aswin1906/github-advisory-2023 huggingface dataset:
XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution (GHSA-8xhr-x3v8-rghj)
Aliases: CVE-2023-40573
Published: 2023-08-23T20:41:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-scheduler-api'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.10.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.xpn.xwiki.platform.plugins:xwiki-plugin-scheduler'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-scheduler-api'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.4-rc-1'}]}]}]

### Impact

XWiki supports scheduled jobs that contain Groovy scripts. Currently, the job checks the content author of the job for programming right. However, modifying or adding a job script to a document doesn't modify the content author. Together with a CSRF vulnerability in the job scheduler, this can be exploited for remote code execution by an attacker with edit right on the wiki.

For successful exploitation, the needs to have edit right on a document whose content has last been changed by a user with programming right. This could be the user profile for users created by admins. In this document, the attacker can create an object of class `XWiki.SchedulerJobClass` using the object editor. By setting job class to `com.xpn.xwiki.plugin.scheduler.GroovyJob`, cron expression to `0 0/5 * * * ?` and job script to `services.logging.getLogger("foo").error("Job content executed")`, the attacker can create a job. Now this job just needs to be triggered or scheduled. This can be achieved by embedding an image with the following XWiki syntax in any document that is visited by an admin: `[[image:path:/xwiki/bin/view/Scheduler/?do=trigger&which=Attacker.Document]]` where `Attacker.Document` is the document that has been prepared by the attacker. If the attack is successful, an error log entry with "Job content executed" will be produced.

### Patches
This vulnerability has been patched in XWiki 14.10.9 and 15.4RC1.

### Workarounds
There is no workaround.

### References
* https://jira.xwiki.org/browse/XWIKI-20852
* https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662
Heap-based buffer overflow in ZBar (GHSA-mhp6-jvpx-2p4m)
Aliases: CVE-2023-40889
Published: 2023-08-29T18:31:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'zbar'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.23.90'}]}]}]

A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90. Specially crafted QR codes may lead to information disclosure and/or arbitrary code execution. To trigger this vulnerability, an attacker can digitally input the malicious QR code, or prepare it to be physically scanned by the vulnerable scanner.
XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action (GHSA-4f8m-7h83-9f6m)
Aliases: CVE-2023-40572
Published: 2023-08-23T20:37:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2-milestone-3'}, {'fixed': '14.10.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.4-rc-1'}]}]}]

### Impact
The create action is vulnerable to a CSRF attack, allowing script and thus remote code execution when targeting a user with script/programming right, thus compromising the confidentiality, integrity and availability of the whole XWiki installation. To reproduce, the XWiki syntax `[[image:path:/xwiki/bin/create/Foo/WebHome?template=&parent=Main.WebHome&title=$services.logging.getLogger(%22foo%22).error(%22Script%20executed!%22)]]` can be added to any place that supports XWiki syntax like a comment. When a user with script right views this image and a log message `ERROR foo - Script executed!` appears in the log, the XWiki installation is vulnerable.

### Patches
This has been patched in XWiki 14.10.9 and 15.4RC1 by requiring a CSRF token for the actual page creation.

### Workarounds
There are no known workarounds.

### References
* https://jira.xwiki.org/browse/XWIKI-20849
* https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7
HashiCorp Vault and Vault Enterprise vulnerable to user enumeration (GHSA-9v3w-w2jh-4hff)
Aliases: CVE-2023-3462
Published: 2023-08-01T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.13.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.14.0'}, {'fixed': '1.14.1'}]}], 'versions': ['1.14.0']}]

HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP server. This vulnerability is fixed in Vault 1.14.1 and 1.13.5.
Badaso vulnerable to cross-site scripting (GHSA-7422-7rq6-j4qv)
Aliases: CVE-2023-38970
Published: 2023-08-31T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'uasoft-indonesia/badaso'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.9.7'}]}]}]

Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function.
FaucetSDN Ryu Denial of Service Vulnerability (GHSA-4987-5p3p-9r27)
Aliases: CVE-2020-35139
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ryu'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.34'}]}]}]

An issue was discovered in `OFPBundleCtrlMsg` in `parser.py` in FaucetSDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) (infinite loop).
Apache Airflow Session Fixation vulnerability (GHSA-pm87-24wq-r8w9)
Aliases: CVE-2023-40273
Published: 2023-08-23T18:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.0'}]}]}]

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that).

