aswin1906/github-advisory-2023 huggingface dataset:
Dgraph Audit Log Encryption Vulnerability (GHSA-92wq-q9pq-gw47)
Aliases: CVE-2023-31135
Published: 2023-05-17T17:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/dgraph-io/dgraph'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.0.0'}]}]}]

### Impact
Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions.  All audit logs generated by versions of Dgraph <v23.0.0 are affected.

### Patches
This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323.  Dgraph users should upgrade to v23.0.0.

### Workarounds
Store existing audit logs in a secure location.  For extra security, encrypt using a tool like `gpg`.

### References
See https://github.com/dgraph-io/dgraph/pull/8323 for more context on the vulnerability.
Jenkins Code Dx Plugin missing permission checks (GHSA-5gjq-5339-x5cv)
Aliases: CVE-2023-2196
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:codedx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Jenkins Code Dx Plugin 3.1.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system.

Code Dx Plugin 4.0.0 requires Item/Configure permission for this form validation method and ensures that only files located within the workspace can be checked.
vyper vulnerable to storage allocator overflow (GHSA-mgv8-gggw-mrg6)
Aliases: CVE-2023-30837
Published: 2023-05-05T22:22:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.8'}]}]}]

### Impact
The storage allocator does not guard against allocation overflows. This can result in vulnerabilities like the following:
```vyper
owner: public(address)
take_up_some_space: public(uint256[10])
buffer: public(uint256[max_value(uint256)])

@external
def initialize():
    self.owner = msg.sender

@external
def foo(idx: uint256, data: uint256):
    self.buffer[idx] = data
```
Per @toonvanhove, "An attacker can overwrite the owner variable by calling this contract with calldata: `0x04bc52f8 fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff` (spaces inserted for readability)
`0x04bc52f8` is the selector for `foo(uint256, uint256)`, and the last argument `fff...fff` is the new value for the owner variable."

### Patches
patched in 0bb7203b584e771b23536ba065a6efda457161bb

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_
Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls (GHSA-ph9x-4vc9-m39g)
Aliases: CVE-2023-32059
Published: 2023-05-12T20:21:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.8'}]}]}]

### Impact

Internal calls to internal functions with more than 1 default argument are compiled incorrectly. Depending on the number of arguments
provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible,
typechecking is bypassed. In the `bar()` function in the following code, `self.foo(13)` is compiled to
`self.foo(13,12)` instead of `self.foo(13,1337)`.

```vyper
@internal
def foo(a:uint256 = 12, b:uint256 = 1337):
    pass

@internal
def bar():
    self.foo(13)
```

note that at the time of publication, the ability to pass kwargs to internal functions is an undocumented feature that does not seem to be widely used.

### Patches
patched in c3e68c302aa6e1429946473769dd1232145822ac

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_
bwm-ng vulnerable to command injection (GHSA-8vw3-vxmj-h43w)
Aliases: CVE-2023-26129
Published: 2023-05-27T06:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'bwm-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.1'}]}]}]

All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwm-ng.js file. 

**Note:**

To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment.
Signature validation bypass in github.com/moov-io/signedxml (GHSA-jqvr-j2vg-gjrv)
Aliases: CVE-2023-34205
Published: 2023-05-30T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/moov-io/signedxml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

In Moov signedxml through 1.0.0, parsing the raw XML (as received) can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack (aka XSW).
Apache StreamPark LDAP Injection vulnerability (GHSA-pjfj-qvqw-3f6v)
Aliases: CVE-2022-45801
Published: 2023-05-01T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.streampark:streampark'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '2.0.0'}]}]}]

Apache StreamPark versions 1.0.0 to 2.0.0 have an LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through techniques similar to SQL Injection. LDAP injection attacks could result in the granting of permissions to unauthorized queries, and content modification inside the LDAP tree. This risk may only occur when the user logs in with ldap, and the user name and password login will not be affected, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Cross-site scripting in Liferay Portal (GHSA-53mw-69qx-q4fc)
Aliases: CVE-2023-33939
Published: 2023-05-24T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.1.0'}, {'fixed': '7.4.3.13'}]}]}]

Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a facet label.
Potential HTTP policy bypass when using header rules in Cilium (GHSA-2h44-x2wx-49f4)
Aliases: CVE-2023-30851
Published: 2023-05-22T20:33:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.16'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.9'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.2'}]}]}]

### Impact

This issue only impacts users who:

- Have a HTTP policy that applies to multiple `toEndpoints` AND
- Have an allow-all rule in place that affects only one of those endpoints

In such cases, a wildcard rule will be appended to the set of HTTP rules, which could cause bypass of HTTP policies.

### Patches

This issue has been patched in Cilium 1.11.16, 1.12.9, and 1.13.2.

### Workarounds

Rewrite HTTP rules for each endpoint separately. For example, if the initial rule looks like:

```
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:kind: echo
        - matchLabels:
            k8s:kind: example
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
```

It should be rewritten to:
 
```
  egress:
    - toEndpoints:
        - matchLabels:
            k8s:kind: echo
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
    - toEndpoints:
        - matchLabels:
            k8s:kind: example
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "GET"
```     

### Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @jrajahalme for investigating and fixing the issue.

### For more information

If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
Gin Web Framework does not properly sanitize filename parameter of Context.FileAttachment function (GHSA-2c4m-59x9-fr2g)
Aliases: CVE-2023-29401
Published: 2023-05-12T20:19:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gin-gonic/gin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.1-0.20190301021747-ccb9e902956d'}, {'fixed': '1.9.1'}]}]}]

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat&quot;;x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
Potential for cross-site scripting in PostHog-js (GHSA-8775-5hwv-wr6v)
Aliases: CVE-2023-32325
Published: 2023-05-22T20:35:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'posthog-js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.57.2'}]}]}]

### Impact

Potential for cross-site scripting in `posthog-js`.

### Patches

The problem has been patched in `posthog-js` version 1.57.2.

### Workarounds

- This isn't an issue for sites that have a Content Security Policy in place.
- Using the HTML tracking snippet on PostHog Cloud always guarantees the latest version of the library – in that case no action is required to upgrade to the patched version.

### References

We will publish details of the vulnerability in 30 days as per our [security policy](https://posthog.com/handbook/company/security#policies).
SQL injection in Liferay Portal (GHSA-g7vw-43xg-8m4h)
Aliases: CVE-2023-33945
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.3.1'}, {'fixed': '7.4.3.18'}]}]}]

SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.
MCMS vulnerable to arbitrary code execution via crafted thumbnail (GHSA-293v-5329-36wp)
Aliases: CVE-2020-22755
Published: 2023-05-08T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.mingsoft:ms-mcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.0.0'}]}]}]

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.
github.com/ipfs/go-bitswap vulnerable to DOS unbounded persistent memory leak (GHSA-q3j6-22wf-3jh9)
Published: 2023-05-11T20:39:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ipfs/go-bitswap'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.0'}]}]}]

This package has been moved to [`github.com/ipfs/boxo/bitswap`](https://pkg.go.dev/github.com/ipfs/boxo/bitswap), this vulnerability is tracked there: https://github.com/ipfs/boxo/security/advisories/GHSA-m974-xj4j-7qv5 (`CVE-2023-25568`)

### Remediation
This is a two step process:
1. Apply one of:
   - (**recommended**) upgrade from `github.com/ipfs/go-bitswap` to `github.com/ipfs/boxo/bitswap`.
   - If you are still using `github.com/ipfs/go-bitswap` and cannot upgrade to `boxo`, you can upgrade to `github.com/ipfs/go-bitswap@v0.12.0`, this will replace the `go-bitswap` implementation by stubs which points to `boxo`.
2. Open https://github.com/ipfs/boxo/security/advisories/GHSA-m974-xj4j-7qv5 and then follow `boxo`'s remediation section.

