aswin1906/github-advisory-2023 huggingface dataset:
Jenkins Azure Key Vault Plugin does not properly mask credentials (GHSA-gmxm-pr58-v5jc)
Aliases: CVE-2023-30514
Published: 2023-04-12T18:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-keyvault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '188.vf46b'}]}]}]

Multiple Jenkins plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

- The credentials are printed in build steps executing on an agent (typically inside a node block).

- Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.

The following plugins are affected by this vulnerability:

- Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514)

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

- Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514)

As of publication of this advisory, there is no fix available for the following plugin:

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)
Jenkins Crap4J Plugin vulnerable to XML external entity (XXE) attacks (GHSA-vq5h-qgxm-2m39)
Aliases: CVE-2023-28680
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:crap4j'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9'}]}]}]

Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control Crap Report file contents to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
xwiki-platform-web-templates allows users to be created even when registration is disabled without validation via template macro (GHSA-fp36-mjw5-fmgx)
Aliases: CVE-2023-29513
Published: 2023-04-20T21:39:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0-rc-1'}, {'fixed': '14.10.1'}]}]}]

### Impact

If a guest has view rights on any document, it's possible to create a new user using the `distribution/firstadminuser.wiki` in the wrong context.

To reproduce:

* On a wiki with view rights for guests but user registration disabled, open as guest <server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Btemplate+name%3D%22distribution%2Ffirstadminuser.wiki%22+%2F%7D%7D where <server> is the URL of your XWiki installation.
* Enter username and password of your choice.
* Click "Register and login"

### Patches

The vulnerability has been patched in XWiki 15.0-rc-1 and 14.10.1.

### Workarounds
There is no known workaround other than upgrading.

### References
https://jira.xwiki.org/browse/XWIKI-19852
https://jira.xwiki.org/browse/XWIKI-20400

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
sidekiq vulnerable to cross-site scripting  (GHSA-h3r8-h5qw-4r35)
Aliases: CVE-2023-1892
Published: 2023-04-21T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'sidekiq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.4'}, {'fixed': '7.0.8'}]}]}]

sidekiq from 7.0.4 to 7.0.7 is vulnerable to reflected cross-site scripting. A fix was released in version 7.0.8.
Jenkins Convert To Pipeline Plugin vulnerable to command injection (GHSA-7c44-m589-36w7)
Aliases: CVE-2023-28677
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:convert-to-pipeline'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0'}]}]}]

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations.

This allows attackers able to configure Freestyle projects to prepare a crafted configuration that injects Pipeline script code into the (unsandboxed) Pipeline resulting from a conversion by Convert To Pipeline Plugin. If an administrator converts the Freestyle project to a Pipeline, the script will be pre-approved.
Apache superset missing check for default SECRET_KEY (GHSA-5cx2-vq3h-x52c)
Aliases: CVE-2023-27524
Published: 2023-04-24T18:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments (GHSA-622w-995c-3c3h)
Aliases: CVE-2023-29015
Published: 2023-04-07T19:22:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.goobi.viewer:viewer-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.03'}]}]}]

### Impact
A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core. An attacker could create a specially crafted comment, resulting in the execution of malicious script code in the user's browser when displaying the comment.

### Patches
The vulnerability has been fixed in version 23.03

If you have any questions or comments about this advisory:
* Email us at [support@intranda.com](mailto:support@intranda.com)
Remote code execution in dawnsparks-node-tesseract (GHSA-88qf-5f3v-pm6m)
Aliases: CVE-2023-29566
Published: 2023-04-24T18:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'dawnsparks-node-tesseract'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.1'}]}]}]

dawnsparks-node-tesseract before 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition (GHSA-2295-vh28-pphc)
Aliases: CVE-2023-2328
Published: 2023-04-27T19:37:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.21 or apply these patches manually https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe.patch
https://github.com/pimcore/pimcore/commit/b9c9ca2371aa643dbc4caca162ff3400266ff96f.patch

### Workarounds
Apply patches:
https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe.patch
https://github.com/pimcore/pimcore/commit/b9c9ca2371aa643dbc4caca162ff3400266ff96f.patch

### References
https://huntr.dev/bounties/01a44584-e36b-46f4-ad94-53af488397f6/
XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector (GHSA-3989-4c6x-725f)
Aliases: CVE-2023-29516
Published: 2023-04-20T22:00:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-attachment-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0-rc-2'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-attachment-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-attachment-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.1'}]}]}]

### Impact
Any user with view rights on `XWiki.AttachmentSelector` can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping in the "Cancel and return to page" button. This page is installed by default.