With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour.

Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.
Apache NiFi Insufficient Property Validation vulnerability (GHSA-23qf-3jf9-h3q9)
Aliases: CVE-2023-40037
Published: 2023-08-19T00:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-dbcp-base'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.21.0'}, {'fixed': '1.23.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-jms-processors'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.21.0'}, {'fixed': '1.23.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-dbcp-service-api'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.21.0'}, {'fixed': '1.23.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-dbcp-service-bundle'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.21.0'}, {'fixed': '1.23.1'}]}]}]

Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection URL validation and introduces validation for additional related properties. Upgrading to Apache NiFi 1.23.1 is the recommended mitigation.
LangChain vulnerable to arbitrary code execution (GHSA-prgp-w7vf-ch62)
Aliases: CVE-2023-39659
Published: 2023-08-15T18:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.232'}]}]}]

An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
Jenkins Fortify Plugin missing permission check (GHSA-4xmf-344q-m4cc)
Aliases: CVE-2023-4302
Published: 2023-08-22T00:31:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:fortify'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '22.2.39'}]}], 'database_specific': {'last_known_affected_version_range': '<= 22.1.38'}}]

Jenkins Fortify Plugin 22.1.38 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Fortify Plugin 22.2.39 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Svelecte item names vulnerable to execution of arbitrary JavaScript (GHSA-7h45-grc5-89wq)
Aliases: CVE-2023-38687
Published: 2023-08-14T21:14:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'svelecte'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.16.3'}]}]}]

### Summary

Svelecte item names are rendered as raw HTML with no escaping. This allows the injection of arbitrary HTML into the Svelecte dropdown. This can be exploited to execute arbitrary JavaScript whenever a Svelecte dropdown is opened.

### Details

Item names given to Svelecte appear to be directly rendered as HTML by the default item renderer. This means that any HTML tags in the name are rendered as HTML elements not as text.

Note that the custom item renderer shown in https://mskocik.github.io/svelecte/#item-rendering is also vulnerable to the same exploit.

To prevent this all special HTML characters in item names should be escaped (for example using `document.createTextNode()`).

### PoC
```svelte
<script>
    import Svelecte from 'svelecte';
    
    const list = [
        { id: 1, name: `Item 1` },
        { id: 2, name: `Item 2<img style="display:none;" src=1 onerror="alert('JavaScript executed!');"/>` },
        { id: 3, name: 'Item 3'}
    ];
</script>
    
<Svelecte options={list}></Svelecte>
```

This code snippet demonstrates how the vulnerability can be used to execute arbitrary JavaScript without the user's knowledge when the Svelecte dropdown is opened (note that visually item 2 appears identical to other items).
In this case the script is hardcoded, but in practice the real danger is that some applications may use Svelecte with items that are created by users or come from low-trust sources where someone else could add a malicious script to the item name.

### Impact

Any site that uses Svelecte with dynamically created items either from an external source or from user-created content could be vulnerable to an XSS attack (execution of untrusted JavaScript), clickjacking or any other attack that can be performed with arbitrary HTML injection.
The actual impact of this vulnerability for a specific application depends on how trustworthy the sources that provide Svelecte items are and the steps that the application has taken to mitigate XSS attacks. XSS attacks using this vulnerability are mostly mitigated by a Content Security Policy that blocks inline JavaScript.
RaspAP Command Injection vulnerability (GHSA-7r88-wjhj-jr8m)
Aliases: CVE-2022-39987
Published: 2023-08-01T15:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'billz/raspap-webgui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'last_affected': '2.9.2'}]}]}]

A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the `entity` POST parameters in `/ajax/networking/get_wgkey.php`.
Woodpecker does not validate webhook before changing any data (GHSA-4gcf-5m39-98mc)
Aliases: CVE-2023-40034
Published: 2023-08-16T21:02:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/woodpecker-ci/woodpecker'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.2'}]}]}]

### Impact
An attacker can post malformed webhook data which leads to an update of the repository data that can e.g. allow the takeover of a repository.
This is only critical if the CI is configured for public usage and connected to a forge witch is also in public usage.

### Patches
Please use either next or the latest v1.0 e.g. v1.0.2

### Workarounds
Secure the CI system by making it inaccessible to untrusted entities, for example, by placing it behind a firewall.

