aswin1906/github-advisory-2023 huggingface dataset:
Jenkins mabl Plugin missing permission check (GHSA-23rr-6phq-5p65)
Aliases: CVE-2023-37950
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.mabl.integration.jenkins:mabl-integration'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.47'}]}]}]

Jenkins mabl Plugin 0.0.46 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in mabl Plugin 0.0.47 requires the appropriate permissions.
Jenkins Oracle Cloud Infrastructure Compute Plugin missing SSH host key validation (GHSA-j54r-w587-95q7)
Aliases: CVE-2023-37948
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.17'}]}]}]

Jenkins Oracle Cloud Infrastructure Compute Plugin 1.0.16 and earlier does not perform SSH host key validation when connecting to OCI clouds.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to OCI clouds.

Oracle Cloud Infrastructure Compute Plugin 1.0.17 provides strategies for performing host key validation for administrators to select the one that meets their security needs.
Jenkins Benchmark Evaluator Plugin vulnerable to cross-site request forgery (GHSA-wgvx-9rh5-4g4m)
Aliases: CVE-2023-37962
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:benchmark-evaluator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.1'}]}]}]

Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Apache Airflow Hive Provider Beeline remote code execution with Principal (GHSA-hg6c-qqcm-r79r)
Aliases: CVE-2023-35797
Published: 2023-07-03T12:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-hive'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.1'}]}]}]

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider.
This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.

Before version 6.1.1 it was possible to bypass the security check to RCE via
principal parameter. For this to be exploited it requires access to modifying the connection details.

It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
CSRF vulnerability in GitLab Authentication Plugin (GHSA-cg6r-gqvc-r396)
Aliases: CVE-2023-39153
Published: 2023-07-26T15:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:gitlab-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.18'}]}]}]

GitLab Authentication Plugin 1.17.1 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.

This vulnerability allows attackers to trick users into logging in to the attacker’s account.

GitLab Authentication Plugin 1.18 implements a state parameter in its OAuth flow.
Obfuscated email addresses should not be sorted (GHSA-g9w4-prf3-m25g)
Aliases: CVE-2023-38509
Published: 2023-07-27T19:28:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livetable-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.5-milestone-1'}, {'fixed': '14.10.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livetable-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0'}, {'fixed': '15.3-rc-1'}]}]}]

## Impact

The mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails.

See https://jira.xwiki.org/browse/XWIKI-20601 for the reproduction steps.

## Patches

This has been patched in XWiki 14.10.9, and XWiki 15.3-rc-1.

## Workarounds

The workaround is to modify the page XWiki.LiveTableResultsMacros following this [patch](https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0c).

## References

- https://jira.xwiki.org/browse/XWIKI-20601
- https://github.com/xwiki/xwiki-platform/commit/1dfb6804d4d412794cbe0098d4972b8ac263df0c

## For more information

If you have any questions or comments about this advisory:

-    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
-    Email us at [Security Mailing List](mailto:security@xwiki.org)
Apache Pulsar Broker's Rest Producer vulnerable to Incorrect Authorization (GHSA-j2r7-3rvw-g7gx)
Aliases: CVE-2023-30428
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar-broker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.10.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar-broker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.11.0'}, {'fixed': '2.11.1'}]}], 'versions': ['2.11.0']}]

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role.
This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0.

The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to exploit this authorization vulnerability.

There are two known risks for affected users. First, an attacker could produce garbage messages to any topic in the cluster. Second, an attacker could produce messages to the topic level policies topic for other tenants and influence topic settings that could lead to exfiltration and/or deletion of messages for other tenants.

2.8 Pulsar Broker users and earlier are unaffected.
2.9 Pulsar Broker users should upgrade to one of the patched versions.
2.10 Pulsar Broker users should upgrade to at least 2.10.4.
2.11 Pulsar Broker users should upgrade to at least 2.11.1.
3.0 Pulsar Broker users are unaffected.
kube-apiserver vulnerable to policy bypass (GHSA-qc2g-gmh6-95p4)
Aliases: CVE-2023-2727
Published: 2023-07-03T21:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.27.0'}, {'fixed': '1.27.3'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.26.0'}, {'fixed': '1.26.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.25.0'}, {'fixed': '1.25.11'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.24.15'}]}]}]

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content (GHSA-f5ww-cq3m-q3g7)
Aliases: CVE-2023-36823
Published: 2023-07-06T19:45:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'sanitize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '6.0.2'}]}]}]

### Impact

Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize `>= 3.0.0, < 6.0.2` when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in XSS (cross-site scripting) or other undesired behavior when the malicious HTML and CSS are rendered in a browser.

