aswin1906/github-advisory-2023 huggingface dataset:
XWiki Platform subject to Uncontrolled Resource Consumption (GHSA-92wp-r7hm-42g7)
Aliases: CVE-2023-26470
Published: 2023-03-03T22:50:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.0-rc-1'}]}]}]

### Impact

It's possible to make the farm unusable by adding an object to a page with a huge number (e.g. 67108863). This will most of the time fill the memory allocated to XWiki and make it unusable every time this document is manipulated.

### Patches
It has been patched in XWiki 14.0

### Workarounds
There is no workaround.

### References
https://jira.xwiki.org/browse/XWIKI-19223

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Use of hard-coded, security-relevant constants in deepset-ai/haystack (GHSA-w7qg-j435-78qw)
Aliases: CVE-2023-1712
Published: 2023-03-30T12:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'farm-haystack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.15.0'}]}]}]

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack in version 1.15.0 and prior. A patch is available at commit 5fc84904f198de661d5b933fde756aa922bf09f1.
matrix-react-sdk Prototype pollution vulnerability (GHSA-2x9c-qwgf-94xr)
Aliases: CVE-2022-36060
Published: 2023-03-28T19:57:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-react-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.53.0'}]}]}]

### Impact
Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered.

### Patches
This is fixed in matrix-react-sdk 3.53.0

### Workarounds
There are no workarounds. Please upgrade immediately.

### References
https://learn.snyk.io/lessons/prototype-pollution/javascript/

### For more information
If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).
Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input (GHSA-q2x3-2f9g-h559)
Aliases: CVE-2023-28333
Published: 2023-03-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).
Denial of service in Jenkins Core (GHSA-h76p-mc68-jv3p)
Aliases: CVE-2023-27901
Published: 2023-03-10T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.388'}, {'fixed': '2.394'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.375.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.376'}, {'fixed': '2.387.1'}]}]}]

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of request parts introduced in version 1.5 for CVE-2023-24998 in org.kohsuke.stapler.RequestImpl, allowing attackers to trigger a denial of service.
Prototype pollution in matrix-js-sdk (part 2) (GHSA-mwq8-fjpf-c2gr)
Aliases: CVE-2023-28427
Published: 2023-03-30T20:19:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-js-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '24.0.0'}]}]}]

### Impact

In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-js-sdk functionality, causing denial of service and potentially affecting program logic.

(This is part 2, where [CVE-2022-36059](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36059) / [GHSA-rfv9-x7hh-xc32](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32) is part 1. Part 2 covers remaining vectors not covered by part 1, found in a codebase audit scheduled after part 1.)

### Patches
The issue has been patched in matrix-js-sdk 24.0.0.

### Workarounds
None.

### References

- [Release blog post](https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0)
- The advisory [GHSA-rfv9-x7hh-xc32](https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-rfv9-x7hh-xc32) ([CVE-2022-36059](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36059)) refers to an initial set of vulnerable locations discovered and patched in matrix-js-sdk 19.4.0. We opted not to disclose that advisory while we performed an audit of the codebase and are now disclosing it jointly with this one.

### For more information
If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).
TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGrad (GHSA-68v3-g9cm-rmm6)
Aliases: CVE-2023-25658
Published: 2023-03-24T21:53:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
Out of bounds read in GRUBlockCellGrad
```python
func = tf.raw_ops.GRUBlockCellGrad

para = {'x': [[21.1, 156.2], [83.3, 115.4]], 'h_prev': array([[136.5],
      [136.6]]), 'w_ru': array([[26.7,  0.8],
      [47.9, 26.1],
      [26.2, 26.3]]), 'w_c': array([[ 0.4],
      [31.5],
      [ 0.6]]), 'b_ru': array([0.1, 0.2 ], dtype=float32), 'b_c': 0x41414141, 'r': array([[0.3],
      [0.4]], dtype=float32), 'u': array([[5.7],
      [5.8]]), 'c': array([[52.9],
      [53.1]]), 'd_h': array([[172.2],
      [188.3 ]])}
```

### Patches
We have patched the issue in GitHub commit [ff459137c2716a2a60f7d441b855fcb466d778cb](https://github.com/tensorflow/tensorflow/commit/ff459137c2716a2a60f7d441b855fcb466d778cb).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx.
Maligned causes incorrect deallocation (GHSA-wm8x-php5-hvq6)
Published: 2023-03-07T20:13:19Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'maligned'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.2.1'}]}]}]

`maligned::align_first` manually allocates with an alignment larger than T, and then uses `Vec::from_raw_parts` on that allocation to get a `Vec<T>`.