### References
Fix: https://github.com/woodpecker-ci/woodpecker/pull/2221
Backport: https://github.com/woodpecker-ci/woodpecker/pull/2222
protocol-http1 HTTP Request/Response Smuggling vulnerability (GHSA-6jwc-qr2q-7xwj)
Aliases: CVE-2023-38697
Published: 2023-08-03T16:36:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'protocol-http1'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.15.1'}]}]}]

### Impact

[RFC 9112 Section 7.1](https://www.rfc-editor.org/rfc/rfc9112#name-chunked-transfer-coding) defined the format of chunk size, chunk data and chunk extension (detailed ABNF is in Appendix section).

In summary:

- The value of Content-Length header should be a string of 0-9 digits.
- The chunk size should be a string of hex digits and should split from chunk data using CRLF.
- The chunk extension shouldn't contain any invisible character.

However, we found that Falcon has following behaviors while disobey the corresponding RFCs.

- Falcon accepts Content-Length header values that have "+" prefix.
- Falcon accepts Content-Length header values that written in hexadecimal with "0x" prefix.
- Falcon accepts "0x" and "+" prefixed chunk size.
- Falcon accepts LF in chunk extension.

This behavior can lead to desync when forwarding through multiple HTTP parsers, potentially results in HTTP request smuggling and firewall bypassing. Note that while these issues were reproduced in Falcon (the server), the issue is with `protocol-http1` which implements the HTTP/1 protocol parser. We have not yet been advised of any real world exploit or practical attack.

### Patches

Fixed in `protocol-http1` v0.15.1+.

### Workarounds

None.

### References

https://github.com/socketry/protocol-http1/pull/20
OpenNMS vulnerable to Cross-site Scripting (GHSA-chgr-j2p9-jjh8)
Aliases: CVE-2023-40312
Published: 2023-08-14T18:32:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-webapp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '31.0.8'}, {'fixed': '32.0.2'}]}]}]

Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
Username enumeration attack in goauthentik (GHSA-vmf9-6pcv-xr87)
Aliases: CVE-2023-39522
Published: 2023-08-29T23:34:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@goauthentik/api'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2023.6.0'}, {'fixed': '2023.6.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@goauthentik/api'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2023.5.6'}]}]}]

## Summary
Using a recovery flow with an identification stage an attacker is able to determine if a username exists.

## Impact
Only setups configured with a recovery flow are impacted by this. Anyone with a user account on a system with the recovery flow described above is susceptible to having their username/email revealed as existing.

## Details

An attacker can easily enumerate and check users' existence using the recovery flow, as a clear message is shown when a user doesn't exist. Depending on configuration this can either be done by username, email, or both.

The invalid and valid usernames should both show the same message and always send an email. Article for reference here: https://postmarkapp.com/guides/password-reset-email-best-practices#how-to-make-sure-your-password-reset-emails-are-secure

### For more information

If you have any questions or comments about this advisory:

-   Email us at [security@goauthentik.io](mailto:security@goauthentik.io)
Cockpit Cross-site Scripting vulnerability (GHSA-rmgx-3w4r-xcfp)
Aliases: CVE-2023-4432
Published: 2023-08-19T03:32:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6.3'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 2a93d391fbd2dd9e730f65d43b29beb65903d195 and anticipated to be part of version 2.6.4.
Apache Batik information disclosure vulnerability (GHSA-2474-2566-3qxp)
Aliases: CVE-2022-44730
Published: 2023-08-22T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.xmlgraphics:batik-script'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0'}, {'fixed': '1.17'}]}]}]

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
LangChain vulnerable to arbitrary code execution (GHSA-92j5-3459-qgp4)
Aliases: CVE-2023-38896
Published: 2023-08-15T18:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.236'}]}]}]

An issue in Harrison Chase langchain before version 0.0.236 and before allows a remote attacker to execute arbitrary code via the `from_math_prompt` and `from_colored_object_prompt` functions.
Nuclei Path Traversal vulnerability (GHSA-2xx4-jj5v-6mff)
Aliases: CVE-2023-37896
Published: 2023-08-04T17:27:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/projectdiscovery/nuclei/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.9.9'}]}]}]

## Overview

We have identified and addressed a security issue in the Nuclei project that affected users utilizing Nuclei as **Go code (SDK)** running **custom templates**. This issue did not affect CLI users. The problem was related to sanitization issues with payloads loading in `sandbox` mode.

