specified in app.yml, if leave it blank a random key will be used.

### Workarounds
It is recommended to upgrade the version to [v1.6.3](https://github.com/KubeOperator/KubePi/releases/tag/v1.6.3).

### For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/KubeOperator/KubePi/issues).
Denial of service via header parsing in Rack (GHSA-65f5-mfpf-vfhj)
Aliases: CVE-2022-44570
Published: 2023-01-18T18:19:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '2.0.9.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0.0'}, {'fixed': '2.1.4.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0.0'}, {'fixed': '2.2.6.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0.0'}, {'fixed': '3.0.4.1'}]}]}]

There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570.

Versions Affected: >= 1.5.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.0.1
Impact

Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.0 series
    2-1-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.1 series
    2-2-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.2 series
    3-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 3.0 series
Cross-site Scripting in yapi-vendor (GHSA-4jqw-vfmj-9rmh)
Aliases: CVE-2021-36686
Published: 2023-01-26T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'yapi-vendor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.9.1'}]}]}]

Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-x2h8-4mhh-5hwh)
Aliases: CVE-2023-0313
Published: 2023-01-16T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Denial of Service Vulnerability in Rack Content-Disposition parsing (GHSA-93pm-5p5f-3ghx)
Aliases: CVE-2022-44571
Published: 2023-01-18T18:24:40Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.9.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.4.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.6.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0.0'}, {'fixed': '3.0.4.1'}]}]}]

There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
    2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
    2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
    3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series
Component takeover in Oracle Data Provider for .NET (GHSA-5pm2-9mr2-3frq)
Aliases: CVE-2023-21893
Published: 2023-01-18T00:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Oracle.ManagedDataAccess'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '21.0.0'}, {'fixed': '21.9.0'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Oracle.ManagedDataAccess.Core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.21.0'}, {'fixed': '3.21.90'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Oracle.ManagedDataAccess'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '19.0.0'}, {'fixed': '19.18.0'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Oracle.ManagedDataAccess.Core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.19.0'}, {'fixed': '2.19.180'}]}]}]

Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server.  Supported versions that are affected are 19c and  21c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCPS to compromise Oracle Data Provider for .NET.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Data Provider for .NET. Note: Applies also to Database client-only on Windows platform. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).

See the readme.txt files inside the `.nupkg` packages for a reference to the fix.
CakePHP SecurityComponent cross form submission issue (GHSA-j9q2-f9q7-jhgq)
Published: 2023-01-20T23:22:09Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.4.8'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.3.18'}]}]}]

Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.
Command Injection in Apache Airflow and Apache Airflow MySQL Provider (GHSA-c732-xvv8-g94c)
Aliases: CVE-2023-22884
Published: 2023-01-21T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-mysql'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.
phpMyFAQ has Weak Password Requirements (GHSA-4p88-cfhq-f3vg)
Aliases: CVE-2023-0307
Published: 2023-01-16T00:30:25Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.10