aswin1906/github-advisory-2023 huggingface dataset:
GitOps Run allows for Kubernetes workload injection (GHSA-wr3c-g326-486c)
Aliases: CVE-2022-23508
Published: 2023-01-09T19:45:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/weaveworks/weave-gitops'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.11.0'}}]

### Impact
A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources.

GitOps run has a local S3 bucket which it uses for synchronising files that are later applied against a Kubernetes cluster. Its endpoint had no security controls to block unauthorised access, therefore allowing local users (and processes) on the same machine to see and alter the bucket content.

By leveraging this vulnerability, an attacker could pick a workload of their choosing and inject it into the S3 bucket, which resulted in the successful deployment in the target cluster, without the need to provide any credentials to either the S3 bucket nor the target Kubernetes cluster.

### Patches
This vulnerability has been fixed by commits [75268c4](https://github.com/weaveworks/weave-gitops/pull/3114/commits/75268c4d2c8f7e4db22c63d76b451ba6545d117f) and [966823b](https://github.com/weaveworks/weave-gitops/pull/3102/commits/966823bbda8c539a4661e2a4f8607c9307ba6225). Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022.

### Workarounds
There is no workaround for this vulnerability.

### References
Disclosed by Paulo Gomes, Senior Software Engineer, Weaveworks.

### For more information
If you have any questions or comments about this advisory:

- Open an issue in [Weave GitOps repository](https://github.com/weaveworks/weave-gitops)
- Email us at [support@weave.works](mailto:support@weave.works)
Gitops Run insecure communication (GHSA-89qm-wcmw-3mgg)
Aliases: CVE-2022-23509
Published: 2023-01-09T19:45:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/weaveworks/weave-gitops'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.11.0'}}]

### Impact
GitOps run has a local S3 bucket which it uses for synchronising files that are later applied against a Kubernetes cluster. The communication between GitOps Run and the local s3 bucket is not encrypted. 

This allows privileged users or process to tap the local traffic to gain information permitting access to the s3 bucket. From that point, it would be possible to alter the bucket content, resulting in changes in the Kubernetes cluster's resources(e.g. CVE-2022-23508).

### Patches
This vulnerability has been fixed by commits [ce2bbff](https://github.com/weaveworks/weave-gitops/pull/3106/commits/ce2bbff0a3609c33396050ed544a5a21f8d0797f) and [babd915](https://github.com/weaveworks/weave-gitops/pull/3098/commits/babd91574b99b310b84aeec9f8f895bd18acb967). Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022.

### Workarounds
There is no workaround for this vulnerability.

### References
Disclosed by Paulo Gomes, Senior Software Engineer, Weaveworks.

### For more information
If you have any questions or comments about this advisory:
- Open an issue in [Weave GitOps repository](https://github.com/weaveworks/weave-gitops)
- Email us at [support@weave.works](mailto:support@weave.works)
Path Traversal In Eclipse GlassFish (GHSA-3g5w-6pw7-6hrp)
Aliases: CVE-2022-2712
Published: 2023-01-27T12:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.glassfish.main.web:web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '7.0.0'}]}]}]

In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed application source code.
Froxlor is vulnerable to path traversal (GHSA-xp3g-2729-rxm3)
Aliases: CVE-2023-0316
Published: 2023-01-16T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]

Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0.
usememos/memos vulnerable to stored Cross-site Scripting (GHSA-x22v-qgm2-7qc7)
Aliases: CVE-2023-0110
Published: 2023-01-07T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Apache Linkis vulnerable to Exposure of Sensitive Information (GHSA-rx76-xw35-6rh8)
Aliases: CVE-2022-44644
Published: 2023-01-31T12:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.linkis:linkis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.1'}]}]}]

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, an authenticated attacker could read arbitrary local file by connecting a rogue mysql server, By adding allowLoadLocalInfile to true in the jdbc parameter. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users upgrade the version of Linkis to version 1.3.1
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin  (GHSA-pcc2-w6m8-x5w4)
Aliases: CVE-2023-24429
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:semantic-versioning-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15'}]}]}]

Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
himiklab yii2-jqgrid-widget vulnerable to SQL Injection (GHSA-7mg5-rw39-q67f)
Aliases: CVE-2014-125051
Published: 2023-01-06T18:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'himiklab/yii2-jqgrid-widget'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.8'}]}]}]

