aswin1906/github-advisory-2023 huggingface dataset:
Keycloak Untrusted Certificate Validation vulnerability (GHSA-5cc8-pgp5-7mpm)
Aliases: CVE-2023-1664
Published: 2023-06-30T20:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '21.1.2'}]}]}]

A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client Certificate Authenticatior with the option "Revalidate Client Certificate". A user may be able to choose, if directly connect to keycloak (not passing via reverse proxy) a specific certificate. If there's a configuration error in KC_SPI_TRUSTSTORE_FILE_FILE the authenticator allows even with the "Cannot validate client certificate trust: Truststore not available" message as there's no certificate to trust against.
hnswlib Double Free vulnerability (GHSA-xwc8-rf6m-xr86)
Aliases: CVE-2023-37365
Published: 2023-06-30T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'hnswlib'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.7.0'}]}]}]

Hnswlib 0.7.0 has a double free in `init_index` when the M argument is a large integer.
PlantUML Server-Side Request Forgery vulnerability (GHSA-ff3m-68vj-h86p)
Aliases: CVE-2023-3432
Published: 2023-06-27T15:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.sourceforge.plantuml:plantuml-mit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2023.9'}]}]}]

Server-Side Request Forgery (SSRF) in GitHub repository plantuml/plantuml prior to 1.2023.9.
JStachio XSS vulnerability: Unescaped single quotes (GHSA-gwxv-jv83-6qjr)
Aliases: CVE-2023-33962
Published: 2023-06-06T00:45:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jstach:jstachio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.1'}]}]}]

### Impact

#### Description:
JStachio fails to escape single quotes `'` in HTML, allowing an attacker to inject malicious code.

#### Reproduction Steps:
Use the following template code:
```html
<div attr='{{value}}'></div>
```

Set the value variable to `' onblur='alert(1)`.

```java
public class Escaping {

    public static void main(String[] args) {
        Model model = new Model("' onblur='alert(1)");
        String result = AttributeTemplate.of().execute(model);
        System.out.println(result);
    }

    @JStache(template = "<div attr='{{value}}'></div>",
            name="AttributeTemplate")
    @JStacheConfig(contentType= Html.class)
    public static class Model {

        public final String value;

        public Model(String value) {
            this.value = value;
        }

        public String getValue() {
            return value;
        }
    }
}
```

Expected Result:
The resulting output should have properly escaped the single quotes and not execute the injected JavaScript code.

Actual Result:
The resulting output is vulnerable and renders as follows:
```html
<div attr='' onblur='alert(1)'></div>
```

#### Impact and Risk:
This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users visiting pages that use this template engine. This can lead to various consequences, including session hijacking, defacement of web pages, theft of sensitive information, or even the propagation of malware.

#### Proposed Solution:
To mitigate this vulnerability, the template engine should properly escape special characters, including single quotes. Common practice is to escape `'` as `&#39`.

### Patches
-

### Workarounds
As long as users stick with double quotes `"` for HTML attributes, they should not be affected.

### References
For instance, [Rocker's general purpose HTML escaping](https://github.com/fizzed/rocker/blob/d749fbf68179b31a64d541f5e18e0e25bc5c2d1b/rocker-runtime/src/main/java/com/fizzed/rocker/runtime/DefaultHtmlStringify.java#L64)
Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack (GHSA-rvrx-rrwh-r9p6)
Aliases: CVE-2023-33958
Published: 2023-06-06T16:44:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/notaryproject/notation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-rc.6'}]}]}]

### Impact
An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running `notation verify`.

### Patches
The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6). Users should upgrade their notation packages to [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6) or above.

### Workarounds
User should use secure and trusted container registries

### Credits
The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning (GHSA-5h3x-9wvq-w4m2)
Aliases: CVE-2023-34234
Published: 2023-06-08T18:03:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.9.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts-upgradeable'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.9.1'}]}]}]

### Impact

By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all.