See https://jira.xwiki.org/browse/XWIKI-20275 for the reproduction steps.

### Patches
The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.

### Workarounds
The issue can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996) on `XWiki.AttachmentSelector`.

### References
- https://github.com/xwiki/xwiki-platform/commit/aca1d677c58563bbe6e35c9e1c29fd8b12ebb996
- https://jira.xwiki.org/browse/XWIKI-20275

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Basic Cross-site Scripting (GHSA-hmm7-6ph9-8jf2)
Aliases: CVE-2023-29508
Published: 2023-04-12T20:36:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livedata-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '13.10.10'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livedata-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.4'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livedata-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.9'}, {'fixed': '14.10'}]}]}]

### Impact
A user without script rights can introduce a stored XSS by using the Live Data macro, if the last author of the content of the page has script rights.

For instance, by adding the LiveData below in the about section of the profile of a user created by an admin.

```javascript
{{liveData id="movies" properties="title,description"}}
{
  "data": {
    "count": 1,
    "entries": [
      {
        "title": "Meet John Doe",
        "url": "https://www.imdb.com/title/tt0033891/",
        "description": "<img onerror='alert(1)' src='foo' />"
      }
    ]
  },
  "meta": {
    "propertyDescriptors": [
      {
        "id": "title",
        "name": "Title",
        "visible": true,
        "displayer": {"id": "link", "propertyHref": "url"}
      },
      {
        "id": "description",
        "name": "Description",
        "visible": true,
        "displayer": "html"
      }
    ]
  }
}
{{/liveData}}
```

### Patches
This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

### Workarounds
No known workaround.

### References
- https://jira.xwiki.org/browse/XWIKI-20312

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [Jira](http://jira.xwiki.org/)
* Email us at [Security ML](mailto:security@xwiki.org)
GovernorCompatibilityBravo may trim proposal calldata (GHSA-93hq-5wgc-jc82)
Aliases: CVE-2023-30542
Published: 2023-04-20T14:11:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.8.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts-upgradeable'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.8.3'}]}]}]

### Impact

The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes the additional elements of the latter to be ignored, and if the proposal succeeds the corresponding actions would eventually execute without any calldata. The `ProposalCreated` event correctly represents what will eventually execute, but the proposal parameters as queried through `getActions` appear to respect the original intended calldata.

### Patches

This issue has been patched in v4.8.3.

### Workarounds

Ensure that all proposals that pass through governance have equal length `signatures` and `calldatas` parameters.
Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml (GHSA-x37v-36wv-6v6h)
Aliases: CVE-2023-29528
Published: 2023-04-20T20:55:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2-milestone-1'}, {'fixed': '14.10'}]}]}]

### Impact
The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1 and massively improved in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid HTML comments. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). An example are anonymous comments in XWiki where the HTML macro filters HTML using restricted mode:

```html
{{html}}
<!--> <Details Open OnToggle=confirm("XSS")>
{{/html}}
```

When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance.

Note that while all versions since 4.2-milestone-1 should be vulnerable, only starting with version 14.6-rc-1 the HTML comment is necessary for the attack to succeed due to [another vulnerability](https://github.com/xwiki/xwiki-commons/security/advisories/GHSA-m3jr-cvhj-f35j) that has been patched in version 14.6-rc-1.

### Patches
This problem has been patched in XWiki 14.10, HTML comments are now removed in restricted mode and a check has been introduced that ensures that comments don't start with `>`.