A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function `addSearchOptionsRecursively` of the file `JqGridAction.php`. The manipulation leads to sql injection. Upgrading to version 1.0.8 can address this issue. The name of the patch is a117e0f2df729e3ff726968794d9a5ac40e660b9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217564.
Observable timing discrepancy in JOpenId (GHSA-m4f8-p58g-j8mj)
Aliases: CVE-2010-10006
Published: 2023-01-18T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.expressme:JOpenId'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.08'}]}]}]

A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460.
CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin (GHSA-m6q8-mwf6-6mmc)
Aliases: CVE-2023-24434
Published: 2023-01-26T21:30:18Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ghprb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.42.2'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Baobab vulnerable to Prototype Pollution (GHSA-wvr2-q86m-6whp)
Aliases: CVE-2021-4307
Published: 2023-01-07T21:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'baobab'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.1'}]}]}]

A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The name of the patch is c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627.
Deno is vulnerable to race condition via interactive permission prompt spoofing (GHSA-mc52-jpm2-cqh6)
Aliases: CVE-2023-22499
Published: 2023-01-20T16:56:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'deno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9.0'}, {'fixed': '1.29.3'}]}]}]

### Impact

Multi-threaded programs were able to spoof interactive permission prompt by rewriting the prompt to suggest that program is waiting on user confirmation to unrelated action. 

A malicious program could clear the terminal screen after permission prompt was shown and write a generic message like so:
```
// Expected prompt
⚠️  ┌ Deno requests read access to "./log.txt".
   ├ Requested by `Deno.open()` API
   ├ Run again with --allow-read to bypass this prompt.
   └ Allow? [y/n] (y = yes, allow; n = no, deny) >

// Prompt that users would see
Do you want to continue?
```

This situation impacts users who use Web Worker API and relied on interactive permission prompt. The reproduction is very timing sensitive and can’t be reliably reproduced on every try.

This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers). 

### Patches

The problem has been fixed in Deno v1.29.3; it is recommended all users update to this version.

### Workarounds

Run with `--no-prompt` flag to disable interactive permission prompts.
Arbitrary file write in net.mingsoft:ms-mcms (GHSA-65v6-3c9m-hmrp)
Aliases: CVE-2022-47042
Published: 2023-01-26T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.mingsoft:ms-mcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.2.11'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.2.10'}}]

MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
Apache Linkis contains Deserialization of Untrusted Data (GHSA-h6w8-52mq-4qxc)
Aliases: CVE-2022-44645
Published: 2023-01-31T12:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.linkis:linkis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.1'}]}]}]

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. We recommend users to upgrade the version of Linkis to version 1.3.1.
Apache Superset is vulnerable to Cross-Site Scripting (XSS)  (GHSA-79x5-cv79-49rj)
Aliases: CVE-2022-43718
Published: 2023-01-16T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'versions': ['2.0.0']}]

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CakePHP has incorrect Cross-Site Request Forgery validation (GHSA-829q-v5g8-hhxc)
Published: 2023-01-20T23:02:02Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.4'}]}]}]

CsrfComponent fails to invalidate requests that are missing both the CSRF token, and CSRF post data.
LdapCherry Cross-site Scripting vulnerbaility (GHSA-vq8w-x8v7-f88m)
Aliases: CVE-2019-25095
Published: 2023-01-05T09:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ldapcherry'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0'}]}]}]

A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The name of the patch is 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. It is recommended to upgrade the affected component. VDB-217434 is the identifier assigned to this vulnerability.
Apiman Manager API affected by Jackson denial of service vulnerability (GHSA-q95j-488q-5q3p)
Published: 2023-01-09T20:05:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.apiman:apiman-manager-api-impl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0.Final'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.2.3.Final'}}]

### Impact

Due to a vulnerability in `jackson-databind <= 2.12.6.0`, an authenticated attacker could craft an Apiman policy configuration which, when saved, may cause a denial of service on the Apiman Manager API.

This does **not** affect the Apiman Gateway.

### Patches

Upgrade to Apiman 3.0.0.Final or later.

If you are using an older version of Apiman and need to remain on that version, contact your Apiman [support provider](https://www.apiman.io/support.html) for advice/long-term support.

### Workarounds

If all users of the Apiman Manager are trusted then you may assess this is low risk, as an account is required to exploit the vulnerability.