## Details

In the previous versions, there was a potential risk with payloads loading in sandbox mode. The issue occurred due to relative paths not being converted to absolute paths before doing the check for `sandbox` flag allowing arbitrary files to be read on the filesystem in certain cases when using Nuclei from `Go` SDK implementation. 

This issue has been fixed in the latest release, v2.9.9. We have also enabled sandbox by default for filesystem loading. This can be optionally disabled if required.

The `-sandbox` option has been **deprecated** and is now divided into two new options: `-lfa` (allow local file access) which is enabled by default and `-lna` (restrict local network access) which can be enabled by users optionally. The `-lfa` allows file (payload) access anywhere on the system (disabling sandbox effectively), and `-lna` blocks connections to the local/private network.

## Affected Versions

This issue affected all versions of Nuclei prior to v2.9.9.

## Patches

We recommend all users upgrade to the latest version, [v2.9.9](https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.9), which includes the security fix.

### References

- [patch](https://github.com/projectdiscovery/nuclei/pull/3927)
- [releases](https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.9)

## Acknowledgments

We would like to thank **keomutchoiboi** who reported this issue to us via our security email, [security@projectdiscovery.io](mailto:security@projectdiscovery.io). We appreciate the responsible disclosure of this issue.
Actions expression injection in `filter-test-configs` (`GHSL-2023-181`) (GHSA-hw6r-g8gj-2987)
Published: 2023-08-30T20:47:13Z
Affected: [{'package': {'ecosystem': 'GitHub Actions', 'name': 'https://github.com/pytorch/pytorch/.github/actions/filter-test-configs'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}]}], 'database_specific': {'last_known_affected_version_range': '< 2.0.1'}}]

The `pytorch/pytorch` `filter-test-configs` workflow is vulnerable to an expression injection in Actions, allowing an attacker to potentially leak secrets and alter the repository using the workflow.

### Details

The [`filter-test-configs`](https://github.com/pytorch/pytorch/blob/ec26947c586dd323d741da80008403664c533f65/.github/actions/filter-test-configs/action.yml) workflow is using the raw `github.event.workflow_run.head_branch` value inside the `filter` step:

```yaml
- name: Select all requested test configurations
  shell: bash
  env:
    GITHUB_TOKEN: ${{ inputs.github-token }}
    JOB_NAME: ${{ steps.get-job-name.outputs.job-name }}
  id: filter
  run: |
    ...
    python3 "${GITHUB_ACTION_PATH}/../../scripts/filter_test_configs.py" \
      ...
      --branch "${{ github.event.workflow_run.head_branch }}"
```

In the event of a repository using `filter-test-configs` in a `pull_request_target`-triggered workflow, an attacker could use a malicious branch name to gain command execution in the step and potentially leak secrets.

```yml
name: Example

on: pull_request_target

jobs:
  example:
    runs-on: ubuntu-latest
    steps:
      - name: Filter
        uses: pytorch/pytorch/.github/actions/filter-test-configs@v2
```

#### Impact

This issue may lead to stealing workflow secrets.

#### Remediation

1. Use an intermediate environment variable for potentially attacker-controlled values such as `github.event.workflow_run.head_branch`:
```yaml
- name: Select all requested test configurations
  shell: bash
  env:
    GITHUB_TOKEN: ${{ inputs.github-token }}
    JOB_NAME: ${{ steps.get-job-name.outputs.job-name }}
    HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
  id: filter
  run: |
    ...
    python3 "${GITHUB_ACTION_PATH}/../../scripts/filter_test_configs.py" \
      ...
      --branch "$HEAD_BRANCH"
```

#### Resources

* [CodeQL for JavaScript - Expression injection in Actions](https://codeql.github.com/codeql-query-help/javascript/js-actions-command-injection/)
* [Keeping your GitHub Actions and workflows secure Part 2: Untrusted input](https://securitylab.github.com/research/github-actions-untrusted-input/)
* [Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)
MindsDB can be made to not verify SSL certificates (GHSA-8hx6-qv6f-xgcw)
Aliases: CVE-2023-38699
Published: 2023-08-01T19:55:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'MindsDB'}, 'ecosystem_specific': {'affected_functions': ['mindsdb.integrations.handlers.dremio_handler.dremio_handler.DremioHandler.connect']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.7.4.0'}]}]}]