### Workarounds
There are no known workarounds apart from upgrading to a version including the fix.

### References
* https://jira.xwiki.org/browse/XCOMMONS-2568
* https://jira.xwiki.org/browse/XWIKI-20348
* https://github.com/xwiki/xwiki-commons/commit/8ff1a9d7e5d7b45b690134a537d53dc05cae04ab

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org/)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)

### Attribution

This vulnerability was reported on Intigriti by [ynoof](https://twitter.com/ynoofAssiri) @Ynoof5.
XWiki App Within Minutes app grants space admin rights that allows cross-site scripting (GHSA-44h9-xxvx-pg6x)
Aliases: CVE-2023-29515
Published: 2023-04-20T21:58:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0-milestone-2'}, {'fixed': '4.2-milestone-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2-milestone-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.1'}]}]}]

### Impact
Any user who can create a space can become admin of that space through App Within Minutes. The admin right implies the script right and thus allows JavaScript injection. The vulnerability can be exploited by creating an app in App Within Minutes. If the button should be disabled because the user doesn't have global edit right, the app can also be created by directly opening `/xwiki/bin/view/AppWithinMinutes/CreateApplication?wizard=true` on the XWiki installation.

### Patches
This has been patched in XWiki 13.10.11, 14.4.8, 14.10.1 and 15.0 RC1 by not granting the space admin right if the user doesn't have script right on the space where the app is created. Error message are displayed to warn the user that the app will be broken in this case. Users who became space admin through this vulnerability won't loose the space admin right due to the fix, so it is advised to check if all users who created AWM apps should keep their space admin rights.

### Workarounds
The patch can be applied by patching the affected wiki documents, the most important one being `AppWithinMinutes.LiveTableEditSheet`. Further, the attack can be prevented by denying view access to `AppWithinMinutes.LiveTableEditSheet`. This only impacts creation and editing of App Within Minutes apps.

### References

* https://jira.xwiki.org/browse/XWIKI-20190
* https://github.com/xwiki/xwiki-platform/commit/e73b890623efa604adc484ad82f37e31596fe1a6

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation (GHSA-38jc-2rwx-qgxr)
Aliases: CVE-2023-30516
Published: 2023-04-12T18:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:image-tag-parameter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0'}]}]}]

Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries.

Job configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default.
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via HTML export (GHSA-8p48-ghv5-7qq7)
Aliases: CVE-2023-1756
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the FAQ site while generating an HTML Export. This has been fixed in 3.1.12.
org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents  (GHSA-4f8g-fq6x-jqrr)
Aliases: CVE-2023-29208
Published: 2023-04-12T20:34:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2-milestone-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact

Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked.

### Patches

The problem has been patched in XWiki 14.10 by checking the rights of current user: only admin and deleter of the document are allowed to view it.

### Workarounds

There is no workaround for this vulnerability other than upgrading.

### References

  * Jira ticket: https://jira.xwiki.org/browse/XWIKI-16285
  * Commit: https://github.com/xwiki/xwiki-platform/commit/d9e947559077e947315bf700c5703dfc7dd8a8d7

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Answer vulnerable to Exposure of Sensitive Information Through Metadata (GHSA-8jg3-rx43-3fv4)
Aliases: CVE-2023-1974
Published: 2023-04-11T12:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.8'}]}]}]

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.8 may expose sensitive information, such as EXIF data and GPS coordatinates, via image metadata.
Regular Expression Denial of Service in Deno.upgradeWebSocket API (GHSA-jc97-h3h9-7xh6)
Aliases: CVE-2023-26103
Published: 2023-04-03T17:18:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'deno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.31.0'}]}]}]

### Impact
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. 

### Patches
It is recommended that users upgrade to Deno 1.31.0.
Code injection via unescaped translations in xwiki-platform (GHSA-4v38-964c-xjmw)
Aliases: CVE-2023-29510
Published: 2023-04-19T18:26:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-administration-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3-milestone-2'}, {'fixed': '14.10.2'}]}]}]

### Impact
In XWiki, every user can add translations that are only applied to the current user. This also allows overriding existing translations. Such translations are often included in privileged contexts without any escaping which allows remote code execution for any user who has edit access on at least one document which could be the user's own profile where edit access is enabled by default.