[`GlobalAlloc::dealloc`](https://doc.rust-lang.org/std/alloc/trait.GlobalAlloc.html#tymethod.dealloc) requires that the `layout` argument must be the same layout that was used to allocate that block of memory.

When deallocating, `Box` and `Vec` may not respect the specified alignment and can cause undefined behavior.
`openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read (GHSA-9qwg-crg9-m2vc)
Published: 2023-03-24T22:01:29Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.7'}, {'fixed': '0.10.48'}]}]}]

`SubjectAlternativeName` and `ExtendedKeyUsage` arguments were parsed using the OpenSSL function `X509V3_EXT_nconf`. This function parses all input using an OpenSSL mini-language which can perform arbitrary file reads.

Thanks to David Benjamin (Google) for reporting this issue.
Keycloak vulnerable to user impersonation via stolen UUID code (GHSA-9g98-5mj6-f9mv)
Aliases: CVE-2023-0264
Published: 2023-03-02T23:25:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '21.0.1'}]}]}]

Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.
Ruby Time component ReDoS issue (GHSA-fg7x-g82r-94qc)
Aliases: CVE-2023-28756
Published: 2023-03-31T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'time'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'fixed': '0.2.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'time'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.1'}]}]}]

A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. The fixed versions are 0.1.1 and 0.2.2.
Go-huge-util vulnerable to path traversal when unzipping files (GHSA-5g39-ppwg-6xx8)
Aliases: CVE-2023-28105
Published: 2023-03-16T18:32:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/dablelv/go-huge-util/zip'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.34'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/dablelv/go-huge-util'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.34'}]}]}]

Impact
ZipSlip issue when use fsutil package to unzip files.
When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.

Patches
It has been fixed in v0.0.34, Please upgrade version to v0.0.34 or above.

Workarounds
No, users have to upgrade version.

References
Mattermost vulnerable to cross-site scripting (XSS) (GHSA-63f2-6959-2pxj)
Aliases: CVE-2023-1776
Published: 2023-03-31T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.7.2'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.7.0'}, {'fixed': '7.7.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.7.1'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.1.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.1.5'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.8.0'}, {'fixed': '7.8.1'}]}], 'versions': ['7.8.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.39.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.3.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.10.10'}}]

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. 

[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00139
Cross-site Scripting (XSS) in UrlSlug Data type (GHSA-x5j3-mq9g-8jc8)
Aliases: CVE-2023-28106
Published: 2023-03-17T14:43:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
An attacker can use XSS to send a malicious script to an unsuspecting user.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14669.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14669.patch manually.

### References
https://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a
Nomad Job Submitter Privilege Escalation Using Workload Identity (GHSA-rqm8-q8j9-662f)
Aliases: CVE-2023-1299
Published: 2023-03-14T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/nomad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.5.1'}]}], 'versions': ['1.5.0']}]

### Summary
A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a user with the submit-job ACL capability can submit a job that can escalate to management-level privileges. This vulnerability, CVE-2023-1299, was introduced in Nomad 1.5.0 and fixed in Nomad 1.5.1.

### Background
Nomad 1.4.0 introduced the concept of workload identity so that tasks can access variables without needing to access them through Nomad HTTP API with an ACL token.

In 1.5.0, the identity block was introduced, which exposes the workload identity token to the workload so it can access Nomad HTTP API via a unix domain socket without configuring mTLS.

### Details
During internal testing, we discovered it was possible to abuse the workload identity to elevate to management-level privilege if the workload identity did not have any attached ACL policies.

### Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to Nomad 1.5.1 or newer. See Nomad’s Upgrading for general guidance on this process.
Duplicate Advisory: pimcore is vulnerable to cross-site scripting in translate module (GHSA-rp78-4562-gx3c)
Published: 2023-03-29T18:30:30Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-hfmg-g39c-5444](https://github.com/advisories/GHSA-hfmg-g39c-5444). This link is maintained ot preserve external references.