This impacts the `Governor` contract in v4.9.0 only, and the `GovernorCompatibilityBravo` contract since v4.3.0.

### Patches

The problem has been patched in 4.9.1 by introducing opt-in frontrunning protection.

### Workarounds

Submit the proposal creation transaction to an endpoint with frontrunning protection.

### Credit

Reported by Lior Abadi and Joaquin Pereyra from Coinspect.

### References

https://www.coinspect.com/openzeppelin-governor-dos/
Jenkins Digital.ai App Management Publisher Plugin vulnerable to Cross-Site Request Forgery (GHSA-r72x-2h45-p59x)
Aliases: CVE-2023-35148
Published: 2023-06-14T15:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ease-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6'}]}]}]

Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
@keystone-6/auth Open Redirect vulnerability (GHSA-jqxr-vjvv-899m)
Aliases: CVE-2023-34247
Published: 2023-06-14T14:54:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@keystone-6/auth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.0'}]}]}]

### Summary
There is an open redirect in the `@keystone-6/auth` package, where the redirect leading `/` filter can be bypassed.

### Impact
Users may be redirected to domains other than the relative host, thereby it might be used by attackers to re-direct users to an unexpected location.

### Mitigations
- Don't use the `@keystone-6/auth` package

### References
- [CWE-601: URL Redirection to Untrusted Site ('Open Redirect')](https://cwe.mitre.org/data/definitions/601.html)
- [OWASP: Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)

#### Similar Vulnerability Reports
- [CVE-2023-0748](https://nvd.nist.gov/vuln/detail/CVE-2023-0748)
- [CVE-2022-2252](https://nvd.nist.gov/vuln/detail/CVE-2022-2252)

#### Credits
Thanks to [morioka12](https://github.com/scgajge12) for reporting this problem.

If you have any questions around this security advisory, please don't hesitate to contact us at [security@keystonejs.com](mailto:security@keystonejs.com), or [open an issue on GitHub](https://github.com/keystonejs/keystone/issues/new/choose).

If you have a security flaw to report for any software in this repository, please see our [SECURITY policy](https://github.com/keystonejs/keystone/blob/main/SECURITY.md).
Apache NiFi vulnerable to Code Injection (GHSA-xm2m-2q6h-22jw)
Aliases: CVE-2023-34468
Published: 2023-06-12T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-dbcp-base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.22.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-hikari-dbcp-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.22.0'}]}]}]

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution.

The resolution validates the Database URL and rejects H2 JDBC locations.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
GilaCMS Cross Site Request Forgery vulnerability (GHSA-4cw3-rhqx-vqwr)
Aliases: CVE-2020-20726
Published: 2023-06-20T15:31:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'gilacms/gila'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.11.4'}]}]}]

Cross Site Request Forgery vulnerability in Gila GilaCMS v.1.11.4 allows a remote attacker to execute arbitrary code via the `cm/update_rows/user` parameter.
janino vulnerable to denial of service due to stack overflow (GHSA-gcg6-xv4f-f749)
Aliases: CVE-2023-33546
Published: 2023-06-01T15:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.codehaus.janino:janino-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.1.9'}]}]}]

janino 3.1.9 and earlier is subject to denial of service (DOS) attacks when using the expression `evaluator.guess` parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.
Rancher UI has multiple Cross-Site Scripting (XSS) issues (GHSA-46v3-ggjg-qq3x)
Aliases: CVE-2022-43760
Published: 2023-06-06T01:59:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.4'}]}]}]

### Impact
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in the Rancher UI. 
Cross-Site scripting allows a malicious user to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a user with write access to the affected areas being able to act on behalf of an administrator, once an administrator opens the affected web page.

The affected areas include the Projects/Namespaces and Auth Provider sections. The attacker needs to be authenticated and have write access to those features in order to exploit the vulnerabilities. Some of the permissions (roles) required are:

- Project Owner.
- Restricted Admin.
- Configure Authentication.
- Administrator.
- Custom RBAC Role that provides write access on Projects or External Authentication Providers.