### Summary
MindsDB's AI Virtual Database allows developers to connect any AI/ML model to any datasource. Prior to version 23.7.4.0, a call to requests with `verify=False` disables SSL certificate checks. This rule enforces always verifying SSL certificates for methods in the Requests library. In version 23.7.4.0, certificates are validated by default, which is the desired behavior

Encryption in general is typically critical to the security of many applications. Using TLS can significantly increase security by guaranteeing the identity of the party you are communicating with. This is accomplished by one or both parties presenting trusted certificates during the connection initialization phase of TLS.

It is important to note that modules such as httplib within the Python standard library did not verify certificate chains until it was fixed in 2.7.9 release.

### Details
Severity: Critical
.eth registrar controller can shorten the duration of registered names (GHSA-rrxv-q8m4-wch3)
Aliases: CVE-2023-38698
Published: 2023-08-01T19:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@ensdomains/ens-contracts'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.22'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.0.21'}}]

### Description
According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled controller may be able to reduce the expiration time of existing domains due to an integer overflow in the renew function.

The vulnerability resides in the following GitHub repository: https://github.com/ensdomains/ens-contracts/blob/master/contracts/ethregistrar/BaseRegistrarImplementation.sol#L171 

The vulnerable line of code is:
```js
require(
            expiries[id] + duration + GRACE_PERIOD > duration + GRACE_PERIOD
        ); // Prevent future overflow
```

In this code snippet, the `duration` variable is user-supplied, making it possible to provide a value that would cause an overflow on both sides of the '>' expression, ultimately rendering the condition true. Specifically, when the duration is set to `2^256 - GRACE_PERIOD`, the subsequent line `expiries[id] += duration;` also experiences an overflow, as `expiries[id]` is greater than `GRACE_PERIOD`. This results in the reduction of `expiries[id]` by `GRACE_PERIOD`. By repeatedly calling the renew function, an attacker could potentially force the expiration of an ENS record.

You can find the PoC included in the attached document. To execute the test, please use the following command:
```
forge test -vvv --match-contract RegistrarExploit --fork-url <alchemy_url>
```

Replace `<alchemy_url>` with your Alchemy API URL. This command will run the Foundry test file and demonstrate the potential vulnerability.

### Impact
If successfully exploited, this vulnerability would enable attackers to force the expiration of any ENS record, ultimately allowing them to claim the affected domains for themselves.

Currently, it would require a malicious DAO to exploit it. Nevertheless, any vulnerability present in the controllers could potentially render this issue exploitable in the future.

An additional concern is the possibility of renewal discounts. Should ENS decide to implement a system that offers unlimited .eth domains for a fixed fee in the future, the vulnerability could become exploitable by any user due to the reduced attack cost.

### Patches
A mitigation is being developed.

### Workarounds
As long as registration cost remains linear or superlinear based on registration duration, or limited to a reasonable maximum (eg, 1 million years), this vulnerability could only be exploited by a malicious DAO. The interim workaround is thus to take no action.
mail-internals use-after-free vulnerability in `vec_insert_bytes` (GHSA-rcx8-48pc-v9q8)
Published: 2023-08-24T22:20:47Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'mail-internals'}, 'ecosystem_specific': {'affected_functions': ['mail_internals::utils::vec_insert_bytes']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'last_affected': '0.2.3'}]}]}]

Incorrect reallocation logic in the function [`vec_insert_bytes`](https://docs.rs/mail-internals/0.2.3/mail_internals/utils/fn.vec_insert_bytes.html) causes a use-after-free.

This function does not have to be called directly to trigger the vulnerability because many methods on [`EncodingWriter`](https://docs.rs/mail-internals/0.2.3/mail_internals/encoder/struct.EncodingWriter.html) call this function internally.