### References

* Apiman maintainer and security contact: marc@blackparrotlabs.io
* https://nvd.nist.gov/vuln/detail/CVE-2020-36518
* https://github.com/FasterXML/jackson-databind/issues/2816
Shopware's log module vulnerable to Improper Output Neutralization (GHSA-7cp7-jfp6-jh4f)
Aliases: CVE-2023-22733
Published: 2023-01-20T17:33:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/platform'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}, {'package': {'ecosystem': 'Packagist', 'name': 'shopware/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}]

### Impact

The log module contains all kind of sent mails. It is possible to see the password reset email of customers and admin users to gain probably more access.

### Patches
Update to the latest 6.4.18.1 version.

### Workarounds
- For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. 
- Remove from all users the log module ACL rights
- [Disable logging](https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging)

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
Code Injection in pyload-ng (GHSA-pf38-5p22-x6h6)
Aliases: CVE-2023-0297
Published: 2023-01-14T03:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev31'}]}]}]

Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
Fix for arbitrary command execution in custom layout update through blocks (GHSA-c9q3-r4rv-mjm7)
Aliases: CVE-2021-39217
Published: 2023-01-27T00:54:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.22'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0.0'}, {'fixed': '20.0.19'}]}]}]

### Impact
Custom Layout enabled admin users to execute arbitrary commands via block methods.
Apache DolphinScheduler vulnerable to Improper Input Validation (GHSA-3xh5-8hvq-rc8x)
Aliases: CVE-2022-45875
Published: 2023-01-04T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.dolphinscheduler:dolphinscheduler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.dolphinscheduler:dolphinscheduler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.1.1'}]}], 'versions': ['3.1.0']}]

Apache DolphinScheduler improperly validates script alert plugin parameters and is vulnerable to remote command execution. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. Users should upgrade to version 3.0.2 or 3.1.1.
XML-RPC for PHP allows access to local files via malicious argument to the Client::send method (GHSA-m95x-m25c-w9mp)
Published: 2023-01-11T23:54:47Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'phpxmlrpc/phpxmlrpc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.9.0'}]}]}]

Abusing the `$method` argument of Client::send, it was possible to force the client to _access local files_ or _connect to undesired urls_ instead of the intended target server's url (the one used in the Client constructor).

This weakness only affects installations where all the following conditions apply, at the same time:

- the xmlrpc Client is used, ie. not xmlrpc servers
- untrusted data (eg. data from remote users) is used as value for the `$method` argument of method `Client::send()`, in conjunction with conditions which trigger usage of curl as http transport (ie. either using the https, http11 or http2 protocols, or calling `Client::setUseCurl()` beforehand)
- either have set the Clients `return_type` property to 'xml', or make the resulting Response's object `httpResponse` member, which is intended to be used for debugging purposes only, available to 3rd parties, eg. by displaying it to the end user or serializing it in some storage (note that the same data can also be accessed via magic property `Response::raw_data`, and in the Request's `httpResponse` member)

This is most likely a very uncommon usage scenario, and as such the chances of exploitation of this issue may be low.

If it is not possible to upgrade to this release of the library at this time, a proactive security measure, to avoid the Client accessing any local file on the server which hosts it, is to add the following call to your code:

      $client->setCurlOptions([CURLOPT_PROTOCOLS, CURLPROTO_HTTPS|CURLPROTO_HTTP]);

Originally reported as issue #81
Joplin Desktop App vulnerable to Cross-site Scripting (GHSA-h6c2-879r-jffh)
Aliases: CVE-2022-45598
Published: 2023-01-31T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'joplin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.9.17'}]}]}]

Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.
Command injection in smartctl (GHSA-69f2-4375-qv9h)
Aliases: CVE-2022-21810
Published: 2023-01-26T21:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'smartctl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.0'}]}]}]

All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.
Ecto lacks a protection mechanism (GHSA-4r2f-6fm9-2qgh)
Aliases: CVE-2017-20166
Published: 2023-01-10T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Hex', 'name': 'ecto'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.1'}]}], 'versions': ['2.2.0']}]

Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between `is_nil` and `raise`.
Several quadratic complexity bugs may lead to denial of service in Commonmarker (GHSA-636f-xm5j-pj9m)
Published: 2023-01-24T18:12:17Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'commonmarker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.23.7'}]}]}]

## Impact

Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.

The following vulnerabilities were addressed:

* [CVE-2023-22483](https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c)
* [CVE-2023-22484](https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r)
* [CVE-2023-22485](https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr)
* [CVE-2023-22486](https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p)

For more information, consult the release notes for version [`0.23.0.gfm.7`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.7).