### Patches

Sanitize `>= 6.0.2` performs additional escaping of CSS in `style` element content, which fixes this issue.

### Workarounds

Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content.

### Credit

This issue was found by @cure53 during an audit of a project that uses Sanitize and was reported by one of that project's maintainers. Thank you!
@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state (GHSA-g8x5-p9qc-cf95)
Aliases: CVE-2023-31999
Published: 2023-07-05T21:36:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@fastify/oauth2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.2.0'}]}]}]

### Impact

All versions of @fastify/oauth2 used a statically generated `state` parameter at startup time and were used across all requests for all users.
The purpose of the Oauth2 `state` parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it.

### Patches

v7.2.0 changes the default behavior to store the `state` in a cookie with the `http-only` and `same-site=lax` attributes set. The state is now by default generated for every user.

Note that this contains a breaking change in the `checkStateFunction` function, which now accepts the full `Request` object.

### Workarounds

There are no known workarounds.

### References

* [Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters](https://auth0.com/docs/secure/attack-protection/state-parameters)
Reflected cross-site scripting via  k304 parameter (GHSA-f54q-j679-p9hh)
Aliases: CVE-2023-38501
Published: 2023-07-25T17:49:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'copyparty'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.7'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.8.6'}}]

### Summary
The application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`

### Details
A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.

The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link.

It is recommended to change the passwords of your copyparty accounts, unless you have inspected your logs and found no trace of attacks.

### Checking for exposure
if copyparty is running behind a reverse proxy, you can check the access-logs for traces of attacks, by grepping for URLs containing `?hc=` with `<` somewhere in its value, for example using the following command:
* nginx:
  ```bash
  (gzip -dc access.log*.gz; cat access.log) | sed -r 's/" [0-9]+ .*//' | grep -iE '%0[da]%0[da]%0[da]%0[da]|[?&](hc|pw)=.*[<>]'
  ```
the above commands also check for attacks against GHSA-cw7j-v52w-fp5r

### PoC
`https://localhost:3923/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(1)%3E`
code.gitea.io/gitea Open Redirect vulnerability (GHSA-cf6v-9j57-v6r6)
Aliases: CVE-2023-3515
Published: 2023-07-05T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'code.gitea.io/gitea'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.19.4'}]}]}]

Open Redirect in GitHub repository go-gitea/gitea prior to 1.19.4. This is most likely a post-auth redirect plus it is a POST based request scenario, so less likely that can be exploited or chained with other bugs that can cause phishing or credential theft.
Jenkins Stored Cross-site Scripting vulnerability  (GHSA-69vw-3pcm-84rw)
Aliases: CVE-2023-39151
Published: 2023-07-26T15:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.402'}, {'fixed': '2.414.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.401.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.415'}, {'fixed': '2.416'}]}], 'versions': ['2.415']}]

Jenkins applies formatting to the console output of builds, transforming plain URLs into hyperlinks. Jenkins 2.415 and earlier, 2.414 and earlier, and LTS 2.401.2 and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents. Jenkins 2.416, 2.414.1, and LTS 2.401.3 encodes URLs of affected hyperlink annotations in build logs.
Code injection in stanford-parser (GHSA-353m-jh2m-72v4)
Aliases: CVE-2023-39020
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'edu.stanford.nlp:stanford-parser'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.9.2'}]}]}]

stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2PipedInputStream. This vulnerability is exploited via passing an unchecked argument.
gRPC Reachable Assertion issue (GHSA-6628-q6j9-w8vg)
Aliases: CVE-2023-1428
Published: 2023-07-06T21:15:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.grpc:grpc-protobuf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'grpcio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'grpc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}]

There exists an vulnerability causing an abort() to be called in gRPC. 
The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
Potential denial of service after connection migration (GHSA-rfhg-rjfp-9q8q)
Published: 2023-07-24T22:43:05Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 's2n-quic'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.25.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.24.0'}}]

### Impact
An issue in s2n-quic results in the endpoint shutting down due to a combination of peer-initiated connection migration and duplicate new connection ID frames being received. No AWS services are affected by this issue, and customers of AWS services do not need to take action.

