aswin1906/github-advisory-2023 huggingface dataset:
Gogs OS Command Injection vulnerability (GHSA-pfvh-p8qp-9ww9)
Aliases: CVE-2022-2024
Published: 2023-02-28T20:12:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'gogs.io/gogs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.11'}]}]}]

### Impact

The malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected.

### Patches

Make sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.

### Workarounds

Disable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129).

### References

https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.
Sequelize - Default support for “raw attributes” when using parentheses (GHSA-f598-mfpv-gmfx)
Aliases: CVE-2023-22578
Published: 2023-02-24T18:48:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@sequelize/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.0-alpha.20'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'sequelize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.29.0'}]}]}]

### Impact

Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL

```ts
User.findAll({
  attributes: [
    ['count(id)', 'count']
  ]
});
```

Produced

```sql
SELECT count(id) AS "count" FROM "users"
```

### Patches

This feature was deprecated in Sequelize 5, and using it prints a deprecation warning.

This issue has been patched in [`@sequelize/core@7.0.0.alpha-20`](https://github.com/sequelize/sequelize/pull/15374) and [`sequelize@6.29.0`](https://github.com/sequelize/sequelize/pull/15710). 

In Sequelize 7, it now produces the following:

```sql
SELECT "count(id)" AS "count" FROM "users"
```

In Sequelize 6, it throws an error explaining that we had to introduce a breaking change, and requires the user to explicitly opt-in to either the Sequelize 7 behavior (always escape) or the Sequelize 5 behavior (inline attributes that include `()` without escaping). See https://github.com/sequelize/sequelize/pull/15710 for more information.

### Mitigations

Do not use user-provided content to build your list or attributes. If you do, make sure that attribute in question actually exists on your model by checking that it exists in the `rawAttributes` property of your model first.

---

A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15694
CVE: CVE-2023-22578
Privilege escalation in MOSN (GHSA-5vx9-j5cw-47vq)
Aliases: CVE-2021-32163
Published: 2023-02-17T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'mosn.io/mosn'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.23.0'}]}]}]

Authentication vulnerability in MOSN before v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
Cross-Site Request Forgery (CSRF) in wallabag/wallabag (GHSA-2qxp-xmx6-cq4f)
Aliases: CVE-2023-0735
Published: 2023-02-08T00:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.4'}]}]}]

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4.
Moodle Cross-site Scripting vulnerability (GHSA-97qf-pq7x-964m)
Aliases: CVE-2023-23921
Published: 2023-02-17T21:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.19'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0'}, {'fixed': '3.11.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-beta'}, {'fixed': '4.0.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0-beta'}, {'fixed': '4.1.1'}]}]}]

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in some returnurl parameters. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
High resource usage when parsing multipart form data with many fields (GHSA-xg9f-g7g7-2323)
Aliases: CVE-2023-25577
Published: 2023-02-15T15:36:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Werkzeug'}, 'ecosystem_specific': {'affected_functions': ['werkzeug.Request.from_values']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.3'}]}]}]

Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage.

This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers.
Cross-site Scripting in Jenkins Pipeline: Build Step Plugin (GHSA-9j65-3f2q-8q2r)
Aliases: CVE-2023-25762
Published: 2023-02-15T15:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:pipeline-build-step'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.18'}]}]}]

Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names.
Kubernetes client-go vulnerable to Sensitive Information Leak via Log File (GHSA-8cfg-vx93-jvxw)
Aliases: CVE-2020-8565
Published: 2023-02-06T23:27:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'k8s.io/client-go'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.19.0'}, {'fixed': '0.19.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/client-go'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.20.0-alpha.0'}, {'fixed': '0.20.0-alpha.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/client-go'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.18.0'}, {'fixed': '0.18.14'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/client-go'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.16'}]}]}]

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.5, <= v1.18.13, <= v1.17.15, < v1.20.0-alpha2.
Pimcore vulnerable to Cross-site Scripting (GHSA-f2jh-mf2c-8278)
Aliases: CVE-2023-1067
Published: 2023-02-27T15:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '10.5.17'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore 10.5.17 and prior. A patch is available and anticipated to be part of 10.5.18.
Cross site scripting Vulnerability in backstage Software Catalog (GHSA-7hv8-3fr9-j2hv)
Aliases: CVE-2023-25571
Published: 2023-02-14T21:35:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@backstage/core-components'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.4'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@backstage/catalog-model'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@backstage/plugin-catalog-backend'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.2'}]}]}]

### Impact

This vulnerability allows a malicious actor with access to add or modify content in an instance of the Backstage software catalog to inject script URLs in the entities stored in the catalog. If users of the catalog then click on said URLs, that can lead to an XSS attack.