### Vulnerable symbols
- `>= v0.9.0; < v0.12.0`
  - `github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).MessageReceived`
  - `github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).NotifyNewBlocks`
  - `github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).findOrCreate`
  - `github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).PeerConnected`
- `v0.8.0`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).MessageReceived`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).NotifyNewBlocks`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).findOrCreate`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).PeerConnected`
- `< v0.8.0`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).MessageReceived`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).receiveBlocksFrom`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).findOrCreate`
  - `github.com/ipfs/go-bitswap/internal/decision.(*Engine).PeerConnected`

### Workarounds
If you are using the stubs at `github.com/ipfs/go-bitswap` and not taking advantage of the features provided by the server, refactoring your code to use the new split API will allows you to run in a client-only mode using: [`github.com/ipfs/go-bitswap/client`](https://pkg.go.dev/github.com/ipfs/go-bitswap/client).
swift-nio-http2 vulnerable to denial of service via ALTSVC or ORIGIN frames (GHSA-pgfx-g6rc-8cjv)
Aliases: CVE-2022-24668
Published: 2023-05-18T17:32:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio-http2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.19.2'}]}]}]

A program using swift-nio-http2 is vulnerable to a denial of service attack caused by a network peer sending ALTSVC or ORIGIN frames. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. It is fixed in 1.19.2 and later releases.

This vulnerability is caused by a logical error after frame parsing but before frame handling. ORIGIN and ALTSVC frames are not currently supported by swift-nio-http2, and should be ignored. However, one code path that encounters them has a deliberate trap instead. This was left behind from the original development process and was never removed.

Sending an ALTSVC or ORIGIN frame does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack.

The attack is low-effort: it takes very little resources to send one of these frames. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send these frames, so attackers require very few resources to achieve a substantial denial of service.

The attack does not have any confidentiality or integrity risks in and of itself. This is a controlled, intentional crash. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks.

The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services.

The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.
Apache Sling Commons JSON bundle vulnerable to Improper Input Validation (GHSA-8j28-34qq-gmch)
Aliases: CVE-2022-47937
Published: 2023-05-15T12:30:16Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.sling:org.apache.sling.commons.json'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.20'}]}]}]

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.
craftcms/cms vulnerable to cross site scripting in RSS feed widget (GHSA-j4mx-98hw-6rv6)
Aliases: CVE-2023-31144
Published: 2023-05-05T23:13:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.8.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.8.3'}}, {'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.4.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.4.3'}}]

A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in [this commit](https://github.com/craftcms/cms/commit/52bd161614620edbab2d24d078ca9ebca2528442).
Command injection in nevado-jms (GHSA-7gm3-mwjw-j53w)
Aliases: CVE-2023-31826
Published: 2023-05-23T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.skyscreamer:nevado-jms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.2'}]}]}]

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.
Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header (GHSA-m2qf-hxjv-5gpq)
Aliases: CVE-2023-30861
Published: 2023-05-01T19:22:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'flask'}, 'ecosystem_specific': {'affected_functions': ['flask.sessions.SecureCookieSessionInterface.save_session']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'flask'}, 'ecosystem_specific': {'affected_functions': ['flask.sessions.SecureCookieSessionInterface.save_session']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.5'}]}]}]

When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.

1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).
2. The application does not access or modify the session at any point during a request.
4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).
5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.
Server-side template injection in beetl (GHSA-m69h-4frq-vwq7)
Aliases: CVE-2023-30331
Published: 2023-05-04T03:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.ibeetl:beetl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.15.0.RELEASE'}]}]}]

An issue in the render function of beetl v3.15.0 allows attackers to execute server-side template injection (SSTI) via a crafted payload.
Jenkins AppSpider Plugin Cross-Site Request Forgery vulnerability (GHSA-vgfw-766v-7q82)
Aliases: CVE-2023-32998
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.rapid7:jenkinsci-appspider-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.16'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.0.15'}}]

A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
Jenkins Email Extension Plugin missing permission check (GHSA-6gp4-2f92-j2w5)
Aliases: CVE-2023-32979
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:email-ext'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.96.1'}]}]}]

Jenkins Email Extension Plugin 2.96 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of files in the `email-templates/` directory in the Jenkins home directory on the controller file system.