## Original Description
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
Moodle has Incorrect Default Permissions (GHSA-2wmj-8mqg-r9q8)
Aliases: CVE-2021-36397
Published: 2023-03-07T00:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, insufficient capability checks meant message deletions were not limited to the current user.
Grafana vulnerable to Cross-site Scripting (GHSA-hjv9-hm2f-rpcj)
Aliases: CVE-2023-0507
Published: 2023-03-01T18:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.5.21'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.2.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.8'}]}]}]

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.
pgAdmin 4 vulnerable to directory traversal  (GHSA-9crj-hpxh-f6qg)
Aliases: CVE-2023-0241
Published: 2023-03-27T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pgadmin4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.19'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.18'}}]

pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
Imperative CLI vulnerable to Command Injection (GHSA-6q8m-42qq-64r7)
Aliases: CVE-2021-4326
Published: 2023-03-01T09:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@zowe/imperative'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.7.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@zowe/imperative'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.18.10'}]}]}]

A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.
Apache UIMA DUCC allows remote code execution  (GHSA-34m5-796p-mjcp)
Aliases: CVE-2023-28935
Published: 2023-03-30T12:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.uima:uima-ducc-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.0.0'}]}]}]

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache UIMA DUCC. When using the "Distributed UIMA Cluster Computing" (DUCC) module of Apache UIMA, an authenticated user that has the permissions to modify core entities can cause command execution as the system user that runs the web process. As the "Distributed UIMA Cluster Computing" module for UIMA is retired, we do not plan to release a fix for this issue. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Keycloak vulnerable to Cross-site Scripting (GHSA-w354-2f3c-qvg9)
Aliases: CVE-2022-1438
Published: 2023-03-01T16:18:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '21.0.0'}]}]}]

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.

## Details

This issue is the result of code found in the exception here: [https://github.com/keycloak/keycloak/blob/48835576daa158443f69917ac309e1a7c951bc87/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1045](https://github.com/keycloak/keycloak/blob/48835576daa158443f69917ac309e1a7c951bc87/services/src/main/java/org/keycloak/authentication/AuthenticationProcessor.java#L1045)

## Steps to reproduce

When using the legacy admin console:

1. Sign in as Admin user in first tab.
2. In that tab create new user in keycloak admin section > intercept user creation request and modify it by including malicious js script there (in username field).
3. Sign in as newly created user in second tab (same browser window but second tab).
4. Navigate back to first tab where you are signed in as admin, navigate to admin console which lists all application users.
5. Choose any user (except newly created malicious one) – modify anything for that user in his settings. E.g. navigate to credentials tab and set new credentials for him. Also set new password as temporary.
6. After update for that user is made, use impersonate option on that modified user.
7. You should see window with form which requires providing new credentials – fill it and submit request.
8. Just after submiting request user will get notified that “You are already authenticated as different user ‘[user + payload]’ in this session. Please sign out first.”  And malicious payload will be executed instantly.
HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks (GHSA-vq4h-9ghm-qmrr)
Aliases: CVE-2023-25000
Published: 2023-03-30T03:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.9'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.1'}]}]}]

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Unprivileged XWiki Platform users can make arbitrary select queries using DatabaseListProperty and suggest.vm (GHSA-vpx4-7rfp-h545)
Aliases: CVE-2023-26473
Published: 2023-03-03T22:46:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3-rc-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact

Any user with edit right can execute arbitrary database select and access data stored in the database.

To reproduce:
 * In admin, rights, remove scripting rights for {{XWikiAllGroup}}.
 * Create a new user without any special privileges.
 * Create a page "Private.WebHome" with {{TOKEN_42}} as content. Go to "page administration" and explicitly set all rights for "Admin" to remove them for all other users.
 * Logout and login as the unprivileged user. Ensure that the previously created page cannot be viewed.
 * Create a new page "ExploitClass.WebHome" and then open it in the class editor (first, make the user an advanced user).
 * Add a field named {{ContentList}} of type {{Database List}}
 * Enter in field "Hibernate Query" the following content: {noformat}select doc.content, doc.fullName from XWikiDocument as doc where doc.fullName = 'Private.WebHome'{noformat}
 * Save the class.
 * Open [http://localhost:8080/xwiki/bin/view/ExploitClass/?xpage=suggest&classname=ExploitClass.WebHome&fieldname=ContentList&firCol=doc.fullName&secCol=-]

### Patches

The problem has been patched on XWiki 13.10.11, 14.4.7, and 14.10.

### Workarounds

There is no workaround for this vulnerability other than upgrading.

### References

https://jira.xwiki.org/browse/XWIKI-19523

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field (GHSA-rcg9-hrhx-6q69)
Aliases: CVE-2023-28429
Published: 2023-03-20T17:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
Unsecured tooltip field in DataObject class definition.

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14574.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14574.patch manually.

### References
xwiki contains Exposed Dangerous Method or Function (GHSA-8692-g6g9-gm5p)
Aliases: CVE-2023-26478
Published: 2023-03-03T22:52:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-store-filesystem-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.3-rc-1'}, {'fixed': '14.4.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-store-filesystem-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.9-rc-1'}]}]}]

### Impact
`org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` is returning an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed to users without the `programing` right.
`com.xpn.xwiki.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operations.