### Patches

This vulnerability has been patched in both the frontend and backend implementations. The default `Link` component from `@backstage/core-components` will now reject `javascript:` URLs, and there is a global override of `window.open` to do the same.

In addition the catalog model as well as the catalog backend now has additional validation built in that prevents `javascript:` URLs in known annotations.

### Workarounds

The general practice of limiting access to modifying catalog content and requiring code reviews greatly helps mitigate this vulnerability.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in the [Backstage README](https://github.com/backstage/backstage)
api-platform/core's secured properties may be accessible within collections (GHSA-vr2x-7687-h6qv)
Aliases: CVE-2023-25575
Published: 2023-02-28T23:25:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'api-platform/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'api-platform/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.1.3'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'api-platform/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.7.10'}]}]}]

### Impact

Resource properties secured with the `security` option of the `ApiPlatform\Metadata\ApiProperty` attribute can be disclosed to unauthorized users. The problem affects most serialization formats, including raw JSON, which is enabled by default when installing API Platform. Custom serialization formats may also be impacted. Only collection endpoints are affected by the issue, item endpoints are not. The JSON-LD format is not affected by the issue.

The result of the security rule is only executed for the first item of the collection. The result of the rule is then cached and reused for the next items. This bug can leak data to unauthorized users when the rule depends on the value of a property of the item. This bug can also hide properties that should be displayed to authorized users.

### Patches

This issue impacts the 2.7, 3.0 and 3.1 branches. Upgrade to v2.7.10, v3.0.12 or v3.1.3.

### Workarounds

Replace the `cache_key` of the context array of the Serializer inside a custom normalizer that works on objects if the security option of the `ApiPlatform\Metadata\ApiProperty` attribute is used.
GoPistolet vulnerable to Improper Resource Shutdown or Release (GHSA-wr8h-w969-36m8)
Aliases: CVE-2015-10085
Published: 2023-02-21T18:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gopistolet/gopistolet'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20210418093520-a5395f728f8d'}]}]}]

A vulnerability was found in GoPistolet. It has been declared as problematic. This vulnerability affects unknown code of the component MTA. The manipulation leads to denial of service. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The name of the patch is b91aa4674d460993765884e8463c70e6d886bc90. It is recommended to apply a patch to fix this issue. VDB-221506 is the identifier assigned to this vulnerability.
TeamPass External Control of File Name or Path vulnerability (GHSA-x36g-4629-xp9v)
Aliases: CVE-2023-1070
Published: 2023-02-27T18:32:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0.23'}]}]}]

External Control of File Name or Path in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
Cross-site Scripting in DaSchTour matomo-mediawiki-extension (GHSA-hc67-v29c-7g78)
Aliases: CVE-2017-20175
Published: 2023-02-05T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'mediawiki/matomo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.3'}]}]}]

A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2. This affects an unknown part of the file Piwik.hooks.php of the component Username Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.4.3 is able to address this issue. The name of the patch is 681324e4f518a8af4bd1f93867074c728eb9923d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220203.
Denial of service vulnerability on Password reset page (GHSA-7j9h-3jxf-3vrf)
Aliases: CVE-2023-25171
Published: 2023-02-15T18:10:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.0'}]}]}]

### Impact
Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. 

### Patches
Users should upgrade to v12.0 or later.

### Workarounds
Users may install and configure a rate-limiting proxy in front of Kiwi TCMS such as Nginx and/or configure rate limits on their email server when possible.