## Mitigation

Users are advised to upgrade to commonmarker version [`0.23.7`](https://rubygems.org/gems/commonmarker/versions/0.23.7).
typo3-appointments vulnerable to Cross-site Scripting (GHSA-cf5r-3pvm-w64w)
Aliases: CVE-2019-25094
Published: 2023-01-04T12:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'innologi/typo3-appointments'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.6'}]}]}]

A vulnerability, which was classified as problematic, was found in innologi appointments Extension up to 2.0.5. This affects an unknown part of the component Appointment Handler. The manipulation of the argument formfield leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.6 is able to address this issue. The name of the patch is 986d3cb34e5e086c6f04e061f600ffc5837abe7f. It is recommended to upgrade the affected component. The identifier VDB-217353 was assigned to this vulnerability.
Nuxeo vulnerable to Reflected Cross-Site Scripting leading to Remote Code Execution (GHSA-x347-fc9w-w7c3)
Aliases: CVE-2021-32828
Published: 2023-01-06T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.nuxeo.ecm.platform:nuxeo-platform-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '10.10'}]}]}]

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.
Command injection in Rancher Git package (GHSA-34p5-jp77-fcrc)
Aliases: CVE-2022-43758
Published: 2023-01-25T19:36:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.5.17'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.10'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.1'}]}]}]

### Impact

An issue was discovered in Rancher from versions 2.5.0 up to and including 2.5.16, 2.6.0 up to and including 2.6.9 and 2.7.0, where a command injection vulnerability is present in the Rancher Git package. This package uses the underlying Git binary available in the Rancher container image to execute Git operations.

Specially crafted commands, when not properly disambiguated, can cause confusion when executed through Git, resulting in command injection in the underlying Rancher host.

This issue can potentially be exploited in Rancher in two ways:

1. Adding an untrusted Helm catalog, in the Catalogs menu, that contains maliciously designed repo URL configuration in Helm charts.
2. Modifying the URL configuration used to download KDM (Kontainer Driver Metadata) releases.

By default, only the Rancher admin has permission to manage both configurations for the local cluster (the cluster where Rancher is provisioned).

Note: More information about this category of issue in version control system (VCS) tools are available in Snyk's [blog post](https://snyk.io/blog/argument-injection-when-using-git-and-mercurial/).

### Workarounds

Except for only adding trusted catalogs and the KDM URL to Rancher, there is no other workaround besides updating Rancher to a patched version.

### Patches

Patched versions include releases 2.5.17, 2.6.10, 2.7.1 and later versions.

It is also important to update to a patched version in case Rancher or its standalone Git package implementation is used as a Go library instead of the application itself. Otherwise, this vulnerability might affect your dependent code.

### For more information

If you have any questions or comments about this advisory:

* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
string-kit Inefficient Regular Expression Complexity vulnerability (GHSA-pfrm-4rjw-g9q5)
Aliases: CVE-2021-4299
Published: 2023-01-02T09:31:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'string-kit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.8'}]}]}]

A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 can address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180.
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-9jff-8xmm-mw22)
Aliases: CVE-2023-0310
Published: 2023-01-16T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Security bug in ConvertToSinglePlane when used with untrusted content from the DDS loader (GHSA-3w9w-9833-gcpv)
Published: 2023-01-26T19:52:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'directxtex_desktop_2019'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2023.1.31.1'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'directxtex_desktop_win10'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2023.1.31.1'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'directxtex_uwp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2023.1.31.1'}]}]}]

### Impact
A memory overwrite bug was reported by a security researcher in the **ConvertToSinglePlane** method via the *texconv* command-line tool when given an invalid height for planar video textures such as NV12. This can be a potential security bug for any clients of the library who follow the same pattern.

This issue *does not* impact use of the DDS texture loader itself, only when combined with `ConvertToSinglePlane` for converting multi-planar video formats. All other functions in the library fail immediately if given images in planar formats.

### Patches
The fix to the specific area as well as general hardening can be found in [this PR](https://github.com/microsoft/DirectXTex/pull/307) and will be included in the This bug has been fixed in the January 31, 2023 or later release of DirectXTex.