This form validation method requires the appropriate permission in Email Extension Plugin 2.96.1.
secrets-store-csi-driver discloses service account tokens in logs (GHSA-g82w-58jf-gcxx)
Aliases: CVE-2023-2878
Published: 2023-05-26T13:59:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'sigs.k8s.io/secrets-store-csi-driver'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.3'}]}]}]

A security issue was discovered in secrets-store-csi-driver where an actor with access to the driver logs could observe service account tokens.  These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions.  Tokens are only logged when [TokenRequests is configured in the CSIDriver object](https://kubernetes-csi.github.io/docs/token-requests.html) and the driver is set to run at log level 2 or greater via the -v flag.


This issue has been rated MEDIUM [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) (6.5), and assigned CVE-2023-2878


### Am I vulnerable?

You may be vulnerable if [TokenRequests is configured in the CSIDriver object](https://kubernetes-csi.github.io/docs/token-requests.html) and the driver is set to run at log level 2 or greater via the -v flag.


To check if token requests are configured, run the following command:

```bash
kubectl get csidriver secrets-store.csi.k8s.io -o jsonpath="{.spec.tokenRequests}"
```

To check if tokens are being logged, examine the secrets-store container log:

```bash
kubectl logs -l app=secrets-store-csi-driver -c secrets-store -f | grep --line-buffered "csi.storage.k8s.io/serviceAccount.tokens"
```

### Affected Versions

- secrets-store-csi-driver < 1.3.3


### How do I mitigate this vulnerability?

Prior to upgrading, this vulnerability can be mitigated by running secrets-store-csi-driver at log level 0 or 1 via the -v flag.


### Fixed Versions


- secrets-store-csi-driver >= 1.3.3


To upgrade, refer to the documentation: https://secrets-store-csi-driver.sigs.k8s.io/getting-started/upgrades.html#upgrades


### Detection


Examine cloud provider logs for unexpected token exchanges, as well as unexpected access to cloud vault secrets.


If you find evidence that this vulnerability has been exploited, please contact [security@kubernetes.io](https://groups.google.com/)
n8n Directory Traversal vulnerability (GHSA-p58x-7733-vp9m)
Aliases: CVE-2023-27562
Published: 2023-05-10T15:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'n8n'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.216.1'}]}]}]

The n8n package prior to version 0.216.1 for Node.js allows Directory Traversal.
Race Condition leading to logging errors (GHSA-hjp3-5g2q-7jww)
Published: 2023-05-01T14:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'audited'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '5.3.3'}]}]}]

In certain setups with threaded web servers, Audited's use of `Thread.current` can incorrectly attributed audits to the wrong user. 

Fixed in 5.3.3. 

In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different users than those who performed the genuine actions.

- The first issue we identified was from November 2021: https://github.com/collectiveidea/audited/issues/601 
- So the solution was implemented in the following Pull Request: https://github.com/collectiveidea/audited/pull/669 
- And the feature was published in version 5.3.3: RELEASE: https://github.com/collectiveidea/audited/pull/671
Jenkins Ansible Plugin stores and displays secrets in plain text (GHSA-38hw-368m-7jmg)
Aliases: CVE-2023-32982
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ansible'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '205.v4cb'}]}]}]

Jenkins Ansible Plugin allows the specification of extra variables that can be passed to Ansible. These extra variables are commonly used to pass secrets.

Ansible Plugin 204.v8191fd551eb_f and earlier stores these extra variables unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These extra variables can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these extra variables, increasing the potential for attackers to observe and capture them.