For users that suspect this vulnerability may have targeted their Rancher instance, we recommend rotating all API Keys and Kubeconfig tokens.

It's also advised to review logs and possibly rotate credentials stored as secrets in Rancher and downstream cluster, if you believe that users' credentials to access Rancher and its clusters might have been compromised.

### Patches
Patched versions include releases `2.6.13`, `2.7.4` and later versions.

### Workarounds
There is no direct mitigation besides updating Rancher to a patched version.

### Credits
We would like to recognize and thank @bybit-sec for the responsible disclosure of this security issue.

### For more information
If you have any questions or comments about this advisory:

- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Jenkins Template Workflows Plugin vulnerable to Stored Cross-site Scripting (GHSA-62v2-xwh3-5gvx)
Aliases: CVE-2023-35146
Published: 2023-06-14T15:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins.plugin.templateWorkflows:template-workflows'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '41.v32d86a'}]}]}]

Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create jobs.
XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters (GHSA-4wc6-hqv9-qc97)
Aliases: CVE-2023-35153
Published: 2023-06-20T16:47:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.4.4'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.0'}]}]}]

### Impact
A stored XSS can be exploited by users with edit rights by adding a `AppWithinMinutes.FormFieldCategoryClass` class on a page and setting the payload on the page title.
Then, any user visiting `/xwiki/bin/view/AppWithinMinutes/ClassEditSheet` executes the payload.

See https://jira.xwiki.org/browse/XWIKI-20365 for me details.

### Patches
The issue has been patched on XWiki 14.4.8, 14.10.4, and 15.0 ?

### Workarounds
The issue can be fixed by updating `AppWithinMinutes.ClassEditSheet` with this [patch](https://github.com/xwiki/xwiki-platform/commit/1b87fec1e5b5ec00b7a8c3c3f94f6c5e22547392#diff-79e725ec7125cced7d302e1a1f955a76745af26ef28a148981b810e85335d302).

### References
- https://github.com/xwiki/xwiki-platform/commit/1b87fec1e5b5ec00b7a8c3c3f94f6c5e22547392#diff-79e725ec7125cced7d302e1a1f955a76745af26ef28a148981b810e85335d302
- https://jira.xwiki.org/browse/XWIKI-20365

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported on Intigriti by René de Sain @renniepak.
Jenkins CSRF protection bypass vulnerability (GHSA-98fp-r22g-wpj7)
Aliases: CVE-2023-35141
Published: 2023-06-14T15:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.400'}]}]}]

Jenkins provides context menus for various UI elements, like links to jobs and builds, or breadcrumbs.

In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST requests are sent in order to load the list of context actions. If part of the URL includes insufficiently escaped user-provided values, a victim may be tricked into sending a POST request to an unexpected endpoint (e.g., the Script Console) by opening a context menu.

As of publication of this advisory, we are aware of insufficiently escaped context menu URLs for label expressions, allowing attackers with Item/Configure permissions to exploit this vulnerability.

Jenkins 2.400, LTS 2.401.1 sends GET requests to load the list of context actions.
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name (GHSA-x3cc-x39p-42qx)
Aliases: CVE-2023-26920
Published: 2023-06-13T12:44:34Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'fast-xml-parser'}, 'ecosystem_specific': {'affected_functions': ['fast-xml-parser.XMLParser.parse']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.2'}]}]}]

### Impact
As a part of this vulnerability, user was able to se code using `__proto__` as a tag or attribute name.

```js
const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser();
let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked
``` 

### Patches
The problem has been patched in v4.1.2

### Workarounds
User can check for "__proto__" in the XML string before parsing it to the parser.

### References
https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7
Async HTTP Client has CRLF Injection vulnerability in HTTP request headers (GHSA-v3r5-pjpm-mwgq)
Aliases: CVE-2023-0040
Published: 2023-06-07T15:52:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/swift-server/async-http-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.2'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/swift-server/async-http-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.10.0'}, {'fixed': '1.12.1'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/swift-server/async-http-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.9.1'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/swift-server/async-http-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.1'}]}]}]

Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. This vulnerability was the result of insufficient validation of HTTP header field values before sending them to the network. Users are vulnerable if they pass untrusted data into HTTP header field values without prior sanitisation. Common use-cases here might be to place usernames from a database into HTTP header fields.