The following describes a proof of concept exploit to demonstrate this vulnerability:

1. Edit the user profile with the wiki editor and set the content to
```
error={{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("hello from groovy!"){{/groovy}}{{/async}}
```
2. Use the object editor to add an object of type `XWiki.TranslationDocumentClass` with scope `USER`.
3. Open the document `WikiManager.AdminWikiDescriptorSheet`.

The expected result would be that a message with title `{{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("hello from groovy!"){{/groovy}}{{/async}}` is displayed while in fact an error that the HTML macro couldn't be executed is displayed, followed by the text "hello from groovy!" and some raw HTML, showing that the Groovy macro has been executed.

### Patches

A mitigation for this vulnerability is part of XWiki 14.10.2 and XWiki 15.0 RC1: translations with user scope now require script right. This means that regular users cannot exploit this anymore as users don't have script right by default anymore starting with XWiki 14.10.

### Workarounds

There are no known workarounds apart from upgrading to a patched versions.

### References

* https://jira.xwiki.org/browse/XWIKI-19749
* https://github.com/xwiki/xwiki-platform/commit/d06ff8a58480abc7f63eb1d4b8b366024d990643

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated (GHSA-mx2q-35m2-x2rh)
Aliases: CVE-2023-30541
Published: 2023-04-17T16:45:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.0'}, {'fixed': '4.8.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts-upgradeable'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.0'}, {'fixed': '4.8.3'}]}]}]

### Impact

A function in the implementation contract may be inaccessible if its selector clashes with one of the proxy's own selectors. Specifically, if the clashing function has a different signature with incompatible ABI encoding, the proxy could revert while attempting to decode the arguments from calldata.

The probability of an accidental clash is negligible, but one could be caused deliberately.

### Patches

The issue has been fixed in v4.8.3.

### Workarounds

If a function appears to be inaccessible for this reason, it may be possible to craft the calldata such that ABI decoding does not fail at the proxy and the function is properly proxied through.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/4154
Hop-by-hop abuse to malform header mutator (GHSA-w9mr-28mw-j8hg)
Published: 2023-04-26T19:44:00Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ory/oathkeeper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.40.3'}]}]}]

### Impact

Downstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config:

```yaml
- id: 'example'
  upstream:
    url: 'https://example.com'
  match:
    url: 'http://127.0.0.1:4455/'
    methods:
      - GET
  authenticators:
    - handler: anonymous
  authorizer:
    handler: allow
  mutators:
    - handler: header
      config:
        headers:
          X-Subject: {{ .Subject }}
```

```
curl -H "Connection: close,x-subject" http://127.0.0.1:4455/
```

The `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.

### Patches

c5cc7f736dc84185034be4356057d1c7a656d797

### Workarounds

The downstream server should handle the case that an expected header is not set by responding with an appropriate error.

### References

See background info in https://github.com/golang/go/issues/50580
Jenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controller (GHSA-qgw9-vgrf-h723)
Aliases: CVE-2023-30523
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:reportportal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.5'}]}]}]

Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.
Apache Superset vulnerable to Improper Authorization (GHSA-7jhg-8m74-6f6g)
Aliases: CVE-2023-27525
Published: 2023-04-17T18:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.1'}]}]}]

An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including 2.0.1
Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter (GHSA-w974-rq9x-mh3v)
Aliases: CVE-2020-19697
Published: 2023-04-04T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'editor.md'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.0'}]}]}]

Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the `<iframe> src` parameter.
Lightbend Alpakka Kafka logs credentials on debug level (GHSA-55vq-xpjf-r2xc)
Aliases: CVE-2023-29471
Published: 2023-04-27T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.typesafe.akka:akka-stream-kafka'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.2'}]}]}]

Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Uvdesk remote code execution vulnerability (GHSA-2hw6-4rv9-82fp)
Aliases: CVE-2023-0265
Published: 2023-04-05T00:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'uvdesk/community-skeleton'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.1'}]}]}]

Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
Jenkins Performance Publisher Plugin vulnerable to XML external entity (XXE) attacks (GHSA-qgm7-m77f-j8pf)
Aliases: CVE-2023-28682
Published: 2023-04-02T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:perfpublisher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '8.09'}]}]}]

Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control PerfPublisher report files to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Shopware vulnerable to cross-site scripting (XSS) (GHSA-mj9r-fpv3-rgfx)
Aliases: CVE-2022-48150
Published: 2023-04-21T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/shopware'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.5.10'}]}]}]

Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability.
org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability (GHSA-p9mj-v5mf-m82x)
Aliases: CVE-2023-29210
Published: 2023-04-12T20:35:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-notifications-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '13.2-rc-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-notifications-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-notifications-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact
Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the user parameter of the macro that provide the [notification filters](https://extensions.xwiki.org/xwiki/bin/view/Extension/Notifications%20Application/#HFilters). These macros are used in the user profiles and thus installed by default in XWiki.

A proof of concept exploit is

```
{{notificationsFiltersPreferences target="user" user="~" /~}~} {{async async=~"true~" cached=~"false~" context=~"doc.reference~"~}~}{{groovy~}~}new File(~"/tmp/exploit.txt~").withWriter { out -> out.println(~"created from filter preferences!~"); }{{/groovy~}~}{{/async~}~}"/}}

{{notificationsAutoWatchPreferences target="user" user="~" /~}~} {{async async=~"true~" cached=~"false~" context=~"doc.reference~"~}~}{{groovy~}~}new File(~"/tmp/exploit2.txt~").withWriter { out -> out.println(~"created from auto watch preferences!~"); }{{/groovy~}~}{{/async~}~}"/}}

{{notificationsEmailPreferences target="user" user="~" /~}~} {{async async=~"true~" cached=~"false~" context=~"doc.reference~"~}~}{{groovy~}~}new File(~"/tmp/exploit3.txt~").withWriter { out -> out.println(~"created from email filter preferences!~"); }{{/groovy~}~}{{/async~}~}"/}}
```

If this creates files inside `/tmp`, the installation is vulnerable.

### Patches
The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.

### Workarounds
The issue can be fixed by patching the code in the affected macros that are contained in XWiki documents as shown in the [patch](https://github.com/xwiki/xwiki-platform/commit/cebf9167e4fd64a8777781fc56461e9abbe0b32a) for this issue.

### References
* https://github.com/xwiki/xwiki-platform/commit/cebf9167e4fd64a8777781fc56461e9abbe0b32a
* https://jira.xwiki.org/browse/XWIKI-20259

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter (GHSA-7v7g-9vx6-vcg2)
Aliases: CVE-2023-29014
Published: 2023-04-07T19:22:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.goobi.viewer:viewer-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.03'}]}]}]

### Impact
A reflected cross-site scripting vulnerability has been identified in Goobi viewer core when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser.

### Patches
The vulnerability has been fixed in version 23.03

### Credits
We would like to thank [RUS-CERT](https://cert.uni-stuttgart.de/) for reporting this issues.

If you have any questions or comments about this advisory:
* Email us at [support@intranda.com](mailto:support@intranda.com)
Directus API vulnerable to denial of service (GHSA-3gvp-54v2-2jrp)
Aliases: CVE-2020-19850
Published: 2023-04-04T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'directus'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.1'}]}], 'versions': ['2.2.0']}]

An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.
Information exposure in microweber (GHSA-h83h-77x2-6w6g)
Aliases: CVE-2023-2239
Published: 2023-04-22T18:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.4'}]}]}]

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository microweber/microweber prior to 1.3.4.
Improper header validation in httpsoft/http-message (GHSA-9jxr-mwpp-w643)
Published: 2023-04-21T20:27:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'httpsoft/http-message'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.12'}]}]}]

### Impact

Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`.

### Patches

The issue is patched in 1.0.12.

### Workarounds

There are no known workarounds.

### References

* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer (GHSA-m3c3-9qj7-7xmx)
Aliases: CVE-2023-29517
Published: 2023-04-20T22:01:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-office-viewer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5-milestone-2'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-office-viewer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-office-viewer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.1'}]}]}]

### Impact

The office document viewer macro was allowing anyone to see any file content from the hosting server, provided that the office server was connected and depending on the permissions of the user running the servlet engine (e.g. tomcat) running XWiki. The same vulnerability also allowed to perform internal requests to resources from the hosting server.