Ansible Plugin 205.v4cb_c48657c21 masks extra variables displayed on the configuration form, and stores them encrypted once job configurations are saved again.
Jenkins SAML Single Sign On(SSO) Plugin missing hostname validation (GHSA-6v6h-rw43-97fh)
Aliases: CVE-2023-32993
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:miniorange-saml-sp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

SAML Single Sign On(SSO) Plugin 2.1.0 performs hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.
Wings vulnerable to escape to host from installation container (GHSA-p744-4q6p-hvc2)
Aliases: CVE-2023-32080
Published: 2023-05-11T19:54:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pterodactyl/wings'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pterodactyl/wings'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.11.6'}]}]}]

### Impact

This vulnerability impacts anyone running the affected versions of Wings.  This vulnerability can be used to gain access to the host system running Wings if a user is able to modify an server's install script or the install script executes code supplied by the user (either through environment variables, or commands that execute commands based off of user data).

### Patches

This vulnerability has been resolved in version `v1.11.6` of Wings, and has been back-ported to the 1.7 release series in `v1.7.5`.

Anyone running `v1.11.x` should upgrade to `v1.11.6` and anyone running `v1.7.x` should upgrade to `v1.7.5`.

### Workarounds

Running Wings with a rootless container runtime may mitigate the severity of any attacks, however the majority of users are using container runtimes that run as root as per our documentation.

SELinux may prevent attackers from performing certain operations against the host system, however privileged containers have a lot of freedom even on systems with SELinux enabled.

TL;DR: None at this time.

### Extra details

It should be noted that this was a known attack vector, for attackers to easily exploit this attack it would require compromising an administrator account on a Panel.  However, certain eggs (the data structure that holds the install scripts that get passed to Wings) have an issue where they are unknowingly executing shell commands with escalated privileges provided by untrusted user data.
Minio console object names with RIGHT-TO-LEFT OVERRIDE unicode character can be exploited (GHSA-jv3f-7m33-qp65)
Aliases: CVE-2023-33955
Published: 2023-05-26T13:57:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/minio/console'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.28.0'}]}]}]

### Impact
Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename.

### Reported-By
Thanks to the report from Mio Li [wulilixi1@gmail.com](mailto:wulilixi1@gmail.com)

### Patches
```
commit 17e791afb90c9ad27c65f63c6be14f2f6a3a9d60
Author: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>
Date:   Tue May 23 08:47:12 2023 -0700

    Replace RIGHT-TO-LEFT OVERRIDE unicode (#2828)
    
    Signed-off-by: Daniel Valdivia <18384552+dvaldivia@users.noreply.github.com>
```

### Workarounds
Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions.  Avoid using RTLO characters in your filenames.
Any file can be included with the pymdown-snippets extension (GHSA-jh85-wwv9-24hv)
Aliases: CVE-2023-32309
Published: 2023-05-15T20:50:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pymdown-extensions'}, 'ecosystem_specific': {'affected_functions': ['pymdownx.snippets.SnippetPreprocessor', 'pymdownx.snippets.SnippetPreprocessor.get_snippet_path', 'pymdownx.snippets.SnippetExtension']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5'}, {'fixed': '10.0'}]}]}]

### Summary

Arbitrary file read when using include file syntax.

### Details

By using the syntax `--8<--"/etc/passwd"` or `--8<--"/proc/self/environ"` the content of these files will be rendered in the generated documentation. Additionally, a path relative to a specified, allowed base path can also be used to render the content of a file outside the specified base paths: `--8<-- "../../../../etc/passwd"`.

Within the Snippets extension, there exists a `base_path` option but the implementation is vulnerable to Directory Traversal.
The vulnerable section exists in `get_snippet_path(self, path)` lines 155 to 174 in snippets.py.

```
base = "docs"
path = "/etc/passwd"
filename = os.path.join(base,path) # Filename is now /etc/passwd
```

### PoC

```py
import markdown

payload = "--8<-- \"/etc/passwd\""
html = markdown.markdown(payload, extensions=['pymdownx.snippets'])

print(html)
```

### Impact

Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. 