### References
[Disclosed by Ahmed Rabeaa Mosaa](https://huntr.dev/bounties/3b712cb6-3fa3-4f71-8562-7a7016c6262e)
Insecure Permissions issue in jeecg-boot (GHSA-fqp6-fw9g-xpxp)
Aliases: CVE-2021-37306
Published: 2023-02-03T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4.5'}]}]}]

An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: api uri:/sys/user/checkOnlyUser?username=admin.
LiteDB may deserialize bad JSON on object type using _type (GHSA-3x49-g6rc-c284)
Aliases: CVE-2022-23535
Published: 2023-02-24T16:22:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'LiteDB'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.0.13'}]}]}]

### Impact
LiteDB use a special field in JSON documents to cast diferent types from `BsonDocument` do POCO classes. When instance of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit in your model.
If your end-user can send to your app a plain JSON string, deserialization can load an unsafe  object to fit in your model.

### Patches
Version >= 5.0.13 add some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type
Next major version will contains a allow-list to select what king of Assembly can be loaded

### Workarounds
- Avoid users send to your app a JSON string to be direct insert/update into database
- Avoid use classes with `Object` type - try use an interface when possible

If your app send a plain JSON string to be insert/update into database, prefer this:
```
// Bad
public class Customer {
    public int Id { get; set; }
    public string Name { get; set; }
    public Object AnyData { get; set; } // <= Avoid use `Object` base type
}

// Good
public class Customer {
    public int Id { get; set; }
    public string Name { get; set; }
    public IDictionary<string, string> AnyData { get; set; } // Will accept only key/value strings
}

```

### References
See this workaround fix on this commit:

https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf (GHSA-w7pp-m8wf-vj6r)
Aliases: CVE-2023-23931
Published: 2023-02-07T20:54:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'cryptography'}, 'ecosystem_specific': {'affected_functions': ['cryptography.hazmat.primitives.ciphers.Cipher']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '39.0.1'}]}]}]

Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers:

```pycon
>>> outbuf = b"\x00" * 32
>>> c = ciphers.Cipher(AES(b"\x00" * 32), modes.ECB()).encryptor()
>>> c.update_into(b"\x00" * 16, outbuf)
16
>>> outbuf
b'\xdc\x95\xc0x\xa2@\x89\x89\xadH\xa2\x14\x92\x84 \x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
```

This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python. This is a soundness bug -- it allows programmers to misuse an API, it cannot be exploited by attacker controlled data alone.

This now correctly raises an exception.

This issue has been present since `update_into` was originally introduced in cryptography 1.8.
IPFS go-bitfield vulnerable to DoS via malformed size arguments (GHSA-2h6c-j3gf-xp9r)
Aliases: CVE-2023-23626
Published: 2023-02-10T19:52:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ipfs/go-bitfield'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

### Impact
When feeding untrusted user input into the size parameter of `NewBitfield` and `FromBytes` functions, an attacker can trigger `panic`s.

This happen when the `size` is a not a multiple of `8` or is negative.
There were already a note in the `NewBitfield` documentation:
> ```
> Panics if size is not a multiple of 8.
> ````

But it incomplete and missing from `FromBytes`'s documentation.

This has been replaced by returning an `(Bitfield, error)` and returning a non nil error if the size is wrong.

### Patches
- https://github.com/ipfs/go-bitfield/commit/5e1d256fe043fc4163343ccca83862c69c52e579

### Workarounds
- Ensure `size%8 == 0 && size >= 0` yourself before calling `NewBitfield` or `FromBytes`

### References
- https://github.com/ipfs/go-unixfs/security/advisories/GHSA-q264-w97q-q778
Missing Authorization in Jenkins Azure Credentials Plugin (GHSA-px2r-cmr2-phw7)
Aliases: CVE-2023-25768
Published: 2023-02-15T15:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-credentials'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '253.v887e0f9e898b'}]}]}]

A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.
Regular Expression Denial of Service in simple-markdown (GHSA-gpvj-gp8c-c7p2)
Aliases: CVE-2019-25103
Published: 2023-02-12T15:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'simple-markdown'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.2'}]}]}]

A vulnerability has been found in simple-markdown 0.5.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file simple-markdown.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. Upgrading to version 0.5.2 is able to address this issue. The name of the patch is 89797fef9abb4cab2fb76a335968266a92588816. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220639.
Apache Kerby LdapIdentityBackend LDAP Injection vulnerability (GHSA-337f-xr2x-6fcf)
Aliases: CVE-2023-25613
Published: 2023-02-20T18:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.kerby:ldap-backend'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.3'}]}]}]