Impacted versions: <=v1.24.0
### Patches
The patch is included in v1.25.0.

### Workarounds
There is no workaround. Applications using s2n-quic should upgrade their application to the most recent release of s2n-quic.

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Improper authorization on debug and artifact file downloads (GHSA-m4hc-m2v6-hfw8)
Aliases: CVE-2023-36826
Published: 2023-07-25T17:19:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sentry'}, 'ecosystem_specific': {'affected_functions': ['sentry.api.endpoints.artifact_lookup.ProjectArtifactLookupEndpoint.download_file', 'sentry.api.endpoints.artifact_lookup.ProjectArtifactLookupEndpoint.get', 'sentry.api.endpoints.artifact_lookup.update_bundles', 'sentry.api.endpoints.artifact_lookup.get_legacy_release_bundles', 'sentry.api.endpoints.artifact_lookup.UrlConstructor.url_for_file_id', 'sentry.api.endpoints.debug_files.DebugFilesEndpoint.download']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.21.0'}, {'fixed': '23.5.2'}]}]}]

### Impact

An authenticated user can download a debug or artifact bundle from arbitrary organizations and projects with a known bundle ID. The user does not need to be a member of the organization or have permissions on the project.

### Patches

A patch was issued to ensure authorization checks are properly scoped on requests to retrieve debug or artifact bundles. Authenticated users who do not have the necessary permissions on the particular project are no longer able to download them.

**Sentry SaaS users do not need to take any action. [Self-Hosted Sentry](https://github.com/getsentry/self-hosted) users should upgrade to version 23.5.2 or higher.**

### References

- [Restrict file downloads to Project](https://github.com/getsentry/sentry/pull/49680)
Making all attributes on a content-type public without noticing it (GHSA-chmr-rg2f-9jmf)
Aliases: CVE-2023-34093
Published: 2023-07-25T17:17:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@strapi/strapi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.10.8'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@strapi/utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.10.8'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@strapi/database'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.10.8'}]}]}]

### Summary
Anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it.

### Details
When dealing with content-types inside a Strapi instance, we can extend those using the appropriate container:
```javascript
strapi.container.get('content-types').extend(contentTypeUID, (contentType) => newContentType);
```
The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes).

### PoC
Extend any content type on runtime (like in the bootstrap functions) and do a copy of the content-type object.
```javascript
strapi.container.get('content-types').extend(contentTypeUID, (contentType) => {
  const newCT = { ... contentType, attributes: { ...contentType.attributes, newAttr: {} } };
  return newCT;
});
```
This will have as effect to remove the getter and as we rely on it in sanitization, every attributes will be considered as public.

### Impact
Everyone can be impacted. Depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected.
league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase (GHSA-wj7q-gjg8-3cpm)
Aliases: CVE-2023-37260
Published: 2023-07-06T21:07:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'league/oauth2-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.3.2'}, {'fixed': '8.4.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'league/oauth2-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.0'}, {'fixed': '8.5.3'}]}]}]

### Impact
Servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. 

### Patches
This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 or 8.4.2 to receive the patch.

### Workarounds
We recommend upgrading the oauth2-server to one of the patched releases (8.5.3 or 8.4.2). If you are unable to upgrade you can avoid this security issue by passing your key as a file instead of a string.

### References
* [Fix for 8.4.x](https://github.com/thephpleague/oauth2-server/pull/1359)
* [Fix for 8.5.x](https://github.com/thephpleague/oauth2-server/pull/1353)
Apache RocketMQ may have remote code execution vulnerability when using update configuration function (GHSA-x3cq-8f32-5f63)
Aliases: CVE-2023-33246
Published: 2023-07-06T21:15:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.rocketmq:rocketmq-broker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.1.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.rocketmq:rocketmq-namesrv'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.9.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.rocketmq:rocketmq-controller'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.1.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.rocketmq:rocketmq-namesrv'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.1.1'}]}]}]

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. 

Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. 

To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
Pimcore vulnerable to SQL Injection in Dataobjects sorting (GHSA-c9hw-557q-f8hq)
Aliases: CVE-2023-3820
Published: 2023-07-21T20:18:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.6.4'}]}]}]

### Impact
Using some SQL exploitation tools such as sqlmap, an attacker can enumerate all information in the database, alter data or perform dos on the backend database.

### Patches
Update to version 10.6.5 or apply this patch manually https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97.patch manually.

### References
https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db/
Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations (GHSA-58qw-p7qm-5rvh)
Published: 2023-07-10T21:52:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-xml'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0-alpha0'}, {'fixed': '10.0.16'}]}], 'database_specific': {'last_known_affected_version_range': '<= 10.0.15'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-xml'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0-alpha0'}, {'fixed': '11.0.16'}]}], 'database_specific': {'last_known_affected_version_range': '<= 11.0.15'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-xml'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.0.0.alpha0'}, {'fixed': '12.0.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 12.0.0.beta4'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-xml'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.4.52'}]}], 'database_specific': {'last_known_affected_version_range': '<= 9.4.51'}}]

### From the reporter

> `XmlParser` is vulnerable to XML external entity (XXE) vulnerability.
>  XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit
> this vulnerability in order to achieve SSRF or cause a denial of service.
> One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the
> WAR includes a malicious web.xml.

### Impact
There are no circumstances in a normally deployed Jetty server where potentially hostile XML is given to the XmlParser class without the attacker already having arbitrary access to the server. I.e. in order to exploit `XmlParser` the attacker would already have the ability to deploy and execute hostile code.  Specifically, Jetty has no protection against malicious web application and potentially hostile web applications should only be run on an isolated virtualisation.  

Thus this is not considered a vulnerability of the Jetty server itself, as any such usage of the jetty XmlParser is equally vulnerable as a direct usage of the JVM supplied SAX parser.  No CVE will be allocated to this advisory.

However, any direct usage of the `XmlParser` class by an application may be vulnerable.  The impact would greatly depend on how the application uses `XmlParser`, but it could be a denial of service due to large entity expansion, or possibly the revealing local files if the XML results are accessible remotely.

### Patches
Ability to configure the SAXParserFactory to fit the needs of your particular XML parser implementation have been merged as part of PR #10067

### Workarounds
Don't use `XmlParser` to parse data from users.
Pimcore Cross-site Scripting vulnerability (GHSA-vmpv-qjhq-r463)
Aliases: CVE-2023-3822
Published: 2023-07-21T15:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.6.4'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
Mongoose Prototype Pollution vulnerability (GHSA-9m93-w8w6-76hh)
Aliases: CVE-2023-3696
Published: 2023-07-17T03:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'mongoose'}, 'ecosystem_specific': {'affected_functions': ['mongoose.Model.findByIdAndUpdate']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.3.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'mongoose'}, 'ecosystem_specific': {'affected_functions': ['mongoose.Model.findByIdAndUpdate']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.11.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'mongoose'}, 'ecosystem_specific': {'affected_functions': ['mongoose.Model.findByIdAndUpdate']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.13.20'}]}]}]

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.
Archive_Tar contains Potential RCE if filename starts with phar:// (GHSA-3q76-jq6m-573p)
Aliases: CVE-2018-1000888
Published: 2023-07-07T13:42:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pear/archive_tar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.4'}]}]}]

PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502, CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract is called without a specific prefix path, we can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar object injection, arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded, it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.
layui vulnerable to cross-site scripting (GHSA-hx4h-676r-j3qp)
Aliases: CVE-2023-3691
Published: 2023-07-16T18:30:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'layui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.0'}]}]}]

A vulnerability, which was classified as problematic, was found in layui up to v2.8.0-rc.16. This affects an unknown part of the component HTML Attribute Handler. The manipulation of the argument title leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.8.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-234237 was assigned to this vulnerability.
Jenkins Pipeline restFul API Plugin vulnerable to Cross Site Request Forgery (GHSA-hmw6-r547-42fr)
Aliases: CVE-2023-37957
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:pipeline-restful-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.11'}]}]}]