It is never recommended to use Snippets to process user-facing, dynamic content. It is designed to process known content on the backend under the control of the host, but if someone were to accidentally enable it for user-facing content, undesired information could be exposed.

### Suggestion

Specified snippets should be restricted to the configured, specified base paths as a safe default. Allowing relative or absolute paths that escape the specified base paths would need to be behind a feature switch that must be opt-in and would be at the developer's own risk.
Jenkins File Parameter Plugin arbitrary file write vulnerability (GHSA-46f2-x6h2-x9hx)
Aliases: CVE-2023-32986
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:file-parameters'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '285.287.v4b'}]}]}]

Jenkins File Parameter Plugin 285.v757c5b_67a_c25 and earlier does not restrict the name (and resulting uploaded file name) of Stashed File Parameters.

This allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

File Parameter Plugin 285.287.v4b_7b_29d3469d restricts the name (and resulting uploaded file name) of Stashed File Parameters.
Liferay portal has unauthorized access to object definition via search  (GHSA-769c-p92r-xgxj)
Aliases: CVE-2023-33947
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.3.4'}, {'fixed': '7.4.3.61'}]}]}]

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.60, and Liferay DXP 7.4 before update 61 does not segment object definition by virtual instance in search which allows remote authenticated users in one virtual instance to view object definition from a second virtual instance by searching for the object definition.
RosarioSIS Stores Sensitive Data in a Mechanism without Access Control (GHSA-36cm-h8gv-mg97)
Aliases: CVE-2023-2665
Published: 2023-05-19T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'francoisjacquet/rosariosis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '11.0'}]}]}]

RosarioSIS prior to 11.0 allows anyone, regardless of authentication status, to download and view file attachments under the `salaries` module. In addition, the file names contain a date in a `YYYY-MM-DD` format and a random six-string digit, making enumerating file names with automated tools relatively easy. This could allow an attacker to gain access to sensitive salary information. The patch for version 11.0 adds microseconds to filenames to make them harder to guess.
engine.io Uncaught Exception vulnerability (GHSA-q9mw-68c2-j6m5)
Aliases: CVE-2023-31125
Published: 2023-05-03T21:56:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'engine.io'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '6.4.2'}]}]}]

### Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

```
TypeError: Cannot read properties of undefined (reading 'handlesUpgrades')
    at Server.onWebSocket (build/server.js:515:67)
```

This impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).

### Patches

A fix has been released today (2023/05/02): [6.4.2](https://github.com/socketio/engine.io/releases/tag/6.4.2)

This bug was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted.

For `socket.io` users:

| Version range               | `engine.io` version | Needs minor update?                                                                                    |
|-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------|
| `socket.io@4.6.x`           | `~6.4.0`            | `npm audit fix` should be sufficient                                                                   |
| `socket.io@4.5.x`           | `~6.2.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |
| `socket.io@4.4.x`           | `~6.1.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |
| `socket.io@4.3.x`           | `~6.0.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |
| `socket.io@4.2.x`           | `~5.2.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |
| `socket.io@4.1.x`           | `~5.1.1`            | Please upgrade to `socket.io@4.6.x`                                                                    |
| `socket.io@4.0.x`           | `~5.0.0`            | Not impacted |
| `socket.io@3.1.x`           | `~4.1.0`            | Not impacted |
| `socket.io@3.0.x`           | `~4.0.0`            | Not impacted |
| `socket.io@2.5.0`           | `~3.6.0`            | Not impacted |
| `socket.io@2.4.x` and below | `~3.5.0`            | Not impacted |

### Workarounds

There is no known workaround except upgrading to a safe version.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)

Thanks to Thomas Rinsma from Codean for the responsible disclosure.
Jenkins AppSpider Plugin missing permission check (GHSA-2c5c-fhr8-pwh9)
Aliases: CVE-2023-32999
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.rapid7:jenkinsci-appspider-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.16'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.0.15'}}]

Jenkins AppSpider Plugin 1.0.15 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

AppSpider Plugin 1.0.16 requires POST requests and Overall/Administer permission for the affected form validation method.
org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability (GHSA-6gvj-8vc5-8v3j)
Aliases: CVE-2023-32068
Published: 2023-05-15T20:52:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.10.4'}]}]}]

### Impact

It's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. 