### Workarounds
If your code makes use of **ConvertToSinglePlane**, you can validate that the width & height alignment requirements are met for the input image before calling the function.
usememos/memos vulnerable to stored Cross-site Scripting (GHSA-pcvh-px2p-vmxw)
Aliases: CVE-2023-0107
Published: 2023-01-07T06:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Http4s improperly parses User-Agent and Server headers (GHSA-54w6-vxfh-fw7f)
Aliases: CVE-2023-22465
Published: 2023-01-06T20:24:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.http4s:http4s-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.0'}, {'fixed': '0.21.34'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.http4s:http4s-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.22.0'}, {'fixed': '0.22.15'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.http4s:http4s-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.23.0'}, {'fixed': '0.23.17'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.http4s:http4s-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0-M1'}, {'fixed': '1.0.0-M38'}]}]}]

### Impact

The `User-Agent` and `Server` header parsers are susceptible to a fatal error on certain inputs.  In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. 

#### v0.21.x

```scala
val unsafe: Option[`User-Agent`] = req.headers.get(`User-Agent`)
```

#### v0.22.x, v0.23.x, v1.x

```scala
val unsafe: Option[`User-Agent`] = req.headers.get[`User-Agent`]
val alsoUnsafe: Option[`Server`] = req.headers.get[Server]
```

### Patches

Fixes are released in 0.21.34, 0.22.15, 0.23.17, and 1.0.0-M38.

### Workarounds

#### Use the weakly typed header interface

##### v0.21.x

```scala
val safe: Option[Header] = req.headers.get("User-Agent".ci)
// but don't do this
val unsafe = header.map(_.parsed) 
```

##### v0.22.x, v0.23.x, v1.x

```scala
val safe: Option[Header] = req.headers.get(ci"User-Agent")
```
curupira is vulnerable to SQL injection (GHSA-85gf-wr67-f83w)
Aliases: CVE-2015-10053
Published: 2023-01-16T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'curupira'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.4'}]}]}]

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The name of the patch is 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.
SQL Injection Vulnerability via ActiveRecord comments (GHSA-hq7p-j377-6v63)
Aliases: CVE-2023-22794
Published: 2023-01-18T18:20:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'activerecord'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.6.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'activerecord'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.7.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'activerecord'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.1'}]}]}]

There is a possible vulnerability in ActiveRecord related to the sanitization of comments. This vulnerability has been assigned the CVE identifier CVE-2023-22794.

Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.6.1, 6.1.7.1, 7.0.4.1
Impact

Previously the implementation of escaping for comments was insufficient for

If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database with insufficient sanitization and be able to inject SQL outside of the comment.

In most cases these interfaces won’t be used with user input and users should avoid doing so.

Example vulnerable code:
```
Post.where(id: 1).annotate("#{params[:user_input]}")

Post.where(id: 1).optimizer_hints("#{params[:user_input]}")
```
Example vulnerable QueryLogs configuration (the default configuration is not vulnerable):
```
config.active_record.query_log_tags = [
  {
    something: -> { <some value including user input> }
  }
]
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

Avoid passing user input to annotate and avoid using QueryLogs configuration which can include user input.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.0 series
    6-1-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 6.1 series
    7-0-Make-sanitize_as_sql_comment-more-strict.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Missing permission check in Jenkins BearyChat Plugin (GHSA-67w4-w877-jv29)
Aliases: CVE-2023-24459
Published: 2023-01-26T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:bearychat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.0.2'}]}]}]

A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
pimcore is vulnerable to cross-site scripting via "title field " in data objects (GHSA-6vf6-g3pr-j83h)
Aliases: CVE-2023-0323
Published: 2023-01-20T16:55:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.14'}]}]}]

### Impact
The vulnerability is capable of resulting in stolen user cookies.

#### Proof of Concept
```
Login with dev account https://11.x-dev.pimcore.fun/admin/?_dc=1670962076&perspective=

Go to setting --> data objects --> classes --> events

Click media under genaral settings

Add payload in title field.