Jenkins Pipeline restFul API Plugin 0.11 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to have Jenkins connect to an attacker-specified URL, capturing a newly generated JCLI token that allows impersonating the victim.
Spring HATEOAS vulnerable to Improper Neutralization of HTTP Headers for Scripting Syntax (GHSA-7m5c-fgwf-mwph)
Aliases: CVE-2023-34036
Published: 2023-07-17T12:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.hateoas:spring-hateoas'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.hateoas:spring-hateoas'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.hateoas:spring-hateoas'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.1'}]}]}]

Reactive web applications that use Spring HATEOAS to produce hypermedia-based responses might be exposed to malicious forwarded headers if they are not behind a trusted proxy that ensures correctness of such headers, or if they don't have anything else in place to handle (and possibly discard) forwarded headers either in WebFlux or at the level of the underlying HTTP server.

For the application to be affected, it needs to satisfy the following requirements:

  *  It needs to use the reactive web stack (Spring WebFlux) and Spring HATEOAS to create links in hypermedia-based responses.
  *  The application infrastructure does not guard against clients submitting (X-)Forwarded… headers.
Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (GHSA-r87r-982q-2c3q)
Aliases: CVE-2023-3819
Published: 2023-07-21T20:18:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.6.4'}]}]}]

### Impact
Unauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc.

### Patches
Update to version 10.6.4 or apply this patch manually https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54.patch manually.

### References
https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c/
Sentry CORS misconfiguration (GHSA-4xqm-4p72-87h6)
Aliases: CVE-2023-36829
Published: 2023-07-06T22:55:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sentry'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.6.0'}, {'fixed': '23.6.2'}]}]}]

### Impact
The Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `system.base-hostname` option of Sentry installation. This only affects installations that have `system.base-hostname` option explicitly set, as it is empty by default.

Impact is limited since recent versions of major browsers have cross-site cookie blocking enabled by default. However, this flaw could allow other multi-step attacks.

### Patches
The patch has been released in [Sentry 23.6.2](https://github.com/getsentry/self-hosted/releases/tag/23.6.2).

### Workarounds

For Sentry SaaS customers, no action is needed.

For self-hosted Sentry installations that have `system.base-hostname` explicitly set, it is recommended to upgrade the installation to 23.6.2 or higher. There are no known workarounds.

### References
- [getsentry/sentry PR #52276](https://github.com/getsentry/sentry/pull/52276)

### Credits
- [@andr0idp4r4n0id](https://twitter.com/andr0idp4r4n0id)
scipy memory leak vulnerability (GHSA-9jx5-6pgf-crrp)
Aliases: CVE-2023-25399
Published: 2023-07-05T18:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'scipy'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.10.0'}]}]}]

A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in `Py_FindObjects()` function.
Apache Pulsar Broker Improper Authentication vulnerability (GHSA-47r2-phr8-m8cp)
Aliases: CVE-2023-31007
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar-broker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.10.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar-broker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.11.0'}, {'fixed': '2.11.1'}]}], 'versions': ['2.11.0']}]

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.

This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0.

2.9 Pulsar Broker users should upgrade to at least 2.9.5.
2.10 Pulsar Broker users should upgrade to at least 2.10.4.
2.11 Pulsar Broker users should upgrade to at least 2.11.1.
3.0 Pulsar Broker users are unaffected.
Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.
Information Disclosure due to Out-of-scope Site Resolution (GHSA-jq6g-4v5m-wm9r)
Aliases: CVE-2023-38499
Published: 2023-07-25T18:25:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'typo3/cms-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.0'}, {'fixed': '9.5.42'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'typo3/cms-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.4.39'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'typo3/cms-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '11.5.30'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'typo3/cms-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.0.0'}, {'fixed': '12.4.4'}]}]}]

> ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (3.5)

### Problem
In multi-site scenarios, enumerating the HTTP query parameters `id` and `L` allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available.

### Solution
Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 that fix the problem described above.

> ℹ️ **Strong security defaults - Manual actions required**
> Resolving sites by the `id` and `L` HTTP query parameters is now denied per default. However, it is still allowed to resolve a particular page by e.g. `https://example.org/?id=123&L=0` - as long as the `page-id 123` is in the scope of the site configured for the `base-url example.org`.
> The new feature flag `security.frontend.allowInsecureSiteResolutionByQueryParameters` - which is disabled per default - can be used to reactivate the previous behavior.