### Patches
This has been patched in the version 14.9-rc-1 and 14.4.6.

### Workarounds
There's no workaround for this issue.

### References
https://jira.xwiki.org/browse/XWIKI-20180

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [JIRA](https://jira.xwiki.org/)
* Email us at [security ML](mailto:security@xwiki.org)
Answer vulnerable to Cross-site Scripting (GHSA-8jh8-33f5-cgfp)
Aliases: CVE-2023-1243
Published: 2023-03-07T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Incorrect Permission Preservation in Jenkins Core (GHSA-cj6r-8pxj-5jv6)
Aliases: CVE-2023-27902
Published: 2023-03-10T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.376'}, {'fixed': '2.387.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.375.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.388'}, {'fixed': '2.394'}]}]}]

Jenkins uses temporary directories adjacent to workspace directories, usually with the @tmp name suffix, to store temporary files related to the build. In pipelines, these temporary directories are adjacent to the current working directory when operating in a subdirectory of the automatically allocated workspace. Jenkins-controlled processes, like SCMs, may store credentials in these directories.

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 shows these temporary directories when viewing job workspaces, which allows attackers with Item/Workspace permission to access their contents.

Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 does not list these temporary directories in job workspaces.

As a workaround, do not grant Item/Workspace permission to users who lack Item/Configure permission, if you’re concerned about this issue but unable to immediately update Jenkins.
Cross-site Scripting (XSS) in Document Types (GHSA-3223-w774-99fq)
Aliases: CVE-2023-1429
Published: 2023-03-16T18:34:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
Unsecured Name field in Document Types module in Settings.

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14645.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14645.patch manually.

### References
https://huntr.dev/bounties/e0829fea-e458-47b8-84a3-a74476d9638f/
Buildkit credentials inlined to Git URLs could end up in provenance attestation (GHSA-gc89-7gcr-jxqc)
Aliases: CVE-2023-26054
Published: 2023-03-07T20:09:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/moby/buildkit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.10.0'}, {'fixed': '0.11.4'}]}]}]

When the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation.

Git URL can be passed in two ways:

1) Invoking build directly from a URL with credentials.

```
buildctl build --frontend dockerfile.v0 --context https://<credentials>@url/repo.git
```

Equivalent in `docker buildx` would be

```
docker buildx build https://<credentials>@url/repo.git
```

2) If the client sends additional VCS info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. 

Thanks to Oscar Alberto Tovar for discovering the issue.

### Impact
When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation.

Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable.

In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable.

Note: [Docker Build-push Github action](https://github.com/docker/build-push-action) builds from Git URLs by default but **is not** affected by this issue even when working with private repositories because the credentials are passed [with build secrets](https://github.com/docker/build-push-action/blob/v4.0.0/src/context.ts#L203) and not with URLs.

### Patches
Bug is fixed in v0.11.4 . 

### Workarounds
It is recommended to pass credentials with build secrets when building directly from Git URL as a more secure alternative than modifying the URL.

In Docker Buildx, VCS info hint can be disabled by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.


### References
- Inline credentials in URLs deprecated in RFC3986 https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1
Access control issue in ezsystems/ezpublish-kernel (GHSA-h5v2-wrhp-5v35)
Aliases: CVE-2022-48367
Published: 2023-03-12T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezpublish-kernel'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.5.0'}, {'fixed': '7.5.28'}]}]}]

Access control based on object state is mishandled. This is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Answer has Observable Response Discrepancy (GHSA-6x5v-cxpp-pc5x)
Aliases: CVE-2023-1540
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation (GHSA-gw97-ff7c-9v96)
Aliases: CVE-2023-25668
Published: 2023-03-24T21:57:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or RCE.
When axis is larger than the dim of input, c->Dim(input,axis) goes out of bound.
Same problem occurs in the QuantizeAndDequantizeV2/V3/V4/V4Grad operations too.
```python
import tensorflow as tf
@tf.function
def test():
    tf.raw_ops.QuantizeAndDequantizeV2(input=[2.5],
    								   input_min=[1.0],
    								   input_max=[10.0],
    								   signed_input=True,
    								   num_bits=1,
    								   range_given=True,
    								   round_mode='HALF_TO_EVEN',
    								   narrow_range=True,
    								   axis=0x7fffffff)
test()
```



### Patches
We have patched the issue in GitHub commit [7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb](https://github.com/tensorflow/tensorflow/commit/7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
OpenStack Glance Inclusion of Functionality from Untrusted Control Sphere vulnerability (GHSA-5gp5-vxj6-4257)
Aliases: CVE-2022-4134
Published: 2023-03-07T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'glance'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '25.1.0'}]}]}]