Go to data objects module and open events, xss will trigger

// PoC.js "><iMg SrC="x" oNeRRor="alert(xss);">
```
### Patches
Update to version 10.5.14 or apply this patch manually https://github.com/pimcore/pimcore/pull/13916.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/13916.patch manually.

### References
https://huntr.dev/bounties/129d6a4b-0504-4de1-a72c-3f12c4552343/
Exposure of system-scoped Kubernetes credentials in Jenkins Kubernetes Credentials Provider Plugin (GHSA-2jpx-h8j2-g8m4)
Aliases: CVE-2023-24425
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.cloudbees.jenkins.plugins:kubernetes-credentials-provider'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.209.v862c6e5fb'}]}]}]

Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentials lookup, allowing attackers with Item/Configure permission to access and potentially capture Kubernetes credentials they are not entitled to.
http-cache-semantics vulnerable to Regular Expression Denial of Service (GHSA-rc47-6667-2j5j)
Aliases: CVE-2022-25881
Published: 2023-01-31T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'http-cache-semantics'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.webjars.npm:http-cache-semantics'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.1'}]}]}]

http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
CSRF vulnerability in Jenkins Keycloak Authentication Plugin  (GHSA-9wrr-4r9v-26xc)
Aliases: CVE-2023-24457
Published: 2023-01-26T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:keycloak'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.3.0'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account.
XML-RPC for PHP's debugger vulnerable to possible XSS attack (GHSA-pxqj-xrv5-qvjf)
Published: 2023-01-11T23:51:00Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'phpxmlrpc/phpxmlrpc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.9.2'}]}]}]

The bundled xml-rpc debugger is susceptible to XSS attacks.

Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihood of exploitation may be low.
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-96x6-jf5w-84c5)
Aliases: CVE-2023-0306
Published: 2023-01-16T00:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
ELF header parsing library doesn't check for valid offset (GHSA-g6pw-999w-j75m)
Published: 2023-01-20T22:41:01Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'elf_rs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.0'}]}]}]

The crate has several unsafe sections that don't perform proper pointer validation.

An example can be found in the following function:

```
fn section_header_raw(&self) -> &[ET::SectionHeader] {
    let sh_off = self.elf_header().section_header_offset() as usize;
    let sh_num = self.elf_header().section_header_entry_num() as usize;
    unsafe {
        let sh_ptr = self.content().as_ptr().add(sh_off);
        from_raw_parts(sh_ptr as *const ET::SectionHeader, sh_num)
    }
}
```

While this will work perfectly fine *if* the ELF header is valid, malicious or malformed input can contain a section header offset of an arbitrary size, meaning that the resultant pointer in the unsafe block can point to an artibrary address in the address space of the process.

This can result in unpredictable behaviour, and in our fuzz testing, we discovered that it's trivial to cause SIGABRT (signal 6), or SEGV (signal 11).

The function should either be marked as unsafe, with a note that the caller is responsible for providing only valid inputs, or it should ideally do the due diligence to ensure that the offset doesn't exceed the bounds of the header (and add additional checks as necessary).
Xataface vulnerable to Cross-site Scripting (GHSA-64wv-c7jw-jw2q)
Aliases: CVE-2021-4303
Published: 2023-01-05T09:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'xataface/xataface'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0'}]}]}]

A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.0.0 can address this issue. The name of the patch is 94143a4299e386f33bf582139cd4702571d93bde. It is recommended to upgrade the affected component. VDB-217442 is the identifier assigned to this vulnerability. NOTE: Installer is disabled by default.
Cross-site Scripting in pyload-ng (GHSA-wcm6-wv95-7jw6)
Aliases: CVE-2023-0488
Published: 2023-01-27T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev42'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
Cross-site request forgery vulnerability in Jenkins OpenID Plugin (GHSA-96jv-c7m6-q43g)
Aliases: CVE-2023-24446
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:openid'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
Apache Superset vulnerable to Cross-site Scripting (GHSA-9f88-wg5r-947j)
Aliases: CVE-2022-43717
Published: 2023-01-16T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'versions': ['2.0.0']}]

Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Path traversal in spotipy (GHSA-q764-g6fm-555v)
Aliases: CVE-2023-23608
Published: 2023-01-23T22:05:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'spotipy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.22.1'}]}]}]

### Summary
If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended.

### Details
The [code Spotipy uses to parse URIs and URLs ](https://github.com/spotipy-dev/spotipy/blob/master/spotipy/client.py#L1942) accepts user data too liberally which allows a malicious user to insert arbitrary characters into the path that is used for API requests. Because it is possible to include `..`, an attacker can redirect for example a track lookup via `spotifyApi.track()` to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well.

Before the security advisory feature was enabled on GitHub, I was already in contact with Stéphane Bruckert via e-mail, and he asked me to look into a potential fix. 

My recommendation is to perform stricter parsing of URLs and URIs, which I implemented in the patch included at the end of the report. If you prefer, I can also invite you to a private fork of the repository.

### Impact
The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API.