### Credits
Thanks to Garvin Hicking who reported this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.

### References
* [TYPO3-CORE-SA-2023-003](https://typo3.org/security/advisory/typo3-core-sa-2023-003)
keylime fails to flag device as untrusted when signature does not validate (GHSA-g4wg-cfpf-9689)
Aliases: CVE-2023-3674
Published: 2023-07-19T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'keylime'}, 'ecosystem_specific': {'affected_functions': ['keylime.tpm.tpm_util.checkquote']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.2.5'}]}]}]

A flaw was found in the keylime attestation verifier, which fails to flag a device's submitted TPM quote as faulty when the quote's signature does not validate for some reason. Instead, it will only emit an error in the log without flagging the device as untrusted.
vm2 Sandbox Escape vulnerability (GHSA-cchq-frgv-rjh5)
Aliases: CVE-2023-37466
Published: 2023-07-13T17:02:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vm2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.9.19'}]}]}]

In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.

### Impact
Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.

### Patches
None.

### Workarounds
None.

### References
PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.
Feathers socket handler allows abusing implicit toString (GHSA-hhr9-rh25-hvf9)
Aliases: CVE-2023-37899
Published: 2023-07-20T14:54:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@feathersjs/socketio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.18'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.5.17'}}, {'package': {'ecosystem': 'npm', 'name': '@feathersjs/socketio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.0.7'}}, {'package': {'ecosystem': 'npm', 'name': '@feathersjs/transport-commons'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.18'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.5.17'}}, {'package': {'ecosystem': 'npm', 'name': '@feathersjs/transport-commons'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.0.7'}}]

### Impact

Feathers socket handler did not catch invalid string conversion errors like:

```ts
const message = `${{ toString: '' }}`
```

Causing the NodeJS process to crash when sending an unexpected Socket.io message like

```ts
socket.emit('find', { toString: '' })
```

### Patches

A fix has been released in

- `v5.0.8` via #3241
- `v4.5.18` via #3242

### Workarounds

Since it is in the core Socket handling code upgrading to the latest version is necessary.
### References

- [v5.0.8 Changelog](https://github.com/feathersjs/feathers/blob/dove/CHANGELOG.md#508-2023-07-19)
- [v4.5.18 Changelog](https://github.com/feathersjs/feathers/blob/crow/CHANGELOG.md#4518-2023-07-19)
Apache InLong has Weak Password Requirements in Apache InLong (GHSA-w3wr-gmwf-r333)
Aliases: CVE-2023-31098
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '1.47.0'}]}], 'database_specific': {'last_known_affected_version_range': '< 1.7.0'}}]

Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.1.0 through 1.6.0. When users change their password to a simple password (with any character or symbol), attackers can easily guess the user's password and access the account. Users are advised to upgrade to Apache InLong 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7805 to solve it.
Cross site scripting via input unit widget (GHSA-4gpr-p634-922x)
Aliases: CVE-2023-36806
Published: 2023-07-25T17:19:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.9.42'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.10.0'}, {'fixed': '4.13.28'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.1.10'}]}]}]

### Impact

Authenticated users can inject malicious code in widgets with units, which is then executed both in the element preview (back end) and on the website (front end).

### Patches

Update to Contao 4.9.42, 4.13.28 or 5.1.10.

### Workarounds

Disable login for all untrusted back end users.

### References

https://contao.org/en/security-advisories/cross-site-scripting-in-widgets-with-units

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

### Credits

Thanks to Christian Pöschl and Fabian Brenner from usd AG for reporting this vulnerability.
Missing authorization in Jenkins Plug-in for ServiceNow  (GHSA-cj2x-r74q-vcx9)
Aliases: CVE-2023-3442
Published: 2023-07-26T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:servicenow-devops'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.38.1'}]}]}]

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server.  No changes are required on your instances of the Now Platform.
Jenkins Sumologic Publisher Plugin missing permission check (GHSA-mx84-frhw-pcg8)
Aliases: CVE-2023-37959
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:sumologic-publisher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.1'}]}]}]

Jenkins Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.