This vulnerability allows attackers to inject new HTTP header fields, or entirely new requests, into the data stream. This can cause requests to be understood very differently by the remote server than was intended. In general, this is unlikely to result in data disclosure, but it can result in a number of logical errors and other misbehaviours.
XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults (GHSA-rf8j-q39g-7xfm)
Aliases: CVE-2023-35152
Published: 2023-06-20T16:46:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-like-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.9-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-like-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-like-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1'}]}]}]

### Impact
Any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation.

### Patches
The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1.

### Workarounds
The vulnerability can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49).

On versions before 13.4-rc-1, the fix needs to be applied on [XWiki.Like.Code.LiveTableResultPage](https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39).

### References
- The reported issue https://jira.xwiki.org/browse/XWIKI-20611, fixed by https://jira.xwiki.org/browse/XWIKI-19900
- The patch https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49
### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects (GHSA-hm9v-vj3r-r55m)
Aliases: CVE-2023-36807
Published: 2023-06-30T22:19:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'PyPDF2'}, 'ecosystem_specific': {'affected_functions': ['PyPDF2._reader.PdfReader.get_object', 'PyPDF2.generic._base.NameObject.read_from_stream', 'PyPDF2.generic._data_structures.DictionaryObject.read_from_stream', 'PyPDF2.generic._data_structures.read_object']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.10.5'}, {'fixed': '2.10.6'}]}], 'versions': ['2.10.5']}]

### Impact
An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop.
This infinite loop blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage. That is, for example, the case if the user extracted metadata from such a malformed PDF.

### Patches
The issue was fixed with https://github.com/py-pdf/pypdf/pull/1331

### Workarounds
If you cannot update your version of `PyPDF2` (preferably to `pypdf>3.1.0` as PyPDF2 is deprecated), you should modify `PyPDF2/generic/_data_structures.py::read_object`.

Replace:

```python
    else:
        # number object OR indirect reference
        peek = stream.read(20)
        stream.seek(-len(peek), 1)  # reset to start
        if IndirectPattern.match(peek) is not None:
            return IndirectObject.read_from_stream(stream, pdf)
        else:
            return NumberObject.read_from_stream(stream)
```

by

```python
    elif tok in b"0123456789+-.":
        # number object OR indirect reference
        peek = stream.read(20)
        stream.seek(-len(peek), 1)  # reset to start
        if IndirectPattern.match(peek) is not None:
            return IndirectObject.read_from_stream(stream, pdf)
        else:
            return NumberObject.read_from_stream(stream)
    else:
        raise PdfReadError(
            f"Invalid Elementary Object starting with {tok} @{stream.tell()}"
        )
```

### References
* [pypdf issue #1329](https://github.com/py-pdf/pypdf/issues/1329)
* [pypdf PR #1331](https://github.com/py-pdf/pypdf/pull/1331)
Kyverno resource with a deletionTimestamp may allow policy circumvention (GHSA-hq4m-4948-64cc)
Aliases: CVE-2023-34091
Published: 2023-06-05T17:10:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kyverno/kyverno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.10.0'}]}]}]

### Impact

In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. 

This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. 

However, this could potentially result in allowing a malicious user to leverage the [Kubernetes finalizers feature](https://kubernetes.io/docs/concepts/overview/working-with-objects/finalizers/) by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. 

Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies.