### Patches

The issue has now been patched against all patterns that we know about for performing redirect. It also performs a real URI parsing that should protect in most cases. This has been patched in XWiki 14.10.4 and 15.0. 

### Workarounds

The only workaround is to upgrade XWiki.

### References

  * JIRA ticket: https://jira.xwiki.org/browse/XWIKI-20096
  * JIRA ticket about the improvment actually fixing the vulnerability: https://jira.xwiki.org/browse/XWIKI-20549
  * Previous advisory about open redirect: https://github.com/advisories/GHSA-jp55-vvmf-63mv

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

## Attribution 

Thanks to Paulos Mesfin who originally reported the vulnerability.
WWBN/AVideo stored XSS vulnerability leads to takeover of any user's account, including admin's account (GHSA-xr9h-p2rc-rpqm)
Aliases: CVE-2023-30860
Published: 2023-05-01T22:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wwbn/avideo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.4'}]}]}]

In AVideo, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but I found out that it did not properly sanitize the malicious characters when creating a Meeting Room. This leads the attacker to put malicious scripts.

Impact:

Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts without user interaction.

Step to Reproduce:

1. As normal USER go to Meet -> Schedule

https://demo.avideo.com/plugin/Meet/

2. In "Meet topic" field put XSS payload

Example: "><img src=x onerror=alert('Pawned+by+Gonz')>

3. Then click Save

4. Now as ADMIN go to Meet -> Schedule -> Upcoming

https://demo.avideo.com/plugin/Meet/

5. Then the XSS payload that normal USER created will be executed



Video POC: https://youtu.be/Nke0Bmv5F-o
libheif vulnerable to segmentation fault via floating point exception (GHSA-22fx-6r9m-r8h9)
Aliases: CVE-2023-29659
Published: 2023-05-05T18:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/strukturag/libheif'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15.2'}]}]}]

A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.
Missing "--allow-net" permission check for built-in Node modules (GHSA-vc52-gwm3-8v2f)
Aliases: CVE-2023-33966
Published: 2023-05-31T23:39:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'deno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.34.0'}, {'fixed': '1.34.1'}]}], 'versions': ['1.34.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'deno_runtime'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.114.0'}, {'fixed': '0.115.0'}]}], 'versions': ['0.114.0']}]

### Impact

Outbound HTTP requests made using the built-in "node:http" or "node:https" modules are incorrectly not checked against the network permission allow list (`--allow-net`). Dependencies relying on these built-in modules are subject to the vulnerability too.

Users of Deno versions prior to 1.34.0 are unaffected. Deno Deploy users are unaffected.

### Patches

This problem has been patched in Deno v1.34.1 and all users are recommended to update to this version.

### Workarounds

No workaround is available for this issue.
Improper handling of NTS cookie length that could crash the ntpd-rs server (GHSA-qwhm-h7v3-mrjx)
Aliases: CVE-2023-33192
Published: 2023-05-25T17:01:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ntpd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.0'}, {'fixed': '0.3.3'}]}]}]

### Impact
ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets.

ntpd-rs running purely as an ntp client is not affected.

### Patches
The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3

### Workarounds
ntpd-rs running purely as an ntp client is not affected. By default, ntpd-rs packages are not configured to run as a server.

For machines where serving the time is required, there is no known workaround. Users are recommended to upgrade ntpd-rs as soon as possible.

### References
https://github.com/pendulum-project/ntpd-rs/pull/752

We would like to thank @mlichvar for identifying this issue