An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3.
Update share links to use FRP instead of SSH tunneling (GHSA-3x5j-9vwr-8rr5)
Aliases: CVE-2023-25823
Published: 2023-02-23T22:10:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'gradio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.13.1'}]}]}]

### Impact
This is a vulnerability which affects anyone using Gradio's share links (i.e. creating a Gradio app and then setting `share=True`) with Gradio versions older than 3.13.1. In these older versions of Gradio, a private SSH key is sent to any user that connects to the Gradio machine, which means that a user could access other users' shared Gradio demos. From there, other exploits are possible depending on the level of access/exposure the Gradio app provides. 

### Patches
The problem has been patched. Ideally, users should upgrade to `gradio==3.19.1` or later where the FRP solution has been properly tested. 

### Credit
Credit to Greg Sadetsky and Samuel Tremblay-Cossette for alerting the team
Sequelize vulnerable to SQL Injection via replacements (GHSA-wrh9-cjv3-2hpw)
Aliases: CVE-2023-25813
Published: 2023-02-22T22:59:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'sequelize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.19.1'}]}]}]

### Impact

The SQL injection exploit is related to replacements. Here is such an example: 

In the following query, some parameters are passed through replacements, and some are passed directly through the `where` option.

```typescript
User.findAll({
  where: or(
    literal('soundex("firstName") = soundex(:firstName)'),
    { lastName: lastName },
  ),
  replacements: { firstName },
})
```

This is a very legitimate use case, but this query was vulnerable to SQL injection due to how Sequelize processed the query: Sequelize built a first query using the `where` option, then passed it over to `sequelize.query` which parsed the resulting SQL to inject all `:replacements`.

If the user passed values such as

```json
{
  "firstName": "OR true; DROP TABLE users;",
  "lastName": ":firstName"
}
```

Sequelize would first generate this query:

```sql
SELECT * FROM users WHERE soundex("firstName") = soundex(:firstName) OR "lastName" = ':firstName'
```

Then would inject replacements in it, which resulted in this:

```sql
SELECT * FROM users WHERE soundex("firstName") = soundex('OR true; DROP TABLE users;') OR "lastName" = ''OR true; DROP TABLE users;''
```

As you can see this resulted in arbitrary user-provided SQL being executed.

### Patches

The issue was fixed in Sequelize 6.19.1

### Workarounds

Do not use the `replacements` and the `where` option in the same query if you are not using Sequelize >= 6.19.1 

### References

See this thread for more information: https://github.com/sequelize/sequelize/issues/14519

Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-2932027
notation-go has excessive memory allocation on verification (GHSA-87x9-7grx-m28v)
Aliases: CVE-2023-25656
Published: 2023-02-22T00:03:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/notaryproject/notation-go'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-rc.3'}]}]}]

### Impact

`notation-go` users will find their application using excessive memory when verifying signatures and the application will be finally killed, and thus availability is impacted.

### Patches

The problem has been patched in the release [v1.0.0-rc.3](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.3). Users should upgrade their `notation-go` packages to `v1.0.0-rc.3` or above.

### Workarounds

Users can review their own trust policy file and check if the identity string contains `=#`. Meanwhile, users should only put trusted certificates in their trust stores referenced by their own trust policy files, and make sure the `authenticity` validation is set to `enforce`

### Credits

The `notation-go` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing this issue during a security fuzzing audit sponsored by CNCF and Shiwei Zhang (@shizhMSFT) for root cause analysis and detailed vulnerability report.

### References

- [Resource exhaustion attacks](https://en.wikipedia.org/wiki/Resource_exhaustion_attack)
Helm vulnerable to information disclosure via getHostByName Function  (GHSA-pwcw-6f5g-gxf8)
Aliases: CVE-2023-25165
Published: 2023-02-08T22:36:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'helm.sh/helm/v3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.11.1'}]}]}]

A Helm contributor discovered an information disclosure vulnerability using the `getHostByName` template function.

### Impact

`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart.

Information passed into the chart can be disclosed to the DNS servers used to lookup the IP address. For example, a malicious chart could inject `getHostByName` into a chart in order to disclose values to a malicious DNS server.

### Patches

The issue has been fixed in Helm 3.11.1.