A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images.
Moodle vulnerable to Cross-site Request Forgery (GHSA-wxmq-v9gx-75pg)
Aliases: CVE-2023-28335
Published: 2023-03-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}]

The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.
Insufficient Session Expiration in pretix (GHSA-r76w-3wwq-jv6v)
Aliases: CVE-2023-27891
Published: 2023-03-07T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pretix'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.17.0'}, {'fixed': '4.17.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'pretix'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.16.0'}, {'fixed': '4.16.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'pretix'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.15.1'}]}]}]

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
Answer vulnerable to Business Logic Errors (GHSA-r95w-7cpx-h5mx)
Aliases: CVE-2023-1542
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails (GHSA-vpqv-mqvc-pcx2)
Aliases: CVE-2014-4920
Published: 2023-03-16T18:35:11Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'twitter-bootstrap-rails'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.0'}]}]}]

The twitter-bootstrap-rails Gem for Rails contains a flaw that enables a
reflected cross-site scripting (XSS) attack. This flaw exists because the
bootstrap_flash helper method does not validate input when handling flash
messages before returning it to users. This may allow a context-dependent
attacker to create a specially crafted request that would execute arbitrary
script code in a user's browser session within the trust relationship between
their browser and the server.
TensorFlow has Null Pointer Error in TensorArrayConcatV2 (GHSA-64jg-wjww-7c5w)
Aliases: CVE-2023-25663
Published: 2023-03-24T21:58:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
When ctx->step_containter() is a null ptr, the Lookup function will be executed with a null pointer.
```python
import tensorflow as tf
tf.raw_ops.TensorArrayConcatV2(handle=['a', 'b'], flow_in = 0.1, dtype=tf.int32, element_shape_except0=1)
```

### Patches
We have patched the issue in GitHub commit [239139d2ae6a81ae9ba499ad78b56d9b2931538a](https://github.com/tensorflow/tensorflow/commit/239139d2ae6a81ae9ba499ad78b56d9b2931538a).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Yu Tian
fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime (GHSA-vfvj-3m3g-m532)
Aliases: CVE-2023-27483
Published: 2023-03-13T20:53:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane-runtime'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.17.0'}, {'fixed': '0.19.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane-runtime'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.6.0'}, {'fixed': '0.16.1'}]}]}]

### Summary

Fuzz testing on `crossplane/crossplane`, by Ada Logics and sponsored by the CNCF, identified input to a function in the `fieldpath` package that can cause an out of memory panic. Applications that use the `Paved` type's `SetValue` method with user provided input without proper validation might use excessive amounts of memory and cause an out of memory panic.

### Details

In the `fieldpath` package, the `SetValue` method of the `Paved` type sets a value on the inner object according to the provided path, without validating it first. This allows setting values in slices at any specific index and the code will grow the target array up to the required size. The index is currently capped at max uint32 (4294967295) given how indexes are parsed,  but that is still an unnecessarily large value.

### Workaround

Users can parse and validate the path before passing it to the `SetValue` method of the `Paved` type, constraining the index size as deemed appropriate.

### Credits

Disclosed by Ada Logics in a fuzzing audit sponsored by CNCF.
zstd vulnerable to buffer overrun (GHSA-5c9c-6x87-f9vm)
Aliases: CVE-2022-4899
Published: 2023-03-31T21:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/facebook/zstd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.4'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'zstd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.4.0'}]}]}]

A vulnerability was found in zstd v1.4.10, where an attacker can supply an empty string as an argument to the command line tool to cause buffer overrun.
phpMyFAQ has weak password requirements (GHSA-4p4m-5qp7-479x)
Aliases: CVE-2023-1753
Published: 2023-03-31T03:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Weak password requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Hippo4j allows attacker to obtain sensitive info via ConfigVerifyController function of Tenant Management module (GHSA-h855-6hph-v363)
Aliases: CVE-2023-27096
Published: 2023-03-27T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hippo4j:hippo4j-all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.3'}]}]}]

Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyController function of the Tenant Management module.
Moodle Cross-site Scripting vulnerability (GHSA-79jp-m64f-pgrc)
Aliases: CVE-2021-36399
Published: 2023-03-07T00:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.
rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters (GHSA-32gr-4cq6-5w5q)
Aliases: CVE-2023-26491
Published: 2023-03-01T18:02:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'rsshub'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-master.c910c4d'}]}]}]

### Impact

When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.

Users who access the deliberately constructed URL are affected.

### Patches

This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version.

### Workarounds

No.