### Patches

The problem has been patched in XWiki 13.10.11, 14.10.1, 14.4.8, 15.0-rc-1.

### Workarounds

It might be possible to workaround this vulnerability by running XWiki in a sandbox with a user with very low privileges on the machine, now to run a servlet engine the user will always need access to some files, so in any case this workaround won't protect all files to be accessed.

### References

  * Original jira ticket: https://jira.xwiki.org/browse/XWIKI-20447
  * Jira ticket related to another exploit using same root cause: https://jira.xwiki.org/browse/XWIKI-20324
  * Jira ticket related to the possibility to exploit the same vulnerability to perform internal requests: https://jira.xwiki.org/browse/XWIKI-20449

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Apache Linkis JDBC EngineConn has deserialization vulnerability (GHSA-qm2h-m799-86rc)
Aliases: CVE-2023-29215
Published: 2023-04-10T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.linkis:linkis-engineconn'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EngineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. Users should upgrade their version of Linkis to version 1.3.2.
Uvdesk vulnerable to stored cross-site scripting (XSS) (GHSA-fwhv-9phj-wrj5)
Aliases: CVE-2023-0325
Published: 2023-04-05T00:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'uvdesk/community-skeleton'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.1'}]}]}]

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.
Access control issues in blackbox_exporter (GHSA-939c-3g97-vpvv)
Aliases: CVE-2023-26735
Published: 2023-04-26T00:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/prometheus/blackbox_exporter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.23.0'}]}]}]

blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface. This vulnerability allows attackers to detect intranet ports and services, as well as download resources.
Path traversal vulnerability in the file manager (GHSA-fp7q-xhhw-6rj3)
Aliases: CVE-2023-29200
Published: 2023-04-26T16:05:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'contao/contao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.9.0'}, {'fixed': '4.9.40'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'contao/contao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.13.0'}, {'fixed': '4.13.21'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'contao/contao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.4'}]}]}]

### Impact

Authenticated users in the back end can list files outside the document root in the file manager.

### Patches

Update to Contao 4.9.40, 4.13.21 or 5.1.4.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/directory-traversal-in-the-file-manager

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Access bypass in Drupal core (GHSA-7jr4-hgqx-vwgq)
Aliases: CVE-2022-25274
Published: 2023-04-26T15:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.12'}]}]}]

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual items of node and media content. This vulnerability only affects sites using Drupal's revision system.

All releases prior to Drupal 9.3 (including Drupal 7) are not affected.
Jenkins Assembla merge request builder Plugin missing authentication to access endpoint (GHSA-jr86-6j4j-mv45)
Aliases: CVE-2023-30521
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:assembla-merge-request-builder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.13'}]}]}]

Jenkins Assembla merge request builder Plugin provides a webhook endpoint at `/assembla-webhook/` that can be used to trigger builds of jobs configured to use a specified repository.

In Assembla merge request builder Plugin 1.1.13 and earlier, this endpoint can be accessed without authentication. This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
Cross-site Scripting (XSS) in Conditions tab of Pricing Rules (GHSA-r7mm-jx6h-hv7m)
Aliases: CVE-2023-2332
Published: 2023-04-27T22:34:22Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.


### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe.patch manually.

### References
https://huntr.dev/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c/
Cross-site scripting vulnerabilities in old version of bundled TinyMCE (GHSA-wqm8-jx8r-8rcq)
Published: 2023-04-26T15:54:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/admin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.12.7'}]}]}]

An old version of TinyMCE include an XSS vulnerability, which was patched in a later version. This was described by TinyMCE:

> A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.

We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.

Reported by: Developers at ACC
Jenkins Quay.io trigger Plugin Cross-site Scripting vulnerability (GHSA-2jgw-28qh-6mg8)
Aliases: CVE-2023-30520
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:quayio-trigger'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1'}]}]}]

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.