### Workarounds

Prior to using a chart with Helm verify the `getHostByName` function is not being used in a template to disclose any information you do not want passed to DNS servers.

### For more information

Helm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.

### Credits

Disclosed by Philipp Stehle at SAP.
generator-hottowel Cross-site Scripting vulnerability (GHSA-f8hv-rx9p-f9r4)
Aliases: CVE-2016-15025
Published: 2023-02-20T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'generator-hottowel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0'}]}]}]

A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/_app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is c17092fd4103143a9ddab93c8983ace8bf174396. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221484.
Cross-site Scripting in Jenkins Email Extension Plugin (GHSA-h97r-fchm-m23x)
Aliases: CVE-2023-25763
Published: 2023-02-15T15:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:email-ext'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.93'}]}]}]

Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control affected fields.
tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function (GHSA-84mm-prjg-49xm)
Aliases: CVE-2015-10073
Published: 2023-02-06T21:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'tinymighty/wiki-seo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.2'}]}]}]

A vulnerability was found in tinymighty WikiSEO 1.2.1. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The name of the patch is 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
MantisBT may expose private issues' summaries to unauthorized users (GHSA-hf4x-6h87-hm79)
Aliases: CVE-2023-22476
Published: 2023-02-23T19:39:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'mantisbt/mantisbt'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.25.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.25.5'}}]

### Impact
Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*.

### Patches
Patch is under development. The vulnerability will be fixed in MantisBT version 2.25.6. 

### Workarounds
None

### Credits
Thanks to [d3vpoo1](https://github.com/jrckmcsb) for reporting the issue.

### References
- https://mantisbt.org/bugs/view.php?id=31086
Apollo has potential access control security issue in eureka (GHSA-368x-wmmg-hq5c)
Aliases: CVE-2023-25570
Published: 2023-02-22T21:58:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.ctrip.framework.apollo:apollo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

### Impact
If users expose the apollo-configservice to the internet (which is not recommended), there are potential security issues since there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice .

### Patches
Login authentication for eureka was added in https://github.com/apolloconfig/apollo/pull/4663 and was released in [v2.1.0](https://github.com/apolloconfig/apollo/releases/tag/v2.1.0).

### Workarounds
To fix the potential issue without upgrading, simply follow the advice that does not expose apollo-configservice to the internet.

### References
[Apollo Security Guidence](https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)
* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)
Django contains Uncontrolled Resource Consumption via cached header (GHSA-q2jf-h9jm-m7p4)
Aliases: CVE-2023-23969
Published: 2023-02-01T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2a1'}, {'fixed': '3.2.17'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0a1'}, {'fixed': '4.0.9'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1a1'}, {'fixed': '4.1.6'}]}]}]

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
Misinterpretation of Input in thorsten/phpmyfaq (GHSA-f9c6-4j9h-6c5r)
Aliases: CVE-2023-0880
Published: 2023-02-17T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
Denial of Service vulnerability in lite-web-server (GHSA-8237-3q5g-99fv)
Aliases: CVE-2023-26104
Published: 2023-02-25T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'lite-web-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.2'}]}]}]

All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.
openssl-src contains Read Buffer Overflow in X.509 Name Constraint (GHSA-w67w-mw4j-8qrv)
Aliases: CVE-2022-4203
Published: 2023-02-08T22:27:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path to a trusted issuer.

The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext) although we are not aware of any working exploit leading to memory contents disclosure as of the time of release of this advisory.

In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects.
`tokio::io::ReadHalf<T>::unsplit` is Unsound (GHSA-4q83-7cq4-p6wg)
Published: 2023-02-04T00:30:37Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'tokio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.21.0'}, {'fixed': '1.24.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'tokio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.19.0'}, {'fixed': '1.20.4'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'tokio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'fixed': '1.18.5'}]}]}]

`tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract

The soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372)

Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.

The `tokio` feature `io-util` is also required to be enabled to trigger this
soundness issue.

Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.