The mail-\* suite is unmaintained and the upstream sources have been actively vandalised.
A fixed `mail-internals-ng` (and `mail-headers-ng` and `mail-core-ng`) crate has been published which fixes this, and a dependency on another unsound crate.
Gitea erroneous repo clones (GHSA-8j3v-68w3-3848)
Aliases: CVE-2022-38795
Published: 2023-08-07T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'code.gitea.io/gitea'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.17.2'}]}]}]

In Gitea through 1.17.1, repo cloning can occur in the migration function.
Jenkins Blue Ocean Plugin cross-site request forgery vulnerability (GHSA-g4pq-p927-7pgg)
Aliases: CVE-2023-40341
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.blueocean:blueocean'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.27.5.1'}]}]}]

Jenkins Blue Ocean Plugin 1.27.5 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to connect to an attacker-specified URL, capturing GitHub credentials associated with an attacker-specified job.

This issue is due to an incomplete fix of SECURITY-2502.

Blue Ocean Plugin 1.27.5.1 uses the configured SCM URL, instead of a user-specified URL provided as a parameter to the HTTP endpoint.
Daylight Studio FUEL-CMS SQLi Vulnerability (GHSA-7rvp-xqj7-rxf2)
Aliases: CVE-2020-24950
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'codeigniter/framework'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.10'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.4.9'}}]

SQL Injection vulnerability in file `Base_module_model.php` in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the `col` parameter to function `list_items`.
Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users (GHSA-7ch3-7pp7-7cpq)
Aliases: CVE-2023-40570
Published: 2023-08-22T18:06:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'datasette'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0a0'}, {'fixed': '1.0a4'}]}]}]

### Impact

This bug affects Datasette instances running a Datasette 1.0 alpha - 1.0a0, 1.0a1, 1.0a2 or 1.0a3 - in an online accessible location but with authentication enabled using a plugin such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords).

The `/-/api` API explorer endpoint could reveal the names of both databases and tables - but not their contents - to an unauthenticated user.

### Patches

Datasette 1.0a4 has a fix for this issue.

### Workarounds

To work around this issue, block all traffic to the `/-/api` endpoint. This can be done with a proxy such as Apache or NGINX, or by installing the [datasette-block](https://datasette.io/plugins/datasette-block) plugin and adding the following configuration to your `metadata.json` or `metadata.yml` file:

```json
{
    "plugins": {
        "datasette-block": {
            "prefixes": ["/-/api"]
        }
    }
}
```
This will block access to the API explorer but will still allow access to the Datasette read or write JSON APIs, as those use different URL patterns within the Datasette `/database` hierarchy.
Jenkins NodeJS Plugin improper credential masking vulnerability (GHSA-36fg-whr2-g999)
Aliases: CVE-2023-40340
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:nodejs'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.0.1'}]}]}]

Jenkins NodeJS Plugin integrates with Config File Provider Plugin to specify custom NPM settings, including credentials for authentication, in a Npm config file.

NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file in Pipeline build logs.

NodeJS Plugin 1.6.0.1 masks credentials specified in the Npm config file in Pipeline build logs.
Puma HTTP Request/Response Smuggling vulnerability (GHSA-68xg-gqqm-vgj8)
Aliases: CVE-2023-40175
Published: 2023-08-18T21:50:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'puma'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.6.7'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'puma'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.3.1'}]}]}]

### Impact
Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

* Incorrect parsing of trailing fields in chunked transfer encoding bodies
* Parsing of blank/zero-length Content-Length headers

### Patches
The vulnerability has been fixed in 6.3.1 and 5.6.7.

### Workarounds
No known workarounds.

### References
[HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)

### For more information
If you have any questions or comments about this advisory:

Open an issue in [Puma](https://github.com/puma/puma)
See our [security policy](https://github.com/puma/puma/security/policy)
Jenkins Docker Swarm Plugin stored cross-site scripting vulnerability (GHSA-v9rw-hjr3-426h)
Aliases: CVE-2023-40350
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:docker-swarm'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.11'}]}]}]

Jenkins Docker Swarm Plugin processes Docker responses to generate the Docker Swarm Dashboard view.

Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control responses from Docker.

As of publication of this advisory, there is no fix.
Apache Airflow vulnerable arbitrary code execution via Spark server (GHSA-8q28-pw9g-w82c)
Aliases: CVE-2023-40195
Published: 2023-08-28T09:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-spark'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}]}], 'database_specific': {'last_known_affected_version_range': '< 4.1.3'}}]

Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.

When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users.