### Patches
This is resolved in Kyverno 1.10.0.

### Workarounds
There is no known workaround.

### References
_Are there any links users can visit to find out more?_
Jeecg P3 Biz Chat allows remote attackers to read arbitrary files (GHSA-v3v9-3jf4-5pxx)
Aliases: CVE-2023-33510
Published: 2023-06-07T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.p3:jeecg-p3-biz-chat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.5'}]}]}]

Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.
Froxlor vulnerable to Path Traversal (GHSA-ghqq-jfx7-f6m9)
Aliases: CVE-2023-3172
Published: 2023-06-09T03:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.20'}]}]}]

Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
sojo vulnerable to stack exhaustion (GHSA-75r3-38rh-pmxv)
Aliases: CVE-2023-34613
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.sf.sojo:sojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.1'}]}]}]

An issue was discovered sojo through 1.1.1 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
Vapor vulnerable to denial of service in HTTP Range Request of FileMiddleware (GHSA-vj2m-9f5j-mpr5)
Aliases: CVE-2022-31005
Published: 2023-06-07T16:26:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/vapor/vapor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.60.3'}]}]}]

Vapor is an HTTP web framework for Swift and [middleware](https://docs.vapor.codes/advanced/middleware/) is a logic chain between the client and a Vapor route handler. [FileMiddleware](https://docs.vapor.codes/advanced/middleware/#file-middleware) enables the serving of assets from the Public folder of a project to the client. 

Vapor before 4.60.3 is vulnerable to denial of service due to an integer overflow when given invalid range headers while using FileMiddleware. This is patched in 4.60.3.
Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource (GHSA-gm2g-2xr9-pxxj)
Aliases: CVE-2023-3485
Published: 2023-06-30T18:31:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'go.temporal.io/server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.20.0'}]}]}]

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed.
If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.
sequoia-openpgp vulnerable to out-of-bounds array access leading to panic (GHSA-25mx-8f3v-8wh7)
Published: 2023-06-06T01:58:04Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'sequoia-openpgp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.1'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'sequoia-openpgp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.8.1'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'sequoia-openpgp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9.0'}, {'fixed': '1.16.0'}]}]}]

Affected versions of the crate have several bugs where attacker-controlled input can result in the use of an out-of-bound array index.  Rust detects the use of the out-of-bound index and causes the application to panic.  An attacker may be able to use this to cause a denial-of-service.  However, it is not possible for an attacker to read from or write to the application's address space.
org.xwiki.commons:xwiki-commons-xml's HTML sanitizer allows form elements in restricted (GHSA-6pqf-c99p-758v)
Aliases: CVE-2023-36471
Published: 2023-06-30T20:41:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.6-rc-1'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.2-rc-1'}]}]}]

### Impact

The HTML sanitizer that is included in XWiki since version 14.6RC1 allowed form and input HTML tags. In the context of XWiki, this allows an attacker without script right to either create forms that can be used for phishing attacks or also in the context of a sheet, the attacker could add an input like `{{html}}<input type="hidden" name="content" value="{{groovy}}println(&quot;Hello from Groovy!&quot;)" />{{/html}}` that would allow remote code execution when it is submitted by an admin (the sheet is rendered as part of the edit form). The attacker would need to ensure that the edit form looks plausible, though, which can be non-trivial as without script right the attacker cannot display the regular content of the document.

### Patches
This has been patched in XWiki 14.10.6 and 15.2RC1 by removing the central form-related tags from the list of allowed tags.

### Workarounds
An admin can manually disallow the tags by adding `form, input, select, textarea, button` to the configuration option `xml.htmlElementSanitizer.forbidTags` in the `xwiki.properties` configuration file.

### References
* https://jira.xwiki.org/browse/XCOMMONS-2634
* https://github.com/xwiki/xwiki-commons/commit/99484d48e899a68a1b6e33d457825b776c6fe8c3
Jenkins Digital.ai App Management Publisher Plugin missing permission checks (GHSA-5ghv-wxh9-7356)
Aliases: CVE-2023-35149
Published: 2023-06-14T15:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ease-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6'}]}]}]

Jenkins Digital.ai App Management Publisher Plugin 2.6 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC (GHSA-3p62-6fjh-3p5h)
Aliases: CVE-2022-4361
Published: 2023-06-30T20:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '21.1.2'}]}]}]

AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).

AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.
liufee CMS File Upload vulnerability (GHSA-q3q5-qvh5-cmw5)
Aliases: CVE-2020-21174
Published: 2023-06-20T15:31:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'feehi/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.8.1'}]}]}]

File Upload vulnerability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
Insecure Temporary File in HuTool (GHSA-7mcw-xmx3-7p8m)
Aliases: CVE-2023-33695
Published: 2023-06-13T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.8.19'}]}]}]

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the `File.createTempFile()` function at `/core/io/FileUtil.java`.
Client Spoofing within the Keycloak Device Authorisation Grant (GHSA-f5h4-wmp5-xhg6)
Aliases: CVE-2023-2585
Published: 2023-06-30T20:29:25Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '21.1.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-server-spi-private'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '21.1.2'}]}]}]

Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.
jeecg-boot unrestricted file upload vulnerability (GHSA-jf2f-hvxx-4rqx)
Aliases: CVE-2023-34660
Published: 2023-06-16T18:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.0'}]}]}]

jeecg-boot V3.5.0 has an unauthorized arbitrary file upload in `/jeecg-boot/jmreport/upload` interface.
crypto-js uses insecure random numbers (GHSA-3w3w-pxmm-2w2j)
Aliases: CVE-2020-36732
Published: 2023-06-12T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'crypto-js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.1'}]}]}]

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.
Jenkins Sonargraph Integration Plugin vulnerable to Stored Cross-site Scripting (GHSA-wmxx-2pvr-x7j6)
Aliases: CVE-2023-35145
Published: 2023-06-14T15:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:sonargraph-integration'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.0.1'}]}]}]

Jenkins Sonargraph Integration Plugin 5.0.1 and earlier does not correctly escape the file path and the project name for the Log file field form validation.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields (GHSA-5cr9-5jx3-2g39)
Aliases: CVE-2023-34103
Published: 2023-06-06T14:13:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'avo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.33.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.33.2'}}, {'package': {'ecosystem': 'RubyGems', 'name': 'avo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0.pre1'}, {'last_affected': '3.0.0.pre12'}]}]}]

### Summary
Some avo fields are vulnerable to XSS when rendering html based content.

### Details
During the analysis of the web application, a rendered field was discovered that did not filter JS / HTML tags in a safe way and can be abused to execute js code on a client side. The trix field uses the trix editor in the backend to edit rich text data which basically operates with html tags. To display the stored data in a rendered view, the HasHTMLAttributes concern is used. This can be exploited by an attacker to store javascript code in any trix field by intercepting the request and modifying the post data, as the trix editor does not allow adding custom html or js tags on the frontend.

### PoC
![image](https://user-images.githubusercontent.com/26464774/243434868-47857054-9b20-437f-842f-0750d53c9b0e.png)
_Adding javascript in the post request which is used when editing a "post" resource (body is declared as a trix field)_

![image](https://user-images.githubusercontent.com/26464774/243435009-948593a0-5179-4368-977c-ec36d2373925.png)
_Successful execution of JS code on live demo environment_

### Impact
Unlike non-persistent XSS, persistent XSS does not require a social engineering phase. Victims of this attack do not need to be tricked into clicking a link or something like that. However, by exploiting such a vulnerability on this particular target, attackers may be able to gain access to accounts that require special protection, such as administrators of the web service, which is what Avo is primarily intended to be used for.

### Recommendation
The content of a field that contains html code should be sanitized using the according rails helper which uses a whitelist of known-safe tags and attributes. Also this security consideration should be applied to the “as_html” attribute as well because it may contain user controlled input as well.

https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html
Grafana Missing Synchronization vulnerability (GHSA-x2w4-c67p-g44j)
Aliases: CVE-2023-2801
Published: 2023-06-06T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.4.12'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.5.0'}, {'fixed': '9.5.3'}]}]}]

Grafana is an open-source platform for monitoring and observability. 

Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance.

The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly.

This might enable malicious users to crash Grafana instances through that endpoint.

Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.
SwiftNIO vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') (GHSA-7fj7-39wj-c64f)
Aliases: CVE-2022-3215
Published: 2023-06-07T16:01:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.41.0'}, {'fixed': '2.42.0'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.39.0'}, {'fixed': '2.39.1'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.29.1'}]}]}]

`NIOHTTP1` and projects using it for generating HTTP responses, including SwiftNIO, can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some form. A malicious user can add newlines to their input (usually in encoded form) and "inject" those newlines into the returned HTTP response.

This capability allows users to work around security headers and HTTP/1.1 framing headers by injecting entirely false responses or other new headers. The injected false responses may also be treated as the response to subsequent requests, which can lead to XSS, cache poisoning, and a number of other flaws.

This issue was resolved by adding a default channel handler that polices outbound headers. This channel handler is added by default to channel pipelines, but can be removed by users if they are doing this validation themselves.
Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter (GHSA-46g3-f9r8-xj4v)
Aliases: CVE-2023-2984
Published: 2023-06-06T01:51:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.22'}]}]}]

### Impact

A path traversal vulnerability exists in the CMS, which allows an attacker to overwrite or modify sensitive files by manipulating the `pimcore_log` parameter.This can lead to potential denial of service---key file overwrite.

The impact of this vulnerability allows attackers to:

- Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.

- Tamper with system settings by modifying key files, such as the hosts file in Windows or configuration files for other services.

- Cause a denial of service (DoS) if critical system files are overwritten or deleted.

The consequences of exploiting this vulnerability can be detrimental to the confidentiality, integrity, and availability of the affected system. It's crucial to address this vulnerability to protect sensitive data and ensure the proper functioning of the system.

### Patches
Update to version 10.5.22 or apply this patch manually https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch manually.

### References
https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191/
angular-ui-notification Cross-site Scripting vulnerability (GHSA-mrcj-5qxr-vhp2)
Aliases: CVE-2023-34840
Published: 2023-06-30T18:31:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'angular-ui-notification'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.0'}, {'last_affected': '0.3.6'}]}]}]

angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles (GHSA-wmff-grcw-jcfm)
Aliases: CVE-2023-34460
Published: 2023-06-21T18:35:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'tauri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.4.1'}]}], 'versions': ['1.4.0']}]

### Impact
The 1.4.0 release includes a regression on the filesystem scope check for dotfiles on Linux and macOS.

Previously dotfiles (eg. `$HOME/.ssh/`) were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented and dotfiles were implicitly allowed.

Only Tauri applications using wildcard scopes in the `fs` endpoint are affected.
Only macOS and Linux systems are affected.

### Patches
The regression has been patched on `v1.4.1`.

### Workarounds
There are no known workarounds at this time, users should update to `v1.4.1` immediately.

### References
See the [original advisory](https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5) for more information.

### For more Information
If you have any questions or comments about this advisory:

Open an issue in tauri
Email us at [security@tauri.app](mailto:security@tauri.app)
Dolibarr vulnerable to unauthenticated database access (GHSA-fpvg-m786-h5vr)
Aliases: CVE-2023-33568
Published: 2023-06-13T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dolibarr/dolibarr'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.0.0'}, {'fixed': '16.0.5'}]}]}]

An issue in Dolibarr v16.0.0 to v16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
Jenkins Team Concert Plugin does not perform permission checks in methods implementing form validation (GHSA-hcpw-v727-64qh)
Aliases: CVE-2023-3315
Published: 2023-06-19T21:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:teamconcert'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.2'}]}]}]

Jenkins Team Concert Plugin 2.4.1 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Team Concert Plugin 2.4.2 requires Overall/Administer permission for the affected form validation methods.