Tokio before 0.2.0 used `futures` 0.1 that did not have `Pin`, so it is not
affected by this issue.
Path traversal vulnerability in glance (GHSA-3hjh-5hgx-f5wh)
Aliases: CVE-2022-25937
Published: 2023-02-13T06:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'glance'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is related to but distinct from the vulnerability reported in [CVE-2018-3715](https://security.snyk.io/vuln/npm:glance:20180129).
Kubernetes Sensitive Information leak via Log File (GHSA-8mjg-8c8g-6h85)
Aliases: CVE-2020-8564
Published: 2023-02-06T23:27:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.19.0'}, {'fixed': '1.19.3'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.18.0'}, {'fixed': '1.18.10'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.17.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.20.0-alpha.1'}]}]}]

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.
Cross-site Scripting in thorsten/phpmyfaq (GHSA-gxxj-x426-xj2w)
Aliases: CVE-2023-0787
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
Denial of service due to unlimited number of parts (GHSA-hpp2-2cr5-pf6g)
Aliases: CVE-2023-25576
Published: 2023-02-14T21:49:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@fastify/multipart'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@fastify/multipart'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.4.1'}]}]}]

### Impact

* The multipart body parser accepts an unlimited number of file parts.
* The multipart body parser accepts an unlimited number of field parts.
* The multipart body parser accepts an unlimited number of empty parts as field
parts.


### Patches

This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x).

### Workarounds

There are no known workaround.  

### References

Reported at https://hackerone.com/reports/1816195.
mrpack-install vulnerable to path traversal with dependency (GHSA-r887-gfxh-m9rr)
Aliases: CVE-2023-25307
Published: 2023-02-08T18:07:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/nothub/mrpack-install'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.16.2'}}]

### Impact
Importing a malicious `.mrpack` file can cause path traversal while downloading files.
This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.

### Patches
No patches yet.

### Workarounds
Avoid importing `.mrpack` files from untrusted sources.

### References
https://docs.modrinth.com/docs/modpacks/format_definition/#files
Withdrawn: wallabag subject to Improper Authorization via annotations (GHSA-xrw3-wqph-3fxg)
Published: 2023-02-01T12:32:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-beta.1'}, {'fixed': '2.5.3'}]}]}]

## Duplicate advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-mrqx-mjc4-vfh3](https://github.com/advisories/GHSA-mrqx-mjc4-vfh3). This link is maintained to preserve external references.

## Original Description

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.
Uncontrolled Resource Consumption (GHSA-vvpx-j8f3-3w6h)
Aliases: CVE-2022-41723
Published: 2023-02-17T14:00:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'golang.org/x/net'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.7.0'}]}]}]

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
Uncaught Exception in thorsten/phpmyfaq (GHSA-6vv4-qq3r-9rv8)
Aliases: CVE-2023-0790
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
Unsafe tar unpacking in HashiCorp go-slug (GHSA-2g5j-5x95-r6hr)
Aliases: CVE-2020-29529
Published: 2023-02-06T23:16:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/go-slug'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0'}]}]}]

HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.
Pimcore contains Unrestricted Upload of File with Dangerous Type (GHSA-8xv4-jj4h-qww6)
Aliases: CVE-2023-23937
Published: 2023-02-02T17:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.16'}]}]}]

### Impact
The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain.

### Patches
Update to version 10.5.16 or apply this patch manually https://github.com/pimcore/pimcore/pull/14125.patch
@sideway/formula contains Regular Expression Denial of Service (ReDoS) Vulnerability (GHSA-c2jc-4fpr-4vhg)
Aliases: CVE-2023-25166
Published: 2023-02-08T22:38:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@sideway/formula'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.1'}]}]}]

### Impact

User-provided strings to formula's parser might lead to polynomial execution time.

### Patches

Users should upgrade to 3.0.1+.

### Workarounds

None.
Moodle Cross-site Scripting vulnerability (GHSA-grmj-gpwm-98ww)
Aliases: CVE-2023-23922
Published: 2023-02-17T21:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-beta'}, {'fixed': '4.0.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0-beta'}, {'fixed': '4.1.1'}]}]}]

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in blog search. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website. This flaw allows a remote attacker to perform cross-site scripting (XSS) attacks.
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2 (GHSA-4xgv-j62q-h3rj)
Published: 2023-02-07T18:36:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pion/dtls'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pion/dtls/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.4'}]}]}]

### Impact

During the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash.

This issue could be abused to cause a denial of service.

### Workaround

None, upgrade to 2.2.4