To view the warning in the docs please visit  https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html
external-svg-loader Cross-site Scripting vulnerability (GHSA-xc2r-jf2x-gjr8)
Aliases: CVE-2023-40013
Published: 2023-08-14T21:32:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'external-svg-loader'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.9'}]}]}]

### Summary
According to the [docs](https://github.com/shubhamjain/svg-loader/tree/main#2-enable-javascript), svg-loader will strip all JS code before injecting the SVG file for security reasons but the input sanitization logic is not sufficient and can be trivially bypassed. This allows an attacker to craft a malicious SVG which can result in XSS. 

### Details
When trying to sanitize the svg the lib [removes event attributes](https://github.com/shubhamjain/svg-loader/blob/main/svg-loader.js#L125-L128) such as `onmouseover`, `onclick` but the list of events is not exhaustive. Here's a list of events not removed by svg-loader. 
`onafterscriptexecute, onbeforecopy, onbeforecut, onbeforescriptexecute, onbeforetoggle, onbegin, onbounce, onend, onfinish, onfocusin, onfocusout, onmousewheel, onpointerrawupdate, onrepeat, onsearch, onshow, onstart, ontoggle(popover), ontouchend, ontouchmove, ontouchstart`
As you can see in the POC we can use `onbegin` in `animate` tag to execute JS code without needing to add `data-js="enabled"`.

### PoC

```html
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <animate onbegin=alert(1) attributeName=x dur=1s>
</svg>

```

```html
<html>
    <head>
        <script src="./dist/svg-loader.js" type="text/javascript"></script>
    </head>
    <body>
        <svg data-src="data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIGJhc2VQcm9maWxlPSJmdWxsIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPgogIDxwb2x5Z29uIGlkPSJ0cmlhbmdsZSIgcG9pbnRzPSIwLDAgMCw1MCA1MCwwIiBmaWxsPSIjMDA5OTAwIiBzdHJva2U9IiMwMDQ0MDAiLz4KICA8YW5pbWF0ZSBvbmJlZ2luPWFsZXJ0KDEpIGF0dHJpYnV0ZU5hbWU9eCBkdXI9MXM+Cjwvc3ZnPgo="></svg>
    </body>
</html>

```

### Impact
Any website which uses external-svg-loader and allows its users to provide svg src, upload svg files would be susceptible to stored XSS attack.
OpenZeppelin Contracts vulnerable to Improper Escaping of Output (GHSA-g4vp-m682-qqmp)
Aliases: CVE-2023-40014
Published: 2023-08-11T19:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.9.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts-upgradeable'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.9.3'}]}]}]

### Impact

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 4.0.0 and prior to version 4.9.3, contracts using `ERC2771Context` along with a custom trusted forwarder may see `_msgSender` return `address(0)` in calls that originate from the forwarder with calldata shorter than 20 bytes. This combination of circumstances does not appear to be common, in particular it is not the case for `MinimalForwarder` from OpenZeppelin Contracts, or any deployed forwarder the team is aware of, given that the signer address is appended to all calls that originate from these forwarders.

### Patches

The problem has been patched in v4.9.3.
wger Workout Manager Cross-Site Request Forgery vulnerability (GHSA-wrw3-qmqw-4x9w)
Aliases: CVE-2023-38759
Published: 2023-08-08T18:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'wger'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.0a3'}]}]}]

Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the `user-management` feature in the `gym/views/gym.py`, `templates/gym/reset_user_password.html`, `templates/user/overview.html`, `core/views/user.py`, and `templates/user/preferences.html`, `core/forms.py` components.
OpenFGA Authorization Bypass (GHSA-jcf2-mxr2-gmqp)
Aliases: CVE-2023-40579
Published: 2023-08-25T19:45:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/openfga/openfga'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.1'}]}]}]

## Overview
Some end users of OpenFGA v1.3.0 or earlier are vulnerable to authorization bypass when calling the ListObjects API. UPDATE: This means that the API sometimes returns more objects than it should.

## Am I Affected?

The vulnerability affects customers using `ListObjects` with specific models. The affected models contain expressions of type `rel1 from type1`.

## Fix
Update to v1.3.1.

## Backward Compatibility
This update is backward compatible.
Apache Airflow missing Certificate Validation (GHSA-5f35-pq34-c87q)
Aliases: CVE-2023-39441
Published: 2023-08-23T18:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-smtp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.0'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-imap'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.0'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.0'}]}]}]

Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability.

The default SSL context with SSL library did not check a server's X.509 certificate.  Